554

Port 554/tcp is registered with IANA as rtsp with the description "Real Time Streaming Protocol (RTSP)," assignee and contact Rob Lanphier (RealNetworks), and a blank reference field (dual-registered on TCP and UDP; related ports are 8554 rtsp-alt and 322 rtsps/RTSP-over-TLS). It is an application-layer control protocol — a "network remote control" for streaming media servers — and in the real world it is overwhelmingly the dominant control protocol of IP cameras, NVRs, DVRs, and surveillance/IoT video. RTSP is a stateful, HTTP/1.1-like text protocol with methods DESCRIBE, SETUP, PLAY, PAUSE, and TEARDOWN (plus OPTIONS and GET/SET_PARAMETER); crucially it does not carry the media itself but sets up and controls separate media streams, typically RTP/RTCP, which may run over UDP or be interleaved over the TCP control channel. Developed by RealNetworks, Netscape, and Columbia University (Schulzrinne, Rao, Lanphier), it was standardized as RFC 2326 (April 1998), with RFC 7826 (December 2016) defining the non-backward-compatible RTSP 2.0; RTSP control is plaintext, and although RTSPS/RTSP-over-TLS exists on port 322 it is rarely used on cameras. The IANA reference field is blank. Security-wise this is the flagship concern of its batch. Cameras ship with well-known logins (admin/admin, admin/12345, admin/blank), and on many devices the web UI is protected while the RTSP service is not, so anyone who guesses the stream path — for example rtsp://ip:554/live.sdp or /cam/realmonitor — can watch without authentication; Shodan and Censys index huge numbers of port-554 devices, and Bitsight's TRACE report "Big Brother Is Watching (And So Is Everyone Else)" (June 2025) found over 40,000 open, publicly accessible network cameras streaming live footage, led by the US (~14,000) and Japan (~7,000). Tooling is mature — Cameradar (Ullaakut/cameradar) scans 554/5554/8554, fingerprints models, and dictionary-attacks routes and credentials, while Nmap NSE rtsp-url-brute and rtsp-methods do similar — and compromised cameras and DVRs are classic IoT-botnet fodder: Eleven11bot, discovered by Nokia's Deepfield team on 26 February 2025 as roughly 30,000 devices (mainly security cameras and NVRs), was later scanned by the Shadowserver Foundation at about 86,400 compromised IoT devices by 2 March 2025. An important caveat is that botnet infection vectors are usually Telnet/default-credential or firmware-CVE based rather than RTSP itself, so RTSP is best understood as the exposure and abuse surface — and the reason a device is interesting — rather than the proven entry vector; botnet associations are therefore threat-reported and vector-specific. For an analyst, an open 554/tcp is almost always an IP camera, NVR, DVR, or streaming-media server: test for default credentials and unauthenticated stream paths (Cameradar / rtsp-url-brute), never expose 554 directly to the internet, change defaults, update firmware, and prefer RTSPS and segmented VLANs.

IANA assignment

rtsp — "Real Time Streaming Protocol (RTSP)"; reference (blank — RFC 2326/7826 are the defining specs but are NOT cited in the registry row); assignee Rob Lanphier (RealNetworks); dual-registered 554/tcp + 554/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency ~0.008104 (de-facto; ~40th most common TCP port, driven by cameras) [Well-established] — nmap-services file

Related ports

RTP/RTCP (dynamic UDP), 8554 (rtsp-alt), 322 (rtsps), ONVIF, 80/443 (camera web UI)

Primary use

application-layer control protocol for streaming media (RFC 2326); overwhelmingly IP cameras/NVRs in practice

Other/unofficial uses

legitimate streaming servers — Wowza, Live555, VLC, the former Darwin/QuickTime Streaming Server, GStreamer, go2rtc relays [Well-established]

Security implications

default creds (admin/admin, admin/12345), unauthenticated stream paths; mass exposure (Bitsight TRACE June 2025 ~40,000+ open cameras; US ~14k, Japan ~7k); tooling (Cameradar, Nmap rtsp-url-brute/rtsp-methods); IoT-botnet fodder (Eleven11bot, Nokia 26 Feb 2025 ~30k → Shadowserver ~86,400 by 2025-03-02); plaintext control (RTSPS/322 rare)

Typically seen on

IP cameras, NVRs, DVRs, CCTV, streaming-media servers (Wowza/Live555/VLC)

Analyst note

An open 554/tcp is almost always an IP camera/NVR/DVR or streaming server; test for default creds and unauthenticated streams (Cameradar/rtsp-url-brute), never internet-expose 554 (use VPN), change defaults, update firmware, prefer RTSPS/segmented VLANs.