5060

Port 5060/tcp is registered with IANA as sip ("SIP") with reference [RFC3263] and a modification date of 2014-04-09; the registry's Assignee, Contact, and Registration Date fields for this row are genuinely blank, not unknown. SIP is the IETF application-layer signaling protocol — specified in RFC 3261 (Rosenberg et al., June 2002), with server location covered by RFC 3263 — that sets up, modifies, and tears down real-time sessions: VoIP calls, video conferencing, and instant messaging. The port number is dual-registered across transports: 5060 is assigned to sip on both TCP and UDP with the same [RFC3263] reference and 2014-04-09 modification date, and to sip on SCTP with reference [RFC4168]. In practice UDP is the historical default transport on 5060 (lower overhead, suited to real-time media signaling) while TCP is used where message reliability or large messages matter; both are defined by RFC 3261. Port 5060 carries cleartext SIP — encrypted SIP (SIP-TLS) is a separate registration on 5061. For an analyst, 5060 is one of the most heavily scanned ports on the internet. It is the target of toll-fraud campaigns that brute-force SIP registrar credentials with tools such as sipvicious/svmap, registration-hijacking attempts, and UDP reflection/amplification abuse: Shadowserver's Accessible SIP report measured roughly 9,087 publicly reachable SIP servers on IPv4 (March 2023 snapshot) and an average SIP amplification factor of about 28.4x (median 12.1x), which makes exposed UDP SIP responders useful for DDoS reflection. Software commonly bound to 5060 includes Asterisk, Kamailio, FreePBX, and Cisco IP phone systems. Defensive guidance is to restrict 5060 to trusted ranges, prefer SIP-TLS on 5061, front it with SIP-aware firewalls/IDS, and enforce strong registrar credentials.

IANA assignment

sip — "SIP"; reference [RFC3263]; modification date 2014-04-09; Assignee/Contact/Registration-Date fields blank in registry [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry

Range class

registered (1024–49151)

Dual registration

5060 is registered as sip on TCP and UDP (both [RFC3263], mod 2014-04-09) and on SCTP ([RFC4168]); cleartext SIP — encrypted SIP-TLS uses 5061 [Confirmed] — IANA registry, RFC 4168

Prevalence/exposure

heavily scanned; Shadowserver counted ~9,087 publicly accessible SIP servers on IPv4 (March 2023) [Confirmed] — Shadowserver Accessible SIP report

Related ports

5061/tcp (SIP-TLS, encrypted); 5060/udp (same number, default SIP transport); 5060/sctp [Confirmed] — IANA registry

Primary use

Session Initiation Protocol signaling — set up/modify/tear down VoIP, video, and IM sessions (RFC 3261 core; RFC 3263 server location)

Common software

Asterisk (PBX), Kamailio (SIP proxy/registrar), FreePBX, Cisco IP phone systems, general VoIP/UC platforms

Security implications

cleartext signaling (interception/tampering); toll fraud via brute-forced registrar credentials (sipvicious/svmap); registration hijacking; UDP reflection/amplification (Shadowserver avg ~28.4x, median ~12.1x); SIP OPTIONS flooding (DoS); CVEs reported against SIP stacks (e.g. Asterisk, Kamailio, Cisco IP Phone)

Transport notes

UDP is the historical default transport on 5060 (low overhead, real-time); TCP supported for reliability/large messages; both defined by RFC 3261; TLS on 5061 recommended for security [Confirmed] — RFC 3261

Security recommendations

restrict to trusted IP ranges; prefer SIP-TLS on 5061; deploy SIP-aware firewall/IDS/IPS; enforce strong credentials; limit response amplification [Likely] — Shadowserver, sslinsights

Analyst note

An open 5060 is almost always a SIP/VoIP endpoint; treat exposed cleartext SIP as a brute-force/toll-fraud and amplification target and confirm whether it should be reachable.

Port 5060/udp is registered with IANA as sip with the description "SIP" and the reference [RFC3263]; the registry shows a modification date of 2014-04-09 and a blank assignee/contact, and the same port number is dual-registered on tcp (also [RFC3263]) and sctp ([RFC4168]). SIP — the Session Initiation Protocol, defined in RFC 3261 — is the dominant signaling protocol for setting up, modifying, and tearing down real-time multimedia sessions: VoIP calls, video, and instant messaging over IP. Port 5060 carries unencrypted SIP signaling, and UDP is the historical default transport because its lower overhead suits latency-sensitive call setup; the companion port 5061 carries SIP over TLS (encrypted, TCP-based), and SIP is also defined to run over TCP and SCTP. For an analyst, 5060/udp is a high-exposure, heavily-scanned port. It is routinely swept across the public internet with SIP OPTIONS probes that fingerprint the PBX behind it (Asterisk, FreeSWITCH, Cisco CUCM, Kamailio/OpenSIPS, Avaya, and effectively every VoIP stack). The dominant threat is toll fraud: attackers brute-force SIP digest credentials to place unauthorized outbound calls, and they also attempt registration hijacking, INVITE-flood denial of service, and UDP reflection/amplification — Shadowserver's accessible-SIP reporting cites an average amplification factor near 28x. Because UDP SIP is cleartext, signaling is also eavesdroppable. Standard mitigations are to firewall 5060/udp to trusted peers, enforce strong digest authentication, migrate to SIPS on 5061/TLS, and keep the SIP software patched (notable CVEs include Cisco IOS SIP CVE-2013-5553 and an Asterisk issue tracked as CVE-2023-41763).

IANA assignment

sip — "SIP"; reference [RFC3263]; assignee/contact blank; registry modification date 2014-04-09; dual-registered 5060/udp + 5060/tcp ([RFC3263]) + 5060/sctp ([RFC4168]) [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry); cross-checked against the IANA XHTML search view

Range class

registered/well-known boundary — 5060 is in the user/registered range (1024–49151) [Confirmed] — IANA port ranges

Prevalence/exposure

high-exposure, mass-scanned port; Shadowserver's accessible-SIP report found on the order of ~9,087 IPv4 hosts with accessible SIP (March 2023 context) [Likely] — Shadowserver accessible-SIP report

Primary use

Session Initiation Protocol signaling for VoIP/video/IM session setup, modification, teardown; UDP is the default unencrypted transport (RFC 3261; port registration per RFC 3263)

Common software

Asterisk, FreeSWITCH, Cisco IP Phones/CUCM, Avaya, Kamailio/OpenSIPS proxies, Twilio, Vonage, and effectively all VoIP PBX/softphone implementations

Security implications

SIP OPTIONS enumeration/PBX fingerprinting; credential brute-force → toll fraud (unauthorized outbound calls); registration hijacking; INVITE-flood DoS; UDP reflection/amplification (Shadowserver avg factor ~28.4x, median ~12.1x); cleartext UDP signaling is eavesdroppable

Notable CVEs

Cisco IOS SIP CVE-2013-5553 (memory leak / device reload); Asterisk CVE-2023-41763

Companion ports

5061/tcp for SIP over TLS (encrypted); SIP also runs over TCP and SCTP (RFC 4168) [Confirmed] — IANA registry; RFC 4168

Mitigations

restrict 5060/udp to trusted IPs via firewall/ACL; enforce strong digest authentication; migrate signaling to SIPS on 5061/TLS; keep SIP software patched [Confirmed] — standard VoIP hardening guidance

Analyst note

An open 5060/udp is normal for VoIP infrastructure but is a top brute-force and toll-fraud target; treat exposed, unauthenticated, or default-credential SIP as high risk.