Common attacks and weaknesses
- Log injection if client certificates are not checked.
Port 6514: Syslog over TLS
Encrypted syslog transport.
6514
How Syslog over TLS works
Monitoring & loggingThe monitoring server collects metrics, alerts or logs from devices over port 6514. Everything is encrypted: someone on the path only sees unreadable bytes.
- Transport
- TCP · UDP · DCCP
- Exposure risk
- 2/10 low if reachable from the Internet
- Encryption
- EncryptedTLS or built-in crypto
- IANA status
- Assigned1 registered service
- Range
- Registered (1024-49151)
- Category
- Monitoring & logging
Is port 6514 dangerous?
How to secure it
- Use mutual TLS between log sources and collectors.
IANA registry entries for port 6514
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| syslog-tls | 6514 | TCP, UDP, DCCP | Syslog over TLS | RFC 5425 | - |
// source: IANA service name and port number registry
Which program uses port 6514, and is it reachable?
Linux
sudo ss -ltnup 'sport = :6514' # process listening on 6514
sudo lsof -nP -i :6514macOS
sudo lsof -nP -i :6514
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 6514 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 6514 netstat -ano | findstr :6514
From another machine
nmap -p 6514 -sV <host> sudo nmap -sU -p 6514 <host> nc -zv <host> 6514
Block it in the firewall
sudo ufw deny 6514/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 6514" -Direction Inbound -LocalPort 6514 -Protocol TCP -Action Block # Windows
What is port 6514 used for?
Encrypted syslog transport.
Is port 6514 TCP or UDP?
Port 6514 is registered for TCP and UDP and DCCP. In practice the service mostly uses TCP.
Is it safe to open port 6514?
It is rated 2/10 (low) when exposed to the Internet. Log injection if client certificates are not checked. Use mutual TLS between log sources and collectors.
How do I check if port 6514 is open?
On Linux run "ss -ltnup 'sport = :6514'", on macOS "lsof -nP -i :6514", and on Windows "netstat -ano | findstr :6514" to see the local process. From another machine, "nmap -p 6514 <host>" shows whether it is reachable.