Port 3306 — MySQL / MariaDB
TCP registered
What runs on port 3306
The default MySQL and MariaDB port.
Security considerations
Bind to 127.0.0.1 unless a remote application genuinely needs it, and then restrict by source address. Internet-exposed MySQL is scanned constantly.
Checking whether something is listening
# Linux / macOS — what is bound to the port
sudo lsof -i :3306
sudo ss -lntp | grep :3306
# Windows
netstat -ano | findstr :3306
Get-NetTCPConnection -LocalPort 3306
# is it reachable from outside?
nc -zv example.com 3306
curl -v telnet://example.com:3306
Freeing the port
# find the process, then stop it
sudo lsof -ti :3306 | xargs kill # Linux / macOS
netstat -ano | findstr :3306 # note the PID, then:
taskkill /PID <pid> /F # Windows
Should this port be open to the internet?
No. Port 3306 should never be reachable from a public address. Bind it to localhost or a private network, and reach it through a VPN or bastion host if remote access is genuinely needed. Internet-wide scanners find newly exposed instances of this service within minutes.
Quick reference
| Port | 3306 |
| Protocol | TCP |
| Service | MySQL / MariaDB |
| Range | Registered (1024–49151) — any user process may bind |
Frequently asked questions
What is port 3306 used for?
The default MySQL and MariaDB port.
Is it safe to open port 3306?
Bind to 127.0.0.1 unless a remote application genuinely needs it, and then restrict by source address. Internet-exposed MySQL is scanned constantly.
How do I check if port 3306 is open?
Locally, sudo lsof -i :3306 on macOS or Linux, or netstat -ano | findstr :3306 on Windows. From outside, nc -zv host 3306 tells you whether anything answers.
Why do I get "address already in use" on port 3306?
Another process is bound to it — often a previous run of your own program that did not exit cleanly. Find it with lsof -ti :3306 and stop it, or configure your application to use a different port.
Can I change the port this service uses?
Almost always yes, in the service's configuration. Moving off a default port reduces automated scan noise, but it is obfuscation rather than security — a real attacker scans all 65,535.