# WHATPORT(5060)

## NAME

port 5060 — SIP — SIP signalling in the clear — the port that sets up VoIP calls, and the most scanned VoIP port there is.

Protocol: TCP/UDP  
IANA registry

## DESCRIPTION

RFC 3261 makes 5060 the default port for SIP over UDP and TCP, so IP phones, PBXes such as Asterisk, Kamailio and FreeSWITCH, SIP trunks and ATAs all rendezvous here. The traffic is text: REGISTER, INVITE and OPTIONS requests with headers naming the user agent, extensions and realm. It attracts constant background scanning from tools like SIPVicious that hunt for extensions with weak passwords, because a compromised PBX becomes someone else's toll-fraud gateway.

## EXPOSURE

**Expose with care.** Exposing 5060 is normal for a public SIP service but it is unauthenticated cleartext signalling. Restrict by source IP where you can, enforce strong per-extension secrets, rate-limit registrations, and prefer 5061 with TLS for anything crossing the internet.

## CHECK

```sh
sudo nmap -sU -p 5060 --script sip-methods TARGET
```

## SEE ALSO

- spec — [RFC 3261 — SIP: Session Initiation Protocol](https://www.rfc-editor.org/rfc/rfc3261.html) (rfc-editor.org)
- source — [asterisk/asterisk on GitHub](https://github.com/asterisk/asterisk) (github.com)
- iana — [IANA port registry — 5060 (sip)](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5060) (iana.org)

---

HTML: <https://whatport.net/5060/> · JSON: <https://whatport.net/5060.json> · full dataset: <https://whatport.net/ports.json>