1433
Summary
- // if you see it open
- Perennial top brute-force target (sa account). Post-compromise RCE via xp_cmdshell. Major ransomware initial-access vector (GhostCringe-style, Trigona, mass brute-force). Historical note: SQL Slammer (Jan 2003) exploited UDP 1434 (Browser/Monitor), NOT 1433.
- // common applications
- Microsoft SQL ServerAzure SQLsqlcmdSSMS
- // analyst note
- An internet-facing 1433 is high-risk; expect brute-force and ransomware targeting. Verify
sais disabled/strong, restrict to VPN/LAN, and close 1434/udp if using static ports.
About port 1433/tcp.
Port 1433/tcp is the default instance listener for the Microsoft SQL Server Database Engine, registered with IANA as ms-sql-s ("Microsoft-SQL-Server") to Microsoft. Named instances, by contrast, use dynamic ports in the 49152–65535 range, brokered by the SQL Server Browser service on the neighbor port 1434/udp (ms-sql-m, "Microsoft-SQL-Monitor"), which resolves an instance name to its current port. The application-layer protocol is Tabular Data Stream (TDS): a client authenticates via Windows Authentication (AD/Kerberos) or SQL Server Authentication (such as the sa account) before exchanging queries, and channel encryption with TLS is recommended. The IANA reference field for 1433 is blank, so no RFC is tied to the assignment. Security-wise, 1433 is among the most-attacked ports on the internet: it was a top-ranked attacked port in the early 2000s and remains a leading brute-force target (especially the sa account), with post-compromise remote code execution classically achieved by enabling xp_cmdshell. MSSQL is a significant ransomware initial-access vector, with vendor-reported campaigns including GhostCringe-style payloads, Trigona, and ongoing mass brute-force operations. A frequent point of historical confusion is worth stating plainly: the SQL Slammer worm of January 2003 exploited a buffer overflow reached via UDP port 1434 (the Monitor/Browser port), not 1433. For an analyst, an internet-facing 1433 is high-risk — verify that sa is disabled or strong, restrict access to VPN/LAN, and close 1434/udp if using static ports.
- IANA assignment
ms-sql-s— "Microsoft-SQL-Server"; reference (blank — no RFC cited in IANA registry); assignee Microsoft [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- registered (1024–49151)
- Prevalence
- among the most commonly attacked database ports (de-facto, nmap-services) [Well-established] — nmap-services file
- Related ports
- 1434/udp (
ms-sql-m, SQL Server Browser); named-instance dynamic ports (49152–65535)
Primary use
default-instance listener for the SQL Server Database Engine (TDS)
Other/unofficial uses
named instances use dynamic ports brokered by 1434/udp [Well-established]
Security implications
perennial brute-force (sa account); xp_cmdshell RCE post-auth; major ransomware initial-access vector (GhostCringe-style, Trigona); SQL Slammer (2003) was 1434/udp, not 1433
Typically seen on
Windows database servers, application backends, managed SQL Server (note: Azure SQL fronts differently)
- Analyst note
- An internet-facing 1433 is high-risk; expect brute-force and ransomware targeting. Verify
sais disabled/strong, restrict to VPN/LAN, and close 1434/udp if using static ports.
About port 1433/udp.
Port 1433/udp is registered with IANA as ms-sql-s with the description "Microsoft-SQL-Server," with a blank reference field. The registration is a dual one: 1433 is listed for both tcp and udp under the identical service name ms-sql-s and description Microsoft-SQL-Server. In practice the UDP side of this registration carries no active service. Microsoft SQL Server's Database Engine accepts client connections over TCP/1433 using the TDS (Tabular Data Stream) protocol; the only UDP port SQL Server actually uses is 1434, the SQL Server Browser service, which answers named-instance discovery requests. So 1433/udp is best understood as a legacy IANA dual-registration with no corresponding real-world implementation rather than a port carrying live UDP traffic. For an analyst this matters mostly because it clears up a common confusion: the well-known security exposure attached to "1433" lives entirely on TCP/1433, the publicly reachable MSSQL endpoint that brute-force, SQL-injection, and credential-stuffing campaigns target. Internet-scanning telemetry (SANS ISC, Shodan) and vendor advisories track TCP/1433, not 1433/udp; SANS ISC reports steady daily probing of TCP/1433 against exposed MSSQL hosts. The historically infamous MSSQL UDP exploit — the 2003 SQL Slammer worm — abused UDP/1434 (the Browser/Resolution service), not 1433/udp. There is no documented scanning, malware, or exploitation literature specific to 1433/udp. An administrator blocking TCP/1433 to keep SQL Server off the public internet need not treat 1433/udp as a separate concern, and a responsive 1433/udp is far more likely an artifact of a permissive firewall or a generic port responder than a real MSSQL service.
- IANA assignment
ms-sql-s— "Microsoft-SQL-Server"; reference (blank — no RFC cited in IANA registry); assignee blank; dual-registered 1433/tcp + 1433/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry, line 2551)- Range class
- registered (1024–49151)
- Prevalence
- no meaningful real-world 1433/udp traffic; scanning telemetry and advisories track TCP/1433 exclusively [Confirmed] — SANS ISC port report (isc.sans.edu/data/port/1433)
- Related ports
- 1433/tcp (the live MSSQL Database Engine endpoint); 1434/udp (SQL Server Browser, named-instance discovery; SQL Slammer target)
Primary use
no active UDP service — IANA-registered name only; real MSSQL Database Engine traffic uses TCP/1433 (TDS protocol), and SQL Server's only UDP port is 1434 (SQL Server Browser, named-instance discovery)
Other/unofficial uses
none documented for UDP; the dual TCP+UDP registration is a historical IANA artifact
Security implications
1433/udp carries no active service and presents no documented direct attack surface; the security risk associated with this port number resides on TCP/1433 (MSSQL brute-force, SQL injection, credential attacks against exposed instances). The notable MSSQL UDP exploit, SQL Slammer (2003), targeted UDP/1434, not 1433/udp
Typically seen on
nothing specific — a responsive 1433/udp is usually a firewall/responder artifact rather than a real MSSQL service
- Analyst note
- Treat "1433" risk as a TCP/1433 concern. 1433/udp is an IANA dual-registration artifact with no active service; blocking TCP/1433 addresses the actual MSSQL exposure.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| ms-sql-s | UDP | Microsoft-SQL-Server | 3.68% |
| ms-sql-s | TCP | Microsoft-SQL-Server | 0.79% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.