# WHATPORT(1434)

## NAME

port 1434 — SQL Server Browser (UDP) / Dedicated Admin Connection (TCP) — Two different SQL Server services share this number: the UDP name resolver, and the TCP admin connection.

Protocol: TCP/UDP  
IANA registry

## DESCRIPTION

On UDP, the SQL Server Browser claims 1434 and answers unauthenticated queries telling clients which dynamic TCP port a named instance is listening on. On TCP, 1434 is the Dedicated Administrator Connection for the default instance, a reserved channel for a DBA to get in when the server is otherwise unresponsive. The UDP side is the historically infamous one: the SQL Server 2000 Resolution Service on UDP 1434 carried the buffer overflow (MS02-039, CVE-2002-0649) that SQL Slammer used in 2003 to saturate networks worldwide from a single UDP packet.

## EXPOSURE

**Do not expose.** The Browser answers unauthenticated UDP and enumerates your instances — useful to attackers, and an amplification-shaped surface; the TCP side is an administrator backdoor by design. Block both at the perimeter.

## CHECK

```sh
nmap -Pn -sU -p 1434 --script ms-sql-info TARGET
```

## SEE ALSO

- docs — [Microsoft Learn — SQL Server Browser service (claims UDP port 1434)](https://learn.microsoft.com/en-us/sql/database-engine/configure-windows/sql-server-browser-service-database-engine-and-ssas) (learn.microsoft.com)
- docs — [Microsoft Security Bulletin MS02-039 — buffer overruns in the SQL Server 2000 Resolution Service (the SQL Slammer vulnerability)](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-039) (learn.microsoft.com)
- iana — [IANA Service Name and Transport Protocol Port Number Registry](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml) (iana.org)

---

HTML: <https://whatport.net/1434/> · JSON: <https://whatport.net/1434.json> · full dataset: <https://whatport.net/ports.json>