Two unrelated services share this number: BSD rsh on TCP, and syslog on UDP.
IANA registers TCP 514 as "shell" — the BSD rsh service, which runs a single command remotely using the same host-based .rhosts trust as rlogin, and which also opens a second connection back to the client for stderr. UDP 514 is syslog, the log-shipping protocol (RFC 5424 format, RFC 5426 UDP transport), and that is what almost every hit on 514 is today: routers, firewalls, and servers forwarding log lines to a collector. Syslog over TCP has no assigned port at all; RFC 6587 notes that implementations commonly borrow TCP/514 anyway, which is exactly why a TCP listener here is as likely to be a log collector as an rsh daemon.
Do not expose
rsh is cleartext remote command execution with address-based trust. Plain syslog is unauthenticated and unencrypted, so an exposed collector can be flooded with forged log entries and, over UDP, used for spoofed traffic — send logs over TLS (RFC 5425) or a private network instead.
$ nmap -Pn -sV -p 514 TARGETSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.