SIP signalling in the clear — the port that sets up VoIP calls, and the most scanned VoIP port there is.
RFC 3261 makes 5060 the default port for SIP over UDP and TCP, so IP phones, PBXes such as Asterisk, Kamailio and FreeSWITCH, SIP trunks and ATAs all rendezvous here. The traffic is text: REGISTER, INVITE and OPTIONS requests with headers naming the user agent, extensions and realm. It attracts constant background scanning from tools like SIPVicious that hunt for extensions with weak passwords, because a compromised PBX becomes someone else's toll-fraud gateway.
Expose with care
Exposing 5060 is normal for a public SIP service but it is unauthenticated cleartext signalling. Restrict by source IP where you can, enforce strong per-extension secrets, rate-limit registrations, and prefer 5061 with TLS for anything crossing the internet.
$ sudo nmap -sU -p 5060 --script sip-methods TARGETSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.