Port 514 — Syslog

Q: How do I check if port 514 is open?

Locally, sudo lsof -i :514 on macOS or Linux, or netstat -ano | findstr :514 on Windows. From outside, nc -zv host 514 tells you whether anything answers.

UDP well-known

What runs on port 514

Remote logging.

Remote syslog over UDP, which means no authentication, no encryption and no delivery guarantee — messages can be forged, read, or silently lost under load. This is acceptable for informational logging on a trusted network and unacceptable for anything security-relevant, since the logs you would need after an incident are exactly the ones an attacker can suppress. TLS syslog on 6514 solves both problems.

Security considerations

UDP syslog has no authentication and no delivery guarantee. Use TLS syslog on 6514 for anything that matters.

Checking whether something is listening

# Linux / macOS — what is bound to the port
sudo lsof -i :514
sudo ss -lntp | grep :514

# Windows
netstat -ano | findstr :514
Get-NetTCPConnection -LocalPort 514

# is it reachable from outside?
nc -zv example.com 514
curl -v telnet://example.com:514

Freeing the port

# find the process, then stop it
sudo lsof -ti :514 | xargs kill        # Linux / macOS
netstat -ano | findstr :514            # note the PID, then:
taskkill /PID <pid> /F                    # Windows

Should this port be open to the internet?

Usually not. Expose it only if a specific external client needs it, and restrict by source address where you can.

Opening or blocking port 514

Finding the port is usually the first half of the job. Start narrow — the second rule is there for services that genuinely serve the public, and most do not:

# ufw — Debian, Ubuntu
sudo ufw allow from 10.0.0.0/8 to any port 514 proto udp
sudo ufw allow 514/udp                   # only if it genuinely serves the public

# firewalld — RHEL, Fedora, CentOS
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=514 protocol=udp accept'
sudo firewall-cmd --reload

# iptables, if you are still there
sudo iptables -A INPUT -p udp --dport 514 -s 10.0.0.0/8 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 514 -j DROP

# Windows
New-NetFirewallRule -DisplayName "Syslog 514" -Direction Inbound -Protocol UDP -LocalPort 514 -RemoteAddress 10.0.0.0/8 -Action Allow

10.0.0.0/8 stands in for a private range — substitute your own. Note that a firewall rule does not undo a service bound to 0.0.0.0; it only stops packets reaching it, and a misconfigured or disabled firewall then exposes it immediately.

Quick reference

Port	514
Protocol	UDP
Service	Syslog
Range	Well-known (0–1023) — binding requires root on Unix

Frequently asked questions

What is port 514 used for?

Remote logging.

Is it safe to open port 514?

UDP syslog has no authentication and no delivery guarantee. Use TLS syslog on 6514 for anything that matters.

How do I check if port 514 is open?

Locally, sudo lsof -i :514 on macOS or Linux, or netstat -ano | findstr :514 on Windows. From outside, nc -zv host 514 tells you whether anything answers.

Why do I get "address already in use" on port 514?

Another process is bound to it — often a previous run of your own program that did not exit cleanly. Find it with lsof -ti :514 and stop it, or configure your application to use a different port.

Can I change the port this service uses?

Almost always yes, in the service's configuration. Moving off a default port reduces automated scan noise, but it is obfuscation rather than security — a real attacker scans all 65,535.

Other common ports

All port numbers