PORTTLS optionalKeep privateIANA assigned
Port 1433Microsoft SQL Server
Port 1433 is the default TCP port for the default instance of Microsoft SQL Server. Named instances use dynamic ports, discovered through the SQL Server Browser service on UDP 1434. SQL Server on 1433 is a top target for password attacks and must not be exposed to the internet.
What port 1433 is used for
The default instance of SQL Server (MSSQLSERVER) listens on TCP 1433. Applications using ADO.NET, JDBC, ODBC or the SQL Server Management Studio client connect there. Named instances (SQLEXPRESS, for example) choose a dynamic port at startup unless configured otherwise, and clients discover it by asking the SQL Server Browser on UDP 1434.
| Component | Port | Notes |
|---|---|---|
| Default instance | TCP 1433 | Fixed |
| Named instance | Dynamic TCP (49152–65535) | Pin it to a fixed port for firewalling |
| SQL Server Browser | UDP 1434 | Instance discovery |
| Dedicated Admin Connection | TCP 1434 | Emergency access |
Security considerations
- Exposed 1433 is attacked within minutes. Password guessing against the
saaccount is one of the oldest automated attacks on the internet. Disablesa, or at least rename it and give it a long random password. - Prefer Windows authentication and disable mixed mode where applications allow.
- Force encryption with a CA-issued certificate so that data, not just the login, is protected.
- Restrict the firewall rule to application servers. Do not allow 1433 from "Any".
- Disable the Browser service if all clients use explicit ports; it is an information source for attackers.
How to check port 1433
Is something listening locally? On Windows, open Command Prompt and run:
netstat -ano | findstr :1433A line in the LISTENING state means a local program has bound port 1433; the last column is its process ID (PID). Match the PID in Task Manager (Details tab) or with tasklist /fi "PID eq <pid>". On Linux or macOS the equivalent is ss -tulnp | grep :1433 or lsof -i :1433.
Can you reach it on a remote host? PowerShell's built-in connection test attempts a TCP handshake:
Test-NetConnection sql01.internal.example -Port 1433TcpTestSucceeded : True means the remote system accepted a TCP connection on port 1433. False means the port is closed, filtered by a firewall, or the host is unreachable; the output's ping result helps tell those apart.
See the netstat and Test-NetConnection records for the full option sets.
Confirm the instance is listening with the SQL Server service log or:
Get-Service MSSQLSERVER, SQLBrowserFirewall considerations
Allow inbound TCP 1433 (or the pinned instance port) only from application hosts. Allow UDP 1434 only if named-instance discovery is required. Azure and AWS security groups must not open 1433 to the internet.
On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 1433 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.
Frequently asked questions
What is UDP 1434?
The SQL Server Browser service. A client that connects to server\INSTANCE asks UDP 1434 which TCP port that instance is on. If the Browser is stopped or blocked, connect with an explicit port: server,49321.
How do I find which port my SQL instance uses?
SQL Server Configuration Manager → SQL Server Network Configuration → Protocols for the instance → TCP/IP → IP Addresses tab → IPAll. Or query SELECT local_tcp_port FROM sys.dm_exec_connections WHERE session_id = @@SPID.
Is SQL Server authentication safe over 1433?
Windows (Kerberos) authentication never sends the password. SQL logins send it encrypted in the login packet even without full TLS, but the rest of the session is plain unless encryption is forced. Enable Force Encryption with a proper certificate.