3306
Summary
- // if you see it open
- Perennial scan/brute-force target (root/app accounts); hundreds of thousands of internet-exposed instances; MySQL-targeting ransomware has wiped/encrypted reachable databases. Bind to localhost/trusted networks and require TLS.
- // common applications
- MySQLMariaDBPercona Server
- // analyst note
- An internet-facing 3306 is almost always a misconfiguration and a high-priority finding; validate authentication, TLS, and bind address.
About port 3306/tcp.
Port 3306/tcp is the default listener for MySQL Server and MariaDB (which shares MySQL's classic client/server protocol), and one of the most commonly observed open database ports on the internet. Unusually for a famous application default, the port is cleanly registered to the database's author: the IANA row gives the service name mysql with description "MySQL" and lists the assignee and contact as "Monty" — Michael "Monty" Widenius, MySQL's co-creator. The wire protocol begins with a server-sent handshake packet (capability flags and a salt), to which the client replies selecting an authentication plugin; historically that was mysql_native_password, while caching_sha2_password is the default from MySQL 8.0 onward. A separate, newer X Protocol (document/CRUD plus SQL over a different framing) runs on port 33060 (mysqlx, registered to Oracle in 2015), and MySQL 8.0.14+ additionally supports a dedicated administrative-connection port. The IANA reference field for 3306 is blank, so there is no RFC tied to the assignment. Security-wise, 3306 is a perennial scan and brute-force target: exposed instances number in the hundreds of thousands and are probed for weak root/application credentials, and MySQL-targeting ransomware has wiped or encrypted reachable databases and left ransom notes. Best practice is to bind to localhost or trusted networks and require TLS. For an analyst, an internet-facing 3306 is almost always a misconfiguration and a high-priority finding — validate authentication, TLS, and bind address.
- IANA assignment
mysql— "MySQL"; reference (blank — no RFC cited in IANA registry); assignee/contact "Monty" (Michael Widenius) [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- registered (1024–49151)
- Prevalence
- among the most common open database ports (de-facto, nmap-services) [Well-established] — nmap-services file
- Related ports
- 33060 (
mysqlx, MySQL X Protocol, Oracle 2015); 1186 (mysql-cluster); 6446 (mysql-proxy); MySQL 8 admin port (configurable)
Primary use
default MySQL Server / MariaDB listener
Other/unofficial uses
any MySQL-protocol-compatible server (MariaDB, Percona, cloud-managed MySQL) [Well-established]
Security implications
brute-force of root/app accounts; hundreds of thousands of exposed instances; MySQL-targeting ransomware; bind-to-localhost + TLS recommended
Typically seen on
database servers, application backends, Docker/Kubernetes containers, managed-DB endpoints
- Analyst note
- An internet-facing 3306 is almost always a misconfiguration and a high-priority finding; validate authentication, TLS, and bind address.
About port 3306/udp.
Port 3306/udp is registered with IANA as mysql with the description "MySQL," assignee "[Monty]" (Michael "Monty" Widenius, MySQL's co-founder, listed as monty&analytikerna.se), and a blank reference field. The assignment is dual-registered: both 3306/tcp and 3306/udp carry the same service name, description, assignee, and contact, so the UDP entry exists as a paired reservation alongside the TCP entry that database clients actually use. In practice MySQL's client-server wire protocol runs exclusively over TCP, and no standard MySQL build opens a UDP listener on 3306 — the same is true of the major derivatives MariaDB and Percona Server, all of which use 3306/tcp for client connections, replication, and tooling (mysqldump, mysqlpump, MySQL Shell, the Connectors). The UDP registration therefore has no known active use; it is the conventional "reserve both transports" artifact that IANA records for many service assignments. For an analyst, that asymmetry is the whole story: port 3306 is one of the most heavily probed numbers on the internet, but essentially all of that attention is TCP-side. Internet-wide scanners (Shodan, Censys) and the SANS Internet Storm Center honeypot network track 3306 as a high-priority target, and the recorded traffic is overwhelmingly TCP credential-stuffing, brute-force login, and exploit probes against exposed MySQL instances — older MySQL versions carried remote-exploit CVEs, and the standing risk is a database left reachable on the public internet with weak or default credentials. UDP probes to 3306 are uncommon and are generally incidental to broad UDP sweeps rather than MySQL-specific attacks. The practical guidance is unchanged across every source: keep 3306 off the public internet and reach the database over private networking or a VPN. A responsive 3306/udp specifically is anomalous and worth investigating, since no mainstream MySQL software is expected to answer there.
- IANA assignment
mysql— "MySQL"; reference (blank — no RFC cited in IANA registry); assignee/contact "[Monty]" (Michael Widenius,monty&analytikerna.se); dual-registered 3306/tcp + 3306/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry line 6565)- Range class
- registered (1024–49151)
- Registration / modification date
- blank in the IANA CSV — null, not fabricated [Confirmed] — IANA registry CSV
- Related ports
- 3306/tcp (the active MySQL port); 5432 (PostgreSQL), 1433 (MS SQL Server), 1521 (Oracle), 27017 (MongoDB) for database-port contrast
Primary use
paired UDP reservation for MySQL; the MySQL wire protocol runs over TCP only and no standard build opens a UDP listener on 3306
Other/unofficial uses
none known for UDP; MySQL, MariaDB, and Percona Server all use 3306/tcp for client connections, replication, and tooling
Security implications
3306 is a high-priority scanner target (Shodan, Censys, SANS ISC), but observed attack traffic is overwhelmingly TCP brute-force / credential-stuffing / exploit probes against exposed MySQL; UDP probes are incidental to broad sweeps; primary risk is a publicly reachable database with weak credentials; older MySQL versions carried remote CVEs
Typically seen on
hosts running MySQL/MariaDB/Percona (on TCP); a responsive 3306/udp is anomalous
- Analyst note
- Treat the UDP registration as a paired reservation with no expected live service. An open/answering 3306/udp does not match any mainstream MySQL behavior — investigate it rather than assuming a normal database service.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| mysql | TCP | — | 4.54% |
| mysql | UDP | — | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.