1434

Port 1434/tcp is registered with IANA as ms-sql-m with the description "Microsoft-SQL-Monitor," assignee and contact Peter Hussey (Microsoft), and a blank reference field; it is dual-registered on TCP and UDP (1434/tcp + 1434/udp). In real-world SQL Server operation the functionally active side is UDP, not TCP: the SQL Server Browser service (sqlbrowser.exe) binds UDP 1434 and answers client discovery probes using the SQL Server Resolution Protocol (SSRP). When a client needs a named instance running on a dynamic TCP port, it sends a UDP packet to 1434 and the Browser replies with that instance's TCP port or named pipe — the database engine itself listens on TCP 1433 (default instance) or a separately assigned dynamic port, never on TCP 1434. So TCP 1434 is a real IANA assignment but operationally dormant; the security weight sits on UDP 1434. That UDP service is historically significant: the SQL Slammer worm (January 2003) exploited a stack buffer overflow in the SQL Server Resolution Service via UDP 1434 (CVE-2002-0649, patched by MS02-039 on 2002-07-24) using a 376-byte UDP payload, and caused widespread internet disruption without ever opening a TCP connection. Beyond Slammer, an unauthenticated UDP probe to 1434 makes the Browser disclose every instance name, version, and listening port on the host (reconnaissance), and the service can be abused as a UDP amplification reflector. Microsoft ships the Browser disabled by default for default instances and enabled only when a named or SSAS instance is present, and recommends disabling it with static ports. For an analyst, an exposed 1434 (especially UDP) is a well-known MSSQL discovery target indexed by Shodan and probed by Metasploit's mssql_ping before credential attacks on TCP 1433.

IANA assignment

ms-sql-m — "Microsoft-SQL-Monitor"; reference (blank — no RFC cited in IANA registry); assignee/contact Peter Hussey; dual-registered 1434/tcp + 1434/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry lines 2552–2553)

Range class

registered (1024–49151) — 1434 is in the registered range, not well-known [Confirmed]

Related ports

1433/tcp (ms-sql-s, the SQL Server engine listener); named instances use dynamic TCP ports advertised via 1434

Primary use

SQL Server Browser / SSRP instance discovery — in practice UDP-bound; TCP 1434 is registered but not used by SQL Server in normal operation (engine listens on TCP 1433 or a dynamic port)

Common software

Microsoft SQL Server (all editions incl. Express and SSAS); sqlbrowser.exe is the specific Windows service; not present on Linux SQL Server

Security implications

SQL Slammer (Jan 2003) via UDP 1434 — CVE-2002-0649 / MS02-039 (patched 2002-07-24); unauthenticated instance enumeration (names/versions/ports); UDP amplification reflector; Browser disabled by default for default instances, enabled for named/SSAS

Exposure/scanning

well-known MSSQL discovery target; Shodan indexes SSRP responders on UDP 1434; Metasploit mssql_ping enumerates instances over UDP 1434 before TCP 1433 credential attacks; most ISPs/clouds block UDP 1434 at the edge post-Slammer; cloud compliance frameworks flag open inbound TCP/UDP 1434

Analyst note

An exposed 1434 indicates a reachable SQL Server deployment; treat UDP 1434 as the active/risky side, restrict to trusted IPs or use static ports + disable the Browser.

Port 1434/udp is registered with IANA as ms-sql-m with the description "Microsoft-SQL-Monitor," assignee and contact both listed as Peter Hussey, and a blank reference field; it is dual-registered, with identical service name, description, assignee, and contact on both 1434/tcp and 1434/udp. In practice the UDP listener is the SQL Server Browser service (historically the SQL Server Resolution Service, or SSRP). When a client connects to a named Microsoft SQL Server instance without specifying a TCP port, it sends a short UDP datagram to port 1434 asking which TCP port that named instance is listening on; the Browser service (sqlbrowser.exe) replies with the dynamic TCP port, so clients need not hard-code dynamic ports in connection strings. The same mechanism backs the "Browse" instance-enumeration button in Management Studio. For an analyst, 1434/udp carries outsized security weight relative to its mundane function. Any unauthenticated host that can reach it can enumerate instance names, versions, and listening TCP ports — useful reconnaissance for targeted attacks. CVE-2002-0649 (Microsoft MS02-039, patch released July 24, 2002) was a buffer overflow in the SQL Server 2000 Resolution Service that allowed remote code execution via a crafted UDP packet to this port; that flaw was weaponized by the SQL Slammer worm on January 25, 2003, a 376-byte UDP-only worm that propagated with no TCP handshake, reached an estimated 55 million scans per second, and compromised roughly 75,000 internet-exposed SQL Server hosts within minutes — one of the fastest-spreading worms on record. Emergency UDP-1434 filters deployed by ISPs during Slammer remain on much backbone infrastructure to this day, which incidentally suppresses later reflection/amplification attempts (the Browser service's multi-line reply to a short query gives a modest amplification ratio). SANS ISC shows continuous low-level background scanning of the port, consistent with automated SQL Server fingerprinting; as of June 2026 the ISC threat level is green. Microsoft disables the Browser service by default and recommends blocking UDP 1434 at the perimeter unless named instances must be externally reachable — and even then prefers fixed static TCP ports with the Browser service off.

IANA assignment

ms-sql-m — "Microsoft-SQL-Monitor"; reference (blank — no RFC cited in IANA registry); assignee/contact Peter Hussey; dual-registered 1434/tcp + 1434/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry, lines 2552–2553); https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=1434

Range class

well-known (0–1023)? No — 1434 is in the registered range (1024–49151) [Confirmed]

Related ports

1433/tcp (ms-sql-s, default SQL Server engine port); contrast static-port deployments

Primary use

SQL Server Browser service / SQL Server Resolution Service (SSRP) — clients query UDP 1434 to discover the dynamic TCP port of a named SQL Server instance [Confirmed] — https://learn.microsoft.com/en-us/sql/sql-server/install/configure-the-windows-firewall-to-allow-sql-server-access ; https://www.sqlnethub.com/blog/sql-server-browser-service-udp-port-1434/

Common software

Microsoft SQL Server (2000 onward, incl. Express and MSDE); the listener is the Windows SQL Server Browser service (sqlbrowser.exe)

Security implications

unauthenticated instance/version/port enumeration (recon); CVE-2002-0649 / MS02-039 buffer overflow → RCE (patch July 24, 2002); SQL Slammer worm Jan 25, 2003 (UDP-only, ~376 bytes, ~75,000 hosts in minutes); legacy ISP UDP-1434 filters persist; modest reflection/amplification potential

Default state

SQL Server Browser service disabled by default as a security best practice [Likely] — single source; https://www.sqlnethub.com/blog/sql-server-browser-service-udp-port-1434/

Scanning posture

continuous low-level background scanning; SANS ISC threat level green as of June 2026 [Confirmed] — https://isc.sans.edu/port.html?port=1434

Firewall recommendation

block UDP 1434 at the perimeter unless named instances need external reach; prefer fixed static TCP ports + Browser service off; restrict to trusted subnets when open [Confirmed] — Microsoft Learn; sqlnethub

Analyst note

an exposed, responsive 1434/udp on the public internet is a SQL Server fingerprint and a recon foothold — treat as misconfiguration/attack-surface, not normal external service.