Skip to content
ProtocolPorts

Port reference

Port 194 (TCP) – IRC (Internet Relay Chat)

Real-time text chat protocol organizing users into channels on relay servers.

tcpWell-known

Quick facts

Transport
tcp
Category
Well-known
Risk level
High

Frequently targeted — restrict exposure and harden it.

Default state

Rarely used on 194 today; most IRC runs on 6667 (plaintext) or 6697 (TLS). Cleartext unless TLS is enabled.

What is port 194 used for?

Port 194 is the original registered port for IRC, the Internet Relay Chat protocol that organizes users into channels on servers for real-time group text chat. Clients like HexChat, mIRC, and irssi connect to server software such as InspIRCd or UnrealIRCd. In practice almost everyone uses 6667 (plaintext) or 6697 (TLS) today, but 194 is the original assignment. Plain IRC sends messages and logins in cleartext unless TLS is enabled.

When would you open it?

You'd open an IRC port only if you host your own IRC server and want people to connect. Because 194 is rarely used by clients, most operators run on 6667/6697 instead, and prefer the TLS port 6697 so logins and chat are encrypted.

Is it safe to open?

Plain IRC is unencrypted and IRC has a long history of botnet command-and-control abuse, so require TLS and authentication and watch for unexpected outbound IRC traffic. See the security notes below.

How to check if this port is open

Linux
ss -tulpn | grep :194
nmap -p 194 <target>
Windows
netstat -ano | findstr :194
Test-NetConnection <host> -Port 194
macOS
lsof -i :194
nmap -p 194 <target>

How to open this port on your router

To reach this service from outside your network, forward the port on your router:

  1. Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
  2. Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
  3. Add a rule forwarding external port 194 to your device's local IP, internal port 194, protocol TCP.
  4. Save and reboot the router if prompted, then test the port from outside your network.

Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.

Allow this port through the firewall

Linux (ufw)
sudo ufw allow 194/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --add-port=194/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 194 -j ACCEPT
Windows
New-NetFirewallRule -DisplayName "Allow 194" -Direction Inbound -Protocol TCP -LocalPort 194 -Action Allow

Security & risks

Common attacks

  • Botnet command-and-control over IRC channels
  • Cleartext credential and message sniffing
  • Channel flooding and IRC-based DDoS coordination
  • Probing connecting clients via ident (port 113)

Hardening

  • Require TLS (IRC over SSL) and disable plaintext where possible
  • Monitor for botnet C2 patterns and suspicious channel activity
  • Restrict server linking and require operator authentication
  • Rate-limit connections and enforce strong NickServ/SASL auth

How to block this port

Linux (ufw)
sudo ufw deny 194/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --remove-port=194/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 194 -j DROP
Windows
New-NetFirewallRule -DisplayName "Block 194" -Direction Inbound -Protocol TCP -LocalPort 194 -Action Block

nmap snippet

nmap -p194 --script irc-info,irc-botnet-channels <target>

Replace <target> with the host or range you're authorized to scan.

Related ports

Port 6667Port 6697Port 113Port 6660

Frequently asked questions

What port does IRC use?
The registered port is 194, but in practice most IRC servers use 6667 for plaintext and 6697 for TLS. Port 194 is the original well-known assignment.
Why is IRC associated with malware?
IRC's lightweight channels made it a popular command-and-control channel for botnets, letting an operator issue commands to many infected hosts at once. Network monitoring often flags IRC C2 patterns.

Related guides