{
  "port": 1434,
  "protocol": "both",
  "service": "SQL Server Browser (UDP) / Dedicated Admin Connection (TCP)",
  "oneLiner": "Two different SQL Server services share this number: the UDP name resolver, and the TCP admin connection.",
  "whatItIs": "On UDP, the SQL Server Browser claims 1434 and answers unauthenticated queries telling clients which dynamic TCP port a named instance is listening on. On TCP, 1434 is the Dedicated Administrator Connection for the default instance, a reserved channel for a DBA to get in when the server is otherwise unresponsive. The UDP side is the historically infamous one: the SQL Server 2000 Resolution Service on UDP 1434 carried the buffer overflow (MS02-039, CVE-2002-0649) that SQL Slammer used in 2003 to saturate networks worldwide from a single UDP packet.",
  "exposure": {
    "verdict": "never",
    "note": "The Browser answers unauthenticated UDP and enumerates your instances — useful to attackers, and an amplification-shaped surface; the TCP side is an administrator backdoor by design. Block both at the perimeter."
  },
  "checkCommand": "nmap -Pn -sU -p 1434 --script ms-sql-info TARGET",
  "links": [
    {
      "title": "Microsoft Learn — SQL Server Browser service (claims UDP port 1434)",
      "url": "https://learn.microsoft.com/en-us/sql/database-engine/configure-windows/sql-server-browser-service-database-engine-and-ssas",
      "kind": "official-docs"
    },
    {
      "title": "Microsoft Security Bulletin MS02-039 — buffer overruns in the SQL Server 2000 Resolution Service (the SQL Slammer vulnerability)",
      "url": "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-039",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}