Port 631 (IPP / CUPS)

Internet Printing Protocol; CUPS listens on TCP 631 and cups-browsed on UDP 631.

Well-known (system) port, 0-1023 TCPUDP Printing Localhost or LAN only

What port 631 is used for

Internet Printing Protocol; CUPS listens on TCP 631 and cups-browsed on UDP 631.

Security: should port 631 be open?

Localhost or LAN only. Never expose. In 2024 a chain of cups-browsed bugs (CVE-2024-47176 and others) allowed remote code execution from UDP 631, and open IPP printers can be used for DDoS amplification. Disable cups-browsed if you do not need it.

IANA assignment

Service nameProtoDescriptionAssigneeReference

ipp TCP IPP (Internet Printing Protocol)
Defined TXT keys: See BonjourPrinting.pdf. IESG RFC 8011

ipps TCP Internet Printing Protocol over HTTPS IESG RFC 8011

ipp UDP IPP (Internet Printing Protocol)
Defined TXT keys: See BonjourPrinting.pdf. IESG RFC 8011

Registry dates for this port: registered 2018-07-06, last modified 2018-07-06.

Check what is listening on port 631

Linux: is anything listening on TCP 631?

sudo ss -tlnp 'sport = :631'

Linux: UDP 631

sudo ss -ulnp 'sport = :631'

Linux / macOS: which process owns the port

sudo lsof -nP -i :631

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':631 '

Windows (Command Prompt)

netstat -ano | findstr :631

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 631 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine

nc -vz -w 5 HOST 631

From Windows

Test-NetConnection HOST -Port 631

UDP probe (no reply does not prove it is closed)

nc -vzu -w 5 HOST 631

Block port 631 in the firewall

ufw

sudo ufw deny 631/tcp

iptables

sudo iptables -A INPUT -p tcp --dport 631 -j DROP

nftables

sudo nft add rule inet filter input tcp dport 631 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'Block TCP 631' -Direction Inbound -Protocol TCP -LocalPort 631 -Action Block

ufw

sudo ufw deny 631/udp