Two different SQL Server services share this number: the UDP name resolver, and the TCP admin connection.
On UDP, the SQL Server Browser claims 1434 and answers unauthenticated queries telling clients which dynamic TCP port a named instance is listening on. On TCP, 1434 is the Dedicated Administrator Connection for the default instance, a reserved channel for a DBA to get in when the server is otherwise unresponsive. The UDP side is the historically infamous one: the SQL Server 2000 Resolution Service on UDP 1434 carried the buffer overflow (MS02-039, CVE-2002-0649) that SQL Slammer used in 2003 to saturate networks worldwide from a single UDP packet.
Do not expose
The Browser answers unauthenticated UDP and enumerates your instances — useful to attackers, and an amplification-shaped surface; the TCP side is an administrator backdoor by design. Block both at the perimeter.
$ nmap -Pn -sU -p 1434 --script ms-sql-info TARGETSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.