# WHATPORT(6129)

## NAME

port 6129 — DameWare Mini Remote Control — DameWare Mini Remote Control's default port — famously scanned after its pre-auth overflows.

Protocol: TCP  
IANA registry

## DESCRIPTION

IANA leaves 6125-6129 unassigned; 6129 is claimed in practice by DameWare Mini Remote Control, a Windows remote-administration tool whose client service listens here by default. A pre-authentication buffer overflow made it a mass-scan target: CERT VU#909678, where a crafted packet mimicking a client compromises the server. Moving the service off the default port is common advice precisely because the number is so well known. A listener here means a managed Windows fleet, and a lot of internet background noise still probes it.

## EXPOSURE

**Do not expose.** A remote-control agent with a history of pre-auth remote code execution has no business on a public IP; reach it over a VPN and keep the version current.

## CHECK

```sh
sudo lsof -nP -iTCP:6129 -sTCP:LISTEN
```

## SEE ALSO

- docs — [CERT VU#909678 — DameWare Mini Remote Control buffer overflow (port 6129/TCP)](https://www.kb.cert.org/vuls/id/909678) (kb.cert.org)
- iana — [IANA Service Name and Transport Protocol Port Number Registry — 6125-6129 unassigned](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=6129) (iana.org)

---

HTML: <https://whatport.net/6129/> · JSON: <https://whatport.net/6129.json> · full dataset: <https://whatport.net/ports.json>