554

Port 554/tcp is registered with IANA as rtsp with the description "Real Time Streaming Protocol (RTSP)," assignee and contact Rob Lanphier (RealNetworks), and a blank reference field (dual-registered on TCP and UDP; related ports are 8554 rtsp-alt and 322 rtsps/RTSP-over-TLS). It is an application-layer control protocol — a "network remote control" for streaming media servers — and in the real world it is overwhelmingly the dominant control protocol of IP cameras, NVRs, DVRs, and surveillance/IoT video. RTSP is a stateful, HTTP/1.1-like text protocol with methods DESCRIBE, SETUP, PLAY, PAUSE, and TEARDOWN (plus OPTIONS and GET/SET_PARAMETER); crucially it does not carry the media itself but sets up and controls separate media streams, typically RTP/RTCP, which may run over UDP or be interleaved over the TCP control channel. Developed by RealNetworks, Netscape, and Columbia University (Schulzrinne, Rao, Lanphier), it was standardized as RFC 2326 (April 1998), with RFC 7826 (December 2016) defining the non-backward-compatible RTSP 2.0; RTSP control is plaintext, and although RTSPS/RTSP-over-TLS exists on port 322 it is rarely used on cameras. The IANA reference field is blank. Security-wise this is the flagship concern of its batch. Cameras ship with well-known logins (admin/admin, admin/12345, admin/blank), and on many devices the web UI is protected while the RTSP service is not, so anyone who guesses the stream path — for example rtsp://ip:554/live.sdp or /cam/realmonitor — can watch without authentication; Shodan and Censys index huge numbers of port-554 devices, and Bitsight's TRACE report "Big Brother Is Watching (And So Is Everyone Else)" (June 2025) found over 40,000 open, publicly accessible network cameras streaming live footage, led by the US (~14,000) and Japan (~7,000). Tooling is mature — Cameradar (Ullaakut/cameradar) scans 554/5554/8554, fingerprints models, and dictionary-attacks routes and credentials, while Nmap NSE rtsp-url-brute and rtsp-methods do similar — and compromised cameras and DVRs are classic IoT-botnet fodder: Eleven11bot, discovered by Nokia's Deepfield team on 26 February 2025 as roughly 30,000 devices (mainly security cameras and NVRs), was later scanned by the Shadowserver Foundation at about 86,400 compromised IoT devices by 2 March 2025. An important caveat is that botnet infection vectors are usually Telnet/default-credential or firmware-CVE based rather than RTSP itself, so RTSP is best understood as the exposure and abuse surface — and the reason a device is interesting — rather than the proven entry vector; botnet associations are therefore threat-reported and vector-specific. For an analyst, an open 554/tcp is almost always an IP camera, NVR, DVR, or streaming-media server: test for default credentials and unauthenticated stream paths (Cameradar / rtsp-url-brute), never expose 554 directly to the internet, change defaults, update firmware, and prefer RTSPS and segmented VLANs.

IANA assignment

rtsp — "Real Time Streaming Protocol (RTSP)"; reference (blank — RFC 2326/7826 are the defining specs but are NOT cited in the registry row); assignee Rob Lanphier (RealNetworks); dual-registered 554/tcp + 554/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency ~0.008104 (de-facto; ~40th most common TCP port, driven by cameras) [Well-established] — nmap-services file

Related ports

RTP/RTCP (dynamic UDP), 8554 (rtsp-alt), 322 (rtsps), ONVIF, 80/443 (camera web UI)

Primary use

application-layer control protocol for streaming media (RFC 2326); overwhelmingly IP cameras/NVRs in practice

Other/unofficial uses

legitimate streaming servers — Wowza, Live555, VLC, the former Darwin/QuickTime Streaming Server, GStreamer, go2rtc relays [Well-established]

Security implications

default creds (admin/admin, admin/12345), unauthenticated stream paths; mass exposure (Bitsight TRACE June 2025 ~40,000+ open cameras; US ~14k, Japan ~7k); tooling (Cameradar, Nmap rtsp-url-brute/rtsp-methods); IoT-botnet fodder (Eleven11bot, Nokia 26 Feb 2025 ~30k → Shadowserver ~86,400 by 2025-03-02); plaintext control (RTSPS/322 rare)

Typically seen on

IP cameras, NVRs, DVRs, CCTV, streaming-media servers (Wowza/Live555/VLC)

Analyst note

An open 554/tcp is almost always an IP camera/NVR/DVR or streaming server; test for default creds and unauthenticated streams (Cameradar/rtsp-url-brute), never internet-expose 554 (use VPN), change defaults, update firmware, prefer RTSPS/segmented VLANs.

Port 554/udp is the IANA-registered UDP transport for RTSP (Real Time Streaming Protocol) control messages; it carries only session setup/control, never the media stream itself, and it should generally stay internal-only or restricted to trusted/VPN networks rather than exposed directly to the public internet.

RTSP is registered with IANA on both 554/tcp and 554/udp under the service name rtsp, described as "Real Time Streaming Protocol (RTSP)," assignee Rob_Lanphier, with a blank IANA reference field (no RFC cited in the registry row itself).

RFC 2326 defines two RTSP URL schemes: rtsp for control messages over a reliable transport (TCP) and rtspu for control messages over an unreliable transport (UDP). The RFC states that "if the port is empty or not given, port 554 is assumed" for either scheme, so UDP 554, where implemented, carries the same SETUP/PLAY/PAUSE/TEARDOWN control exchange as TCP 554 — not the media stream. The negotiated RTP/RTCP media always travels on separately negotiated ports named in the SETUP request's Transport header, regardless of whether control ran over TCP or UDP.

In practice, RTSP control runs over TCP 554 almost universally; the rtspu UDP-control scheme is rarely implemented by camera, NVR, and media-server software, which matches this port's much lower measured prevalence than its TCP counterpart. RTSP itself is widely embedded in IP camera, DVR, and NVR firmware, and in general-purpose media client and server software; vendor documentation describes this ecosystem as built on libraries like LIVE555 and tools such as VLC, ffmpeg, and Wowza.

Exposure

RTSP-capable devices (cameras, NVRs, DVRs) are frequently port-forwarded to the public internet for "remote viewing," often without encryption or meaningful authentication — vendor and security write-ups recommend a VPN or firewalled access instead of direct exposure.

Scanning activity

SANS Internet Storm Center's port-554 telemetry (isc.sans.edu/data/port/554, checked August 2026) shows a small number of individual scan sources generating high per-source volumes (585, 250, and 157 scans from single source IPs on one day), consistent with routine internet background-noise scanning rather than sustained widespread simultaneous scanning.

Common weakness

Exposed devices with default or blank credentials are described in vendor/security write-ups as discoverable by scanners within minutes of exposure.

Malware association

No specific malware or trojan family tied to this port is recorded as of an August 2026 search; general write-ups describe exposed RTSP cameras as targets for botnet recruitment and credential-stuffing rather than naming a specific family.

Mitigations cited

Firewall the port from untrusted networks, prefer a VPN over direct port-forwarding, require strong non-default credentials, segment cameras on their own VLAN, and keep firmware patched.

IANA assignment

rtsp — "Real Time Streaming Protocol (RTSP)"; reference (blank — no RFC cited in the registry row); assignee Rob_Lanphier; dual-registered 554/tcp + 554/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry rtsp 554/udp

Range class

well-known (0–1023) [Confirmed] — this site's own tooling

Prevalence

nmap-services open-frequency 554/udp = 0.000593 (measured, not zero); 554/tcp = 0.008104, per repo artifact [Confirmed] — this site's own tooling (built from nmap-services)

Related ports

554/tcp (RTSP control channel, dual-registered, near-universal in practice); dynamically negotiated RTP/RTCP media ports (never 554); 8554/tcp-udp (common alternate RTSP port)

Primary use

RTSP control messages (SETUP/PLAY/PAUSE/TEARDOWN) via the rtspu UDP scheme defined in RFC 2326; media (RTP/RTCP) travels on separately negotiated ports, never on 554 itself

Other/unofficial uses

RFC-defined rtspu UDP control scheme is rarely implemented; near-universal practice runs RTSP control over TCP 554 instead

Security implications

frequently port-forwarded for remote camera/device viewing without adequate auth; actively scanned per SANS ISC telemetry; no specific malware family confirmed

Typically seen on

IP cameras, DVR/NVR devices, and media streaming servers on local or VPN-segmented networks

Analyst note

An internet-facing 554/udp responder is most plausibly an exposed camera or streaming device answering RTSP control requests over UDP; verify authentication and network placement before assuming benign use.