Port reference
Port 12345 (TCP) – NetBus
Default control port of the NetBus Windows remote-access trojan; an open 12345 is a strong compromise indicator.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
Not a normal service. If 12345 is listening, investigate for a NetBus-style backdoor — though some legitimate apps also reuse the port.
What is port 12345 used for?
Port 12345 is best known as the default control port for NetBus, a classic late-1990s Windows remote-access trojan (RAT). It is not a normal, standard service: NetBus gives a remote operator full control of an infected machine, including keystroke logging, file transfer, screen capture, and running commands. A handful of legitimate applications have reused the memorable number over the years, but the trojan association is what makes this port notable.
When would you open it?
You would not open port 12345. It is not a service you deliberately run, and there is no normal reason to expose it. A host found listening on 12345 most likely indicates a NetBus-style backdoor and possible compromise, so it should be investigated rather than forwarded.
Is it safe to open?
No. An open 12345 is a strong indicator of compromise rather than a service to enable, since the port itself is the backdoor. Block it at the firewall and scan the host with reputable AV/EDR. See the security notes below.
How to check if this port is open
ss -tulpn | grep :12345
nmap -p 12345 <target>netstat -ano | findstr :12345
Test-NetConnection <host> -Port 12345lsof -i :12345
nmap -p 12345 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 12345 to your device's local IP, internal port 12345, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 12345/tcpsudo firewall-cmd --permanent --add-port=12345/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 12345 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 12345" -Direction Inbound -Protocol TCP -LocalPort 12345 -Action AllowSecurity & risks
Common attacks
- NetBus remote-access trojan control channel
- Full remote control of an infected Windows host
- Keylogging, file transfer, and screen capture by the operator
- Mass scanning for hosts already infected by NetBus
Hardening
- Treat a listening 12345 as a likely compromise and investigate the host
- Run a reputable AV/EDR scan to remove NetBus and similar RATs
- Block inbound 12345 at the perimeter firewall
- Rebuild the host if a backdoor is confirmed and rotate credentials
How to block this port
sudo ufw deny 12345/tcpsudo firewall-cmd --permanent --remove-port=12345/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 12345 -j DROPNew-NetFirewallRule -DisplayName "Block 12345" -Direction Inbound -Protocol TCP -LocalPort 12345 -Action Blocknmap snippet
nmap -p12345 -sV --script banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Does an open port 12345 mean I'm infected?
- Not always, but it is a strong indicator. 12345 is the default NetBus trojan port, so a listening 12345 warrants immediate investigation — though a few legitimate applications also reuse the port.
- What is NetBus?
- NetBus is a late-1990s Windows remote-access trojan that gives an attacker full control of an infected machine — keylogging, file access, and screen capture — over its default port 12345.