3389
Summary
- // if you see it open
- Among the most-attacked ports. BlueKeep (CVE-2019-0708) is a wormable pre-auth RCE in Remote Desktop Services on legacy Windows, patched May 2019 (CISA AA19-168A, NSA advisory). Relentless brute-force/credential-stuffing (~2M failed logins across 999 IPs over 15 days, Sophos) and a leading ransomware initial-access vector. Mitigations: never expose 3389 directly; VPN + MFA or RD Gateway; enforce NLA, account lockout, strong passwords; patch.
- // common applications
- Microsoft RDPxrdpFreeRDPmstscRemmina
- // analyst note
- Open 3389/tcp = RDP exposure and a high-risk finding when internet-facing. Verify NLA is enforced, check patch level for BlueKeep, review brute-force/lockout logs, and confirm whether it should be behind a VPN/gateway rather than public.
About port 3389/tcp.
Port 3389/tcp is the IANA-assigned home of Microsoft's Remote Desktop Protocol and one of the most-attacked ports on the internet. RDP provides graphical remote access to and control of Windows desktops and servers, transmitting screen images, keystrokes, and mouse input between the client (mstsc.exe) and the Remote Desktop Services host; it is an extension of the ITU-T T.128 application-sharing protocol and supports Network Level Authentication (NLA), encryption, multi-monitor, and clipboard/printer/audio redirection. The IANA service name is ms-wbt-server ("MS WBT Server", contact Jordan Marchese, Microsoft; both 3389/tcp and 3389/udp are officially registered), but the registry cites no RFC — the protocol is documented in Microsoft's open MS-RDPBCGR specification series. Two security facts dominate the picture. First, BlueKeep (CVE-2019-0708) is a wormable, pre-authentication remote-code-execution flaw in Remote Desktop Services on legacy Windows, patched in May 2019 and the subject of CISA advisory AA19-168A and an NSA advisory. Second, exposed RDP is a relentless brute-force target and a leading ransomware initial-access vector — Sophos observed roughly two million failed logins across 999 source IPs over fifteen days in one study. For an analyst, an open 3389/tcp is RDP exposure and a high-risk finding when internet-facing: verify NLA is enforced, check the patch level for BlueKeep, review brute-force/lockout logs, and confirm whether the service should sit behind a VPN or RD Gateway rather than be public.
- IANA assignment
ms-wbt-server— "MS WBT Server"; reference (blank — no RFC cited in IANA registry); governing spec Microsoft MS-RDPBCGR (not the IANA-cited reference); contact Jordan Marchese (Microsoft), modified 2022-11-03 [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- registered (1024–49151) — User Ports / Registered Ports range per RFC 6335 §6 [IANA-assigned] — RFC 6335, IANA registry header
- Prevalence
- nmap-services open-frequency 0.083904 (a very common open TCP port, typically top ~10) [Well-established] — nmap-services file
- Related ports
- 22 SSH (Unix/Linux remote-admin equivalent); 5900 VNC; 23 Telnet; 3389/udp
Primary use
Microsoft Remote Desktop Protocol — graphical remote access/control of Windows hosts; both TCP and UDP 3389 registered (UDP added for media/high-latency performance)
Other/unofficial uses
xrdp (open-source RDP server for Linux); registry-based port relocation (security-through-obscurity defeated by scanners)
Security implications
BlueKeep (CVE-2019-0708) wormable pre-auth RCE on legacy Windows (patched May 2019); relentless brute-force/credential-stuffing (~2M failed logins/999 IPs/15 days, Sophos); leading ransomware initial-access vector. Mitigate: never expose 3389 directly; VPN + MFA or RD Gateway; enforce NLA, lockout, strong passwords; patch
Typically seen on
Windows servers, RDS/VDI hosts, cloud Windows instances, workstations, MSP-managed systems
- Analyst note
- Open 3389/tcp = RDP exposure and a high-risk finding when internet-facing. Verify NLA is enforced, check patch level for BlueKeep, review brute-force/lockout logs, and confirm whether it should be behind a VPN/gateway rather than public.
About port 3389/udp.
Port 3389/udp is registered with IANA as ms-wbt-server ("MS WBT Server"), assignee [Jordan_Marchese], with a blank reference field — the same service-name registration that covers the much better-known 3389/tcp. The UDP side carries Microsoft's RDP-UDP transport, specified in the open document [MS-RDPEUDP], which was introduced with RDP 8.0 on Windows 8 and Windows Server 2012 R2 to run alongside the primary TCP 3389 Remote Desktop connection. When a session starts the client and server negotiate transports; if UDP 3389 is reachable it is preferred for its lower latency on WAN and wireless links, and if it is blocked the session falls back to TCP-only, so RDP keeps working either way. RDP-UDP runs in two sub-modes — Reliable (RDP-UDP-R, with retransmission) and Best-Efforts (RDP-UDP-L, without guaranteed delivery) — and Microsoft documents materially higher throughput versus TCP under the same conditions. For an analyst the port matters mostly because it is co-located with the heavily targeted TCP 3389 RDP surface: any host exposing RDP to the internet on TCP tends to expose UDP 3389 as well, and automated scanners sweep port 3389 constantly. An additional concern is that internet-reachable MS-RDPEUDP endpoints respond to unauthenticated handshake probes and have been documented as a DDoS reflection/amplification vector. The IANA reference field is blank — MS-RDPEUDP is a Microsoft open specification, not an IETF-standardized protocol, so no RFC is cited.
- IANA assignment
ms-wbt-server— "MS WBT Server"; reference (blank — no RFC cited in IANA registry); assignee[Jordan_Marchese]; dual-registered 3389/tcp + 3389/udp (TCP row carries Modification Date 2022-11-03, also no Reference)[Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry lines 6714–6715- Range class
- registered (1024–49151) [Confirmed] — port 3389 falls in the IANA registered range
- IANA reference
- blank (left blank in the registry; MS-RDPEUDP is a Microsoft open specification, not an IETF RFC) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry line 6715
- Related ports
- 3389/tcp (primary RDP transport, same service name); 3391/udp (RD Gateway external transport)
Primary use
RDP-UDP transport extension for Microsoft Remote Desktop Protocol; spec [MS-RDPEUDP], introduced with RDP 8.0 on Windows 8 / Windows Server 2012 R2; preferred for lower latency, falls back to TCP if blocked [Confirmed] — https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpeudp/2744a3ee-04fb-407b-a9e3-b3b2ded422b1 , https://techdirectarchive.com/2025/06/02/remote-desktop-connection-behaviour-over-udp-and-tcp/
Common software
Microsoft Remote Desktop Services (Windows 8+, Windows Server 2012 R2+); built-in Remote Desktop Connection client (mstsc.exe); Remote Desktop Gateway (UDP 3391 for external transport, 3389 internally)
Security implications
internet-reachable MS-RDPEUDP responds to unauthenticated handshake probes and is a documented DDoS reflection/amplification vector (BAF ≈ 85.9:1 per Ireland's NCSC); co-exposure with the heavily targeted TCP 3389 RDP surface; broad RDP attack surface (e.g. BlueKeep CVE-2019-0708 was TCP-side)
Typically seen on
Windows hosts running Remote Desktop Services with UDP transport enabled; internet-exposed RDP endpoints
- Sub-modes
- Reliable (RDP-UDP-R, retransmission) and Best-Efforts (RDP-UDP-L, no guaranteed delivery); Microsoft documents higher throughput vs TCP under the same conditions [Confirmed] — https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpeudp/2744a3ee-04fb-407b-a9e3-b3b2ded422b1
- Analyst note
- An open UDP 3389 almost always accompanies an internet-exposed RDP host; treat it as part of the RDP attack surface and as a potential amplification source — block unsolicited inbound UDP 3389 at the perimeter and deliver RDP via VPN or RD Gateway.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| ms-wbt-server | TCP | Microsoft Remote Display Protocol (aka ms-term-serv, microsoft-rdp) | 8.39% |
| ms-wbt-server | UDP | Microsoft Remote Display Protocol (aka ms-term-serv, microsoft-rdp) | 0.50% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.