Port 6514 (Syslog over TLS)

Syslog transport over TLS (RFC 5425), used to ship logs between sites or to a SaaS collector.

Registered (user) port, 1024-49151 TCP Monitoring and logging Expose only to trusted sources

What port 6514 is used for

Syslog transport over TLS (RFC 5425), used to ship logs between sites or to a SaaS collector.

Expose only to trusted sources. Use mutual TLS or an allowlist so only your hosts can send logs.

Service nameProtoDescriptionAssigneeReference

syslog-tls TCP Syslog over TLS - RFC 5425

syslog-tls UDP syslog over DTLS - RFC 6012

syslog-tls DCCP syslog over DTLS - RFC 6012

Linux: is anything listening on TCP 6514?

sudo ss -tlnp 'sport = :6514'

Linux / macOS: which process owns the port

sudo lsof -nP -i :6514

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':6514 '

Windows (Command Prompt)

netstat -ano | findstr :6514

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 6514 -State Listen | Select LocalAddress,OwningProcess

From another machine

nc -vz -w 5 HOST 6514

From Windows

Test-NetConnection HOST -Port 6514

Replace 203.0.113.10 with the address or network you trust. With ufw, make sure the default incoming policy is deny.

ufw (one trusted source)

sudo ufw allow from 203.0.113.10 to any port 6514 proto tcp

iptables

sudo iptables -A INPUT -p tcp --dport 6514 -s 203.0.113.10 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 6514 -j DROP

nftables

sudo nft add rule inet filter input ip saddr 203.0.113.10 tcp dport 6514 accept
sudo nft add rule inet filter input tcp dport 6514 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'TCP 6514 trusted' -Direction Inbound -Protocol TCP -LocalPort 6514 -RemoteAddress 203.0.113.10 -Action Allow

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.