1723

Port 1723/tcp is the control-channel port for PPTP, registered with IANA as pptp with the description "pptp" (literally lowercase, not the spelled-out protocol name), assignee Ken Crocker (Microsoft), reference [RFC2637], with a modification date of 2021-09-21. PPTP is a VPN tunneling protocol specified in RFC 2637 (July 1999), developed by a Microsoft-led vendor consortium; it uses a TCP 1723 control channel to set up and manage the tunnel, plus GRE (IP protocol 47, not a TCP/UDP port) to carry the encapsulated PPP data. Authentication is via PAP/CHAP/MS-CHAP/MS-CHAPv2, and encryption via MPPE (RC4-based). A practical detail for triage: a host can answer on TCP/1723 while the tunnel still fails because GRE/47 is being filtered upstream. The defining fact for this page is that PPTP is cryptographically broken. At DEF CON 20 in July 2012, Moxie Marlinspike and David Hulton presented "Divide and Conquer: Cracking MS-CHAPv2," reducing the security of an MS-CHAPv2 handshake to a single DES key; their chapcrack tool parses a captured handshake (from a PPTP VPN or WPA2-Enterprise session) into a token that the CloudCracker service then solved on FPGA hardware with a 100% success rate, in a worst case on the order of a day. Recovering the MD4 hash decrypts the entire capture and allows authentication, which is why the researchers' guidance was blunt: treat PPTP traffic as effectively unencrypted, and retire MS-CHAPv2. PPTP/MPPE is deprecated; modern guidance favors WireGuard, IPsec/IKEv2, or OpenVPN. For an analyst, an open 1723 indicates a legacy PPTP VPN gateway or router and should be treated as a high-priority finding: exposed endpoints are credential-crackable, so confirm whether GRE/47 is also reachable and prioritize migration off PPTP.

IANA assignment

pptp — "pptp"; reference [RFC2637]; assignee Ken Crocker (Microsoft); modification date 2021-09-21; registered for 1723/tcp and 1723/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry (verified verbatim from live registry)

Range class

registered (1024–49151)

Prevalence

among the more commonly open TCP ports — nmap-services open-frequency ~0.0325 (de-facto) [Well-established] — nmap-services file

Related ports / VPN family

GRE = IP protocol 47 (PPTP data channel, not a port); 1701 (L2TP); 500 + 4500 (IPsec IKE/NAT-T); 1194 (OpenVPN); 51820 (WireGuard)

Primary use

PPTP VPN control channel

Other/unofficial uses

legacy remote-access VPN on routers/gateways [Well-established]

Security implications

cryptographically broken — MS-CHAPv2 reduced to a single DES key (Marlinspike & Hulton, DEF CON 20, July 2012; chapcrack + CloudCracker, 100% success, ~1 day worst case); MPPE/PPTP deprecated; treat PPTP as effectively unencrypted; CVE-2012-4445 among relevant CVEs

Typically seen on

legacy VPN gateways, routers/firewalls with PPTP enabled

Analyst note

An open 1723 indicates a legacy PPTP VPN gateway/router; treat as high-priority. PPTP/MS-CHAPv2 is breakable — confirm whether GRE/47 is reachable and prioritize migrating to WireGuard/IPsec-IKEv2/OpenVPN.

Port 1723/udp is registered with IANA as pptp ("pptp"), assignee Ken Crocker, reference RFC 2637, and is dual-registered alongside 1723/tcp (the IANA CSV modification date is 2021-09-21; the registration-date column is blank). The catch worth flagging up front is that the UDP entry is a mirror registration only: RFC 2637 — "Point-to-Point Tunneling Protocol (PPTP)" (Hamzeh et al., July 1999, Informational) — specifies port 1723 over TCP for the PPTP control connection and uses GRE (Generic Routing Encapsulation, IP protocol 47) to carry the encapsulated PPP data frames. UDP 1723 appears nowhere in RFC 2637 and corresponds to no documented real-world implementation; every known PPTP client and server uses TCP 1723 plus GRE/47, not UDP. PPTP itself was built by a Microsoft-led vendor consortium in the late 1990s and shipped natively in Windows from the Windows 95 OSR2 / NT 4.0 era, in Windows Server RRAS, in pptpd (PoPToP) on Linux, and in macOS's built-in VPN client until Apple removed PPTP in macOS Sierra 10.12 (2016). The protocol is now considered cryptographically broken and is widely deprecated: MS-CHAPv2 (its default authentication) is crackable offline in under a day, MPPE relies on RC4 and is open to bit-flipping, and there is no forward secrecy — guidance since at least 2012 has been to drop PPTP for IKEv2/IPsec, OpenVPN, or WireGuard. For an analyst, those security concerns and the active internet scanning attach to TCP 1723 + GRE/47; UDP 1723 specifically has no observed scanning campaigns or Shodan exposure data, consistent with the absence of real UDP usage. Treat a responsive 1723/udp as anomalous rather than as a normal PPTP control channel.

IANA assignment

pptp — service name "pptp"; reference RFC 2637; assignee Ken Crocker; dual-registered 1723/tcp + 1723/udp; IANA CSV modification date 2021-09-21, registration-date column blank [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry)

Range class

registered (1024–49151)

Related ports

GRE / IP protocol 47 (PPTP data channel); contrast modern VPN ports (IKE/IPsec 500/4500, OpenVPN 1194, WireGuard 51820)

Primary use

PPTP VPN tunneling — but the *registered protocol's actual control channel runs on TCP 1723*, not UDP; UDP 1723 has no documented use [Confirmed for the TCP protocol; UDP-use is null] — RFC 2637

Protocol mechanics

PPTP uses two channels — a TCP control connection on port 1723 for session setup/management and a GRE (IP protocol 47) tunnel for the PPP data payload; RFC 2637 is Informational, not an IETF standard

Common software

Windows native PPTP client/server (Win95 OSR2 / NT 4.0+), Windows Server RRAS, pptpd (PoPToP) and NetworkManager-pptp on Linux, legacy Cisco/3Com/Ascend appliances, macOS built-in VPN client (PPTP removed in macOS Sierra 10.12, 2016)

Security implications

PPTP is cryptographically broken/deprecated — MS-CHAPv1 leaks NT hashes; MS-CHAPv2 is crackable offline in <24h; MPPE uses RC4 and is bit-flip-vulnerable; no forward secrecy; community consensus since ~2012 is to migrate to IKEv2/IPsec, OpenVPN, or WireGuard. These apply to TCP 1723 + GRE/47

Exposure / scanning

TCP 1723 is actively scanned and indexed by Shodan as a known PPTP attack surface; for UDP 1723 specifically no scanning campaigns or Shodan exposure data were found — firewall guidance blocks TCP 1723 + GRE/47 and does not separately call out UDP 1723

UDP-specific note

no real protocol or software is known to use UDP 1723; the IANA UDP entry is a conventional mirror of the TCP registration [Confirmed] — RFC 2637, IANA registry

Analyst note

A responsive 1723/udp is anomalous — real PPTP is TCP 1723 + GRE/47; investigate rather than assume a normal PPTP control channel.