CyberHunter
LinkedIn profile - Bastien Cordier Email: contact@bastiencordier.pro
// Messaging & queues

Port 5672: AMQP (RabbitMQ)

AMQP message broker (RabbitMQ); the management UI runs on 15672.

RabbitMQ
5672

How AMQP (RabbitMQ) works

Messaging & queues
producerconsumerqueuepublish producerconsumerqueuepublish

Producers publish messages into a queue on port 5672; consumers pick them up in order, at their own pace. Encryption is optional: traffic is only protected if TLS is enabled on the server and the client.

Transport
TCP · UDP · SCTP
Exposure risk
6/10 high if reachable from the Internet
Encryption
Optional TLSTLS only if negotiated
IANA status
Assigned1 registered service
Range
Registered (1024-49151)
Category
Messaging & queues
01 Security

Is port 5672 dangerous?

Common attacks and weaknesses

  • Default guest/guest account.
  • Messages readable without TLS.

How to secure it

  • Delete the guest account, enable TLS (5671) and restrict clients.
02 Registry

IANA registry entries for port 5672

ServicePortTransportDescriptionReferenceUpdated
amqp 5672 TCP, UDP, SCTP AMQP - 2006-01

// source: IANA service name and port number registry

03 Check it

Which program uses port 5672, and is it reachable?

Linux

sudo ss -ltnup 'sport = :5672'      # process listening on 5672
sudo lsof -nP -i :5672

macOS

sudo lsof -nP -i :5672

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 5672 -State Listen | Select LocalAddress, OwningProcess
Get-NetUDPEndpoint -LocalPort 5672
netstat -ano | findstr :5672

From another machine

nmap -p 5672 -sV <host>
sudo nmap -sU -p 5672 <host>
nc -zv <host> 5672

Block it in the firewall

sudo ufw deny 5672/tcp                                         # Linux (ufw)
New-NetFirewallRule -DisplayName "Block 5672" -Direction Inbound -LocalPort 5672 -Protocol TCP -Action Block  # Windows
04 FAQ
What is port 5672 used for?

AMQP message broker (RabbitMQ); the management UI runs on 15672.

Is port 5672 TCP or UDP?

Port 5672 is registered for TCP and UDP and SCTP. In practice the service mostly uses TCP.

Is it safe to open port 5672?

It is rated 6/10 (high) when exposed to the Internet. Default guest/guest account. Delete the guest account, enable TLS (5671) and restrict clients.

How do I check if port 5672 is open?

On Linux run "ss -ltnup 'sport = :5672'", on macOS "lsof -nP -i :5672", and on Windows "netstat -ano | findstr :5672" to see the local process. From another machine, "nmap -p 5672 <host>" shows whether it is reachable.

05 Related
:9092 Apache Kafka tcp · udp · high risk :2181 ZooKeeper tcp · udp · high risk :15672 RabbitMQ management tcp · high risk :1881 IBM WebSphere MQ Everyplace tcp · udp :2230 MetaSoft Job Queue Administration Service tcp · udp :2664 Patrol for MQ GM tcp · udp :2665 Patrol for MQ NM tcp · udp :2873 PubSub Realtime Telemetry Protocol tcp · udp

Latest vulnerability news

All news