Common attacks and weaknesses
- Classic botnet command and control channel; outbound IRC from servers is suspicious.
Port 6667: IRC
Internet Relay Chat (6697 for TLS).
6667
How IRC works
Voice & chatMessages go back and forth between clients through the chat server on port 6667. It travels in clear text: anyone on the path can read it.
- Transport
- TCP
- Exposure risk
- 6/10 high if reachable from the Internet
- Encryption
- Clear textreadable on the network
- IANA status
- Assigned1 registered service
- Range
- Registered (1024-49151)
- Category
- Voice & chat
Is port 6667 dangerous?
How to secure it
- Alert on unexpected outbound connections to IRC ports.
IANA registry entries for port 6667
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| ircu | 6665-6669 | TCP | IRCU | - | - |
// source: IANA service name and port number registry
Which program uses port 6667, and is it reachable?
Linux
sudo ss -ltnup 'sport = :6667' # process listening on 6667
sudo lsof -nP -i :6667macOS
sudo lsof -nP -i :6667
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 6667 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 6667 netstat -ano | findstr :6667
From another machine
nmap -p 6667 -sV <host> nc -zv <host> 6667
Block it in the firewall
sudo ufw deny 6667/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 6667" -Direction Inbound -LocalPort 6667 -Protocol TCP -Action Block # Windows
What is port 6667 used for?
Internet Relay Chat (6697 for TLS).
Is port 6667 TCP or UDP?
Port 6667 is registered for TCP.
Is it safe to open port 6667?
It is rated 6/10 (high) when exposed to the Internet. Classic botnet command and control channel; outbound IRC from servers is suspicious. Alert on unexpected outbound connections to IRC ports.
How do I check if port 6667 is open?
On Linux run "ss -ltnup 'sport = :6667'", on macOS "lsof -nP -i :6667", and on Windows "netstat -ano | findstr :6667" to see the local process. From another machine, "nmap -p 6667 <host>" shows whether it is reachable.