H.323 call setup — a video conferencing system, VoIP gateway, or PBX willing to take a call.
TCP 1720 carries H.225.0 call signalling, a Q.931-derived message set: SETUP, ALERTING, CONNECT, RELEASE COMPLETE. Once a call is accepted, H.245 negotiates capabilities and the audio and video themselves flow over RTP on dynamic UDP ports, so 1720 is only the front door. It is the standard listening port for H.323 gateways, gatekeepers, MCUs, and the video conferencing endpoints from Polycom, Cisco/Tandberg, and Lifesize. H.323 predates SIP and survives mostly in video conferencing rooms and in PSTN gateways.
Do not expose
An H.323 endpoint reachable from the internet is a standing toll-fraud and auto-answer target — signalling is cleartext, vendor firmware ships weak or default credentials, and scanners sweep 1720 continuously. Front it with an H.323 session border controller.
$ nmap -sV -p 1720 TARGETSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.