5672
Summary
- // if you see it open
- Plaintext 5672 transmits credentials and message payloads in clear unless the application enforces TLS (use 5671/amqps). Exposed brokers with default or weak credentials allow unauthorized queue access or message injection. RabbitMQ default guest/guest has been localhost-restricted since 3.3 but remains a risk on misconfigured instances. RabbitMQ guidance is to bind the listener to specific interfaces or disable plaintext entirely via 'listeners.tcp = none'. Shadowserver scans 5672 globally and reports exposed instances (version, platform, SASL mechanisms) daily.
- // analyst note
- A public 5672 is most often a RabbitMQ broker; treat plaintext exposure and default credentials as the primary concerns and check for a TLS listener on 5671.
About port 5672/tcp.
Port 5672/tcp is registered with IANA as amqp, the Advanced Message Queuing Protocol, with assignee and contact Pieter Hintjens (of iMatix) and a registration date of January 2006; the IANA reference field is blank — there is no AMQP-specific RFC, because the AMQP 0-9-1 wire specification is an OASIS standard rather than an IETF document. The port is dual-registered on TCP and UDP under the same 2006 assignment, and 5672/sctp is separately registered to amqp with contact Martin Sustrik (March 2007); in practice TCP is the only transport used. AMQP is an open application-layer protocol for message-oriented middleware: brokers accept connections, route messages through exchanges to queues, and deliver them to consumers. Port 5672 carries plaintext (non-TLS) AMQP; the TLS variant runs on 5671/tcp (amqps). The dominant implementation is RabbitMQ, which listens on 5672 by default for both AMQP 0-9-1 and AMQP 1.0; other speakers include Apache Qpid, Microsoft Azure Service Bus (AMQP 1.0), and client stacks such as Celery, Pika, and Spring AMQP. For an analyst, the security relevance is straightforward: plaintext 5672 transmits credentials and payloads in clear unless the operator enforces TLS, and exposed brokers with default or weak credentials allow unauthorized queue access or message injection. RabbitMQ guidance recommends binding the listener to specific interfaces or disabling the plaintext listener entirely (listeners.tcp = none) in production. The Shadowserver Foundation scans for accessible AMQP on 5672 globally and reports exposed instances daily, capturing product version, platform, and supported SASL mechanisms. A reachable 5672 on the public internet is therefore worth investigating as a likely-misconfigured message broker.
- IANA assignment
amqp— "AMQP"; assignee/contact Pieter Hintjens; registration 2006-01; reference (blank — no RFC cited in IANA registry); dual-registered 5672/tcp + 5672/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry line 9981)- Range class
- registered (1024–49151)
- IANA reference
- blank — AMQP 0-9-1 is an OASIS standard, not an IETF RFC; the registry cites only the port-procedure document RFC 6335 [Confirmed] — IANA registry
- Related ports
- 5671/tcp (amqps, TLS); contrast other message brokers (e.g. MQTT 1883/8883, STOMP, Kafka 9092)
Primary use
plaintext (non-TLS) AMQP message-broker listener
Common software
RabbitMQ (default 5672 listener for AMQP 0-9-1 and AMQP 1.0), Apache Qpid, Microsoft Azure Service Bus (AMQP 1.0); clients Celery, Pika, Spring AMQP [Confirmed] — https://www.rabbitmq.com/docs/networking, https://learn.microsoft.com/en-us/azure/service-bus-messaging/service-bus-amqp-protocol-guide
Security implications
plaintext credentials/payloads in clear unless TLS enforced; default/weak credentials enable unauthorized queue access or message injection; RabbitMQ guest/guest restricted to localhost since 3.3 but a risk on misconfigured instances
Exposure/scanning
Shadowserver scans accessible AMQP on 5672 daily (version, platform, SASL mechanisms) and publishes counts on its dashboard; Shodan port:5672 surfaces reachable brokers. No global host count is asserted (live dashboard query required)
- SCTP co-registration
- 5672/sctp also
amqp, contact Martin Sustrik, registration 2007-03 [Confirmed] — IANA registry (CSV lines 9982–9983) - TLS variant
- 5671/tcp
amqpscarries the same protocol over TLS; RabbitMQ can disable plaintext 5672 vialisteners.tcp = none[Confirmed] — https://www.rabbitmq.com/docs/networking - Analyst note
- A public 5672 is most often a RabbitMQ broker; treat plaintext exposure and default credentials as the primary concerns and check for a TLS listener on 5671.
About port 5672/udp.
Port 5672/udp is registered with IANA as amqp with the description "AMQP," assignee Pieter Hintjens, registration date 2006-01, and a blank reference field — no RFC is cited in the registry for any of the 5672 entries. The number is dual-registered across transports: 5672/tcp (also Pieter Hintjens, 2006-01) and 5672/sctp (Martin Sustrik, 2007-03) carry the same amqp service name. The practical reality for an analyst is that the UDP slot is a paper registration: AMQP is a connection-oriented, ordered, reliable messaging protocol and every production implementation speaks it over TCP exclusively. RabbitMQ, Apache Qpid, Apache ActiveMQ, Azure Service Bus, and Solace all bind 5672/tcp for plaintext AMQP (0-9-1 and 1.0) and 5671/tcp for AMQPS (TLS); none of them listen on 5672/udp. Because no service speaks on the UDP variant, internet-exposure scanners (Shodan, Nmap UDP scan) find effectively nothing there, and there are no CVEs specific to 5672/udp. The entire exposure and security story for this number lives on the TCP side: exposed RabbitMQ brokers are routinely found via Shodan (port:5672 product:RabbitMQ) and are susceptible to message snooping and injection when left internet-facing, so 5672/tcp and 5671/tcp should never be exposed to the public internet. For the analyst, a responsive 5672/udp would itself be anomalous and worth a second look, since the registered protocol does not use UDP at all; real AMQP activity will be on TCP.
- IANA assignment
amqp— "AMQP"; reference (blank — no RFC cited in IANA registry); assignee Pieter Hintjens; registration date 2006-01; dual-registered 5672/tcp (Pieter Hintjens, 2006-01) + 5672/sctp (Martin Sustrik, 2007-03) [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry)- Range class
- registered (1024–49151) [Confirmed] — IANA port number ranges
- Related ports
- 5671/tcp (AMQPS, TLS); 15672/tcp (RabbitMQ management UI); 5672/tcp and 5672/sctp (same service name)
Primary use
Advanced Message Queuing Protocol; in practice AMQP runs over TCP only — the UDP registration carries no known real-world traffic
Common software
RabbitMQ, Apache Qpid, Apache ActiveMQ, Azure Service Bus, Solace — all bind 5672/tcp (plain) and 5671/tcp (AMQPS/TLS); none bind 5672/udp
Exposure / scanning
5672/udp carries no listening service, so UDP-side exposure scans find effectively nothing; the exposure story is entirely TCP-side (exposed RabbitMQ brokers found via Shodan port:5672 product:RabbitMQ)
Security implications
no CVEs specific to 5672/udp; AMQP broker CVEs (unauthenticated access, info disclosure) target the TCP service and the management API on 15672/tcp; 5672/tcp + 5671/tcp must not be internet-facing
- Analyst note
- AMQP is a TCP protocol; a responsive 5672/udp is anomalous given the registered protocol does not use UDP — investigate rather than assume normal messaging traffic.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| amqp | TCP | — | 0.01% |
| amqp | UDP | — | 0.00% |
| amqp | SCTP | — | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.