CyberHunter
LinkedIn profile - Bastien Cordier Email: contact@bastiencordier.pro
// Network services

Port 631: IPP / CUPS

Internet Printing Protocol, used by CUPS.

Internet Printing ProtocolCUPS
631

How IPP / CUPS works

Network services
computerprinterPrint-Job computerprinterPrint-Job

Print jobs are sent to the printer over port 631, which prints them as they arrive. Encryption is optional: traffic is only protected if TLS is enabled on the server and the client.

Transport
TCP · UDP
Exposure risk
6/10 high if reachable from the Internet
Encryption
Optional TLSTLS only if negotiated
IANA status
Assigned2 registered services
Range
Well-known (0-1023)
Category
Network services
01 Security

Is port 631 dangerous?

Common attacks and weaknesses

  • cups-browsed vulnerabilities (CVE-2024-47176 chain) allowing remote code execution over UDP 631.

How to secure it

  • Disable cups-browsed and block 631 from untrusted networks.
02 Registry

IANA registry entries for port 631

ServicePortTransportDescriptionReferenceUpdated
ipp 631 TCP, UDP IPP (Internet Printing Protocol) RFC 8011 2018-07-06
ipps 631 TCP Internet Printing Protocol over HTTPS RFC 8011 2018-07-06

// source: IANA service name and port number registry

03 Check it

Which program uses port 631, and is it reachable?

Linux

sudo ss -ltnup 'sport = :631'      # process listening on 631
sudo lsof -nP -i :631

macOS

sudo lsof -nP -i :631

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 631 -State Listen | Select LocalAddress, OwningProcess
Get-NetUDPEndpoint -LocalPort 631
netstat -ano | findstr :631

From another machine

nmap -p 631 -sV <host>
sudo nmap -sU -p 631 <host>
nc -zv <host> 631

Block it in the firewall

sudo ufw deny 631/tcp                                         # Linux (ufw)
New-NetFirewallRule -DisplayName "Block 631" -Direction Inbound -LocalPort 631 -Protocol TCP -Action Block  # Windows
04 FAQ
What is port 631 used for?

Internet Printing Protocol, used by CUPS.

Is port 631 TCP or UDP?

Port 631 is registered for TCP and UDP.

Is it safe to open port 631?

It is rated 6/10 (high) when exposed to the Internet. cups-browsed vulnerabilities (CVE-2024-47176 chain) allowing remote code execution over UDP 631. Disable cups-browsed and block 631 from untrusted networks.

How do I check if port 631 is open?

On Linux run "ss -ltnup 'sport = :631'", on macOS "lsof -nP -i :631", and on Windows "netstat -ano | findstr :631" to see the local process. From another machine, "nmap -p 631 <host>" shows whether it is reachable.

05 Related
:53 DNS tcp · udp · moderate risk :135 MS RPC tcp · udp · high risk :123 NTP udp · tcp · moderate risk :67 DHCP server udp · tcp · moderate risk :111 rpcbind tcp · udp · high risk :9100 Raw printing (JetDirect) tcp · udp · high risk :5353 mDNS udp · tcp · moderate risk :5355 LLMNR udp · tcp · high risk

Latest vulnerability news

All news