5061

Port 5061/tcp is registered with IANA as sips with the description "SIP-TLS," reference [RFC3263], and a blank assignee/contact (modification date 2014-04-09). It is the encrypted counterpart to plaintext SIP on port 5060: where 5060 carries unprotected SIP signaling, 5061 carries SIP over Transport Layer Security (TLS), giving call-setup confidentiality and integrity. The SIPS URI scheme (sips:) mandates TLS-encrypted transport for the signaling path used to establish, modify, and tear down voice calls, video sessions, registrations, and instant-messaging sessions in VoIP and unified-communications deployments. RFC 3261 (Rosenberg et al., June 2002) already named 5061 as the default port for SIP using TLS over TCP and for sips: over TCP, so operational use predates the formal 2014 IANA record by more than a decade. The registry assigns sips across three transports at 5061 — TCP and UDP both cite [RFC3263], while an SCTP registration cites [RFC4168] — but because TLS is connection-oriented, TCP is the operative transport for SIP-TLS in practice; plaintext UDP cannot carry standard TLS (DTLS-SRTP is a separate, media-plane mechanism). For an analyst, 5061 is a public-facing service by design: it is meant to be reachable, and standard hardening (TLS 1.2+, CA-signed certificates, IP allowlisting, rate limiting, strong SIP authentication) is considered sufficient. The dominant real-world risk on the SIP pair is toll fraud through compromised credentials, where attackers route international calls over a hijacked trunk; 5060 draws the heaviest automated scan and exploitation volume, but 5061 shares the same attacker ecosystem (TLS-handshake DoS, downgrade-to-cleartext attempts, certificate-validation abuse, and credential brute-force after the handshake). Common software exposing 5061 includes Asterisk, FreeSWITCH (tls-sip-port=5061), Cisco Unified Communications Manager and CUBE, Microsoft Teams Direct Routing, and major SIP-trunk providers.

IANA assignment

sips — "SIP-TLS"; reference [RFC3263]; assignee/contact blank; modification date 2014-04-09 [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry)

Range class

registered (1024–49151) [Confirmed]

IANA references

[RFC3263] for TCP and UDP; [RFC4168] for SCTP; RFC 3261 specifies 5061 as the default SIP/SIPS TLS port [Confirmed] — IANA registry, RFC 3261

Registration/modification date

registration date blank in registry; modification date 2014-04-09 [Confirmed] — IANA registry

Related ports

5060/tcp+udp (plaintext SIP); RTP media range; contrast DTLS-SRTP for UDP media

Primary use

secure SIP signaling (SIP over TLS) for VoIP/unified communications — establish, modify, and terminate voice/video/IM sessions; default port for sips: over TCP per RFC 3261

Common software

Asterisk (TLS profile on 5061); FreeSWITCH (tls-sip-port=5061); Cisco Unified Communications Manager and CUBE/ISR; Microsoft Teams Direct Routing; Zoom Phone; RingCentral/Vonage/8x8 SIP trunks; FusionPBX

Security implications

designed for public exposure; if reachable without controls it is routinely probed by SIP scanners. Threats include TLS-handshake DoS, downgrade-to-cleartext, post-handshake credential brute-force, and certificate-validation abuse; toll fraud via compromised SIP credentials is the most damaging outcome. 5060 (plaintext) draws heavier scan/fraud volume; 5061 shares the same attacker ecosystem

Notable CVEs

TLS/SIP-related CVEs (e.g., DoS via malformed TLS handshake, certificate-validation bypass, TLS downgrade) are reported against SIP/VoIP products; applicability to port 5061 specifically vs. the affected product should be confirmed against NVD before relying on any single ID

Dual/triple registered

sips is registered at 5061 on tcp, udp (both [RFC3263], mod date 2014-04-09), and sctp ([RFC4168], no mod date) — TCP is the operative transport since TLS is connection-oriented [Confirmed] — IANA registry

Analyst note

an open 5061 on VoIP/UC infrastructure is expected and legitimate; assess TLS version/cipher posture, certificate validity, and SIP auth strength rather than treating the port itself as anomalous.

Port 5061/udp is registered with IANA under the service name sips with the description "SIP-TLS," referencing RFC 3263 (SIP: Locating SIP Servers), with a blank assignee, a blank registration-date column, and a last-modified date of 2014-04-09. It is dual-registered: 5061/tcp carries the same sips / "SIP-TLS" name, description, and RFC reference, and a separate SCTP registration for 5061 also exists (sips / "SIP-TLS," reference RFC 4168, no modification date). The defining detail for an analyst is that the UDP registration is essentially nominal. SIP-TLS (the SIPS scheme) layers SIP over TLS, and TLS requires a connection-oriented transport — it cannot run over connectionless UDP. RFC 3263 is explicit: a SIPS+D2U (SIPS over UDP) service record "SHOULD NOT be placed into the DNS, since it is not possible to use TLS over UDP," and the spec mandates TCP for SIPS URIs. As a result, every conforming SIP-TLS deployment uses 5061/tcp (or SCTP per RFC 4168) for encrypted call setup, registration, and presence signaling; the actual media is carried separately over RTP/SRTP on dynamically negotiated ports. The 5061/udp slot is held for namespace completeness only and is not serviced by correct implementations. Some scanners still sweep the SIP range (5060–5061) over UDP, and a correctly configured server will not return a valid SIP-TLS response to a TLS handshake attempted over UDP. For an analyst, a host genuinely responding on 5061/udp is anomalous; real encrypted-SIP traffic and the brute-force and toll-fraud activity associated with port 5061 belong to the TCP side.

IANA assignment

sips — "SIP-TLS"; reference RFC 3263; assignee blank; registration-date column blank; last-modified 2014-04-09; dual-registered on 5061/tcp and an SCTP registration (reference RFC 4168) also exists [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (search=5061)

Range class

registered (1024–49151)

Related ports

5060 (sip, cleartext SIP signaling); 5061/tcp (the operational SIP-TLS listener); RTP/SRTP media on dynamically negotiated ports

Primary use

nominal registration for SIP over TLS (SIPS); functionally unused over UDP because TLS cannot run over a connectionless transport — RFC 3263 prohibits SIPS over UDP and mandates TCP

Common software (on 5061/tcp)

Asterisk/FreePBX, Cisco Unified Communications Manager, Microsoft Teams / Skype for Business SIP trunking, PJSIP/SIPp stacks, and enterprise IP-PBX systems (Avaya, Mitel, Grandstream) — all use 5061 over TCP for encrypted SIP signaling

Security implications

port 5061 draws SIP REGISTER brute-force and toll-fraud activity, but observed attacks target the TCP listener; a FreePBX community thread (May 2022) documented a sustained REGISTER brute-force spike against 5061/tcp; UDP probes occur during SIP-range sweeps but receive no valid response

UDP practical status

functionally unused by conforming implementations; IANA carries the UDP entry for namespace completeness only; scanners may probe it but get no valid SIP-TLS response [Confirmed] — RFC 3263; SANS ISC diary on ports 5060/5061

Analyst note

Treat a genuinely responsive 5061/udp as anomalous — conforming SIP-TLS lives on 5061/tcp. Investigate UDP responses as misconfiguration, a non-conforming device, or scanner noise rather than normal encrypted SIP.