Port 1521Oracle Database listener

What port 1521 is used for

Oracle clients do not connect to a database instance directly. They connect to the listener, a separate process that knows which instances are registered on the host. The listener accepts the connection on port 1521, checks the requested service name, and either redirects the client to a server process or hands the socket over.

Tools connecting through 1521 include SQL*Plus, SQL Developer, JDBC thin drivers, ODBC, and every application that uses an Oracle tnsnames.ora entry.

Encryption

Plain Oracle Net on 1521 is unencrypted. Options:

• Native Network Encryption, configured in sqlnet.ora, encrypts the session on the same port.
• TCPS, Oracle Net over TLS, typically on port 2484 with a wallet holding the certificate.

Security considerations

• Restrict the listener to trusted hosts with firewall rules and, where used, TCP.VALIDNODE_CHECKING in sqlnet.ora.
• Secure listener administration. Historical attacks abused unauthenticated listener commands; modern versions enforce local OS authentication, but confirm LOCAL_OS_AUTHENTICATION_LISTENER is on.
• Default accounts (SCOTT, HR) with default passwords should be locked.
• Never expose 1521 to the internet. Oracle on a public address is quickly enumerated by scanners that know to try 1521 first.

How to check port 1521

Is something listening locally? On Windows, open Command Prompt and run:

netstat -ano | findstr :1521

A line in the LISTENING state means a local program has bound port 1521; the last column is its process ID (PID). Match the PID in Task Manager (Details tab) or with tasklist /fi "PID eq <pid>". On Linux or macOS the equivalent is ss -tulnp | grep :1521 or lsof -i :1521.

Can you reach it on a remote host? PowerShell's built-in connection test attempts a TCP handshake:

Test-NetConnection ora01.internal.example -Port 1521

TcpTestSucceeded : True means the remote system accepted a TCP connection on port 1521. False means the port is closed, filtered by a firewall, or the host is unreachable; the output's ping result helps tell those apart.

See the netstat and Test-NetConnection records for the full option sets.

Check the listener from the server:

lsnrctl status

The output lists the listening endpoints and registered services.

Firewall considerations

Allow inbound TCP 1521 (or 2484 for TCPS) from application servers and DBA workstations only.

On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 1521 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.