# WHATPORT(514)

## NAME

port 514 — rsh (TCP) / syslog (UDP) — Two unrelated services share this number: BSD rsh on TCP, and syslog on UDP.

Protocol: TCP/UDP  
IANA registry

## DESCRIPTION

IANA registers TCP 514 as "shell" — the BSD rsh service, which runs a single command remotely using the same host-based .rhosts trust as rlogin, and which also opens a second connection back to the client for stderr. UDP 514 is syslog, the log-shipping protocol (RFC 5424 format, RFC 5426 UDP transport), and that is what almost every hit on 514 is today: routers, firewalls, and servers forwarding log lines to a collector. Syslog over TCP has no assigned port at all; RFC 6587 notes that implementations commonly borrow TCP/514 anyway, which is exactly why a TCP listener here is as likely to be a log collector as an rsh daemon.

## EXPOSURE

**Do not expose.** rsh is cleartext remote command execution with address-based trust. Plain syslog is unauthenticated and unencrypted, so an exposed collector can be flooded with forged log entries and, over UDP, used for spoofed traffic — send logs over TLS (RFC 5425) or a private network instead.

## CHECK

```sh
nmap -Pn -sV -p 514 TARGET
```

## SEE ALSO

- spec — [RFC 5424 — The Syslog Protocol](https://www.rfc-editor.org/rfc/rfc5424.html) (rfc-editor.org)
- spec — [RFC 6587 — Transmission of Syslog Messages over TCP (on the unassigned TCP/514 habit)](https://www.rfc-editor.org/rfc/rfc6587.html) (rfc-editor.org)
- iana — [IANA Service Name and Transport Protocol Port Number Registry — 514](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=514) (iana.org)

---

HTML: <https://whatport.net/514/> · JSON: <https://whatport.net/514.json> · full dataset: <https://whatport.net/ports.json>