Skip to content
ProtocolPorts

Port reference

Port 2123 (UDP) – GTP-C (GPRS Tunnelling, mobile core)

GTP control-plane signaling between mobile core nodes (SGSN/GGSN, S-GW/P-GW), managing PDP/PDN sessions and bearers.

udpRegistered

Quick facts

Transport
udp
Category
Registered
Risk level
High

Frequently targeted — restrict exposure and harden it.

Default state

Open on mobile core network elements (GGSN/PGW, SGSN/SGW) on operator and roaming (GRX/IPX) interfaces, not on consumer hosts.

What is port 2123 used for?

Port 2123 carries GTP-C, the control-plane signaling of the GPRS Tunnelling Protocol used inside mobile carrier networks. Core nodes such as the SGSN and GGSN (3G) or the S-GW and P-GW (4G/LTE EPC) talk over it to set up, modify, and tear down subscriber data sessions as phones connect and roam. The actual user data rides a separate tunnel, GTP-U, on port 2152. This is telecom infrastructure, not something found on ordinary computers.

When would you open it?

You only deal with 2123 if you operate mobile-core equipment or interconnect with other carriers over roaming links (GRX/IPX). In that case it is opened between trusted core nodes and roaming partners, typically through a dedicated GTP firewall rather than the public internet.

Is it safe to open?

GTP has weak built-in authentication, so an exposed interface can let forged signaling disrupt or spoof subscriber sessions. Keep it on isolated carrier networks behind a GTP firewall and never reachable from the internet. See the security notes below.

How to check if this port is open

Linux
ss -tulpn | grep :2123
nmap -sU -p 2123 <target>
Windows
netstat -ano | findstr :2123
Test-NetConnection <host> -Port 2123   # TCP only
macOS
lsof -i :2123
nmap -sU -p 2123 <target>

How to open this port on your router

To reach this service from outside your network, forward the port on your router:

  1. Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
  2. Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
  3. Add a rule forwarding external port 2123 to your device's local IP, internal port 2123, protocol UDP.
  4. Save and reboot the router if prompted, then test the port from outside your network.

Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.

Allow this port through the firewall

Linux (ufw)
sudo ufw allow 2123/udp
Linux (firewalld)
sudo firewall-cmd --permanent --add-port=2123/udp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p udp --dport 2123 -j ACCEPT
Windows
New-NetFirewallRule -DisplayName "Allow 2123" -Direction Inbound -Protocol UDP -LocalPort 2123 -Action Allow

Security & risks

Common attacks

  • Subscriber/session spoofing via forged GTP-C messages
  • Session teardown and denial of service against bearers
  • Information disclosure and IMSI/subscriber enumeration
  • Malformed GTP message fuzzing causing node crashes

Hardening

  • Restrict GTP-C to trusted roaming peers via GTP firewall
  • Validate GTP message integrity and enforce sequence/teid checks
  • Separate roaming (GRX/IPX) from internal interfaces
  • Rate-limit and monitor GTP-C signaling for anomalies
  • Patch core network elements against GTP parsing flaws

How to block this port

Linux (ufw)
sudo ufw deny 2123/udp
Linux (firewalld)
sudo firewall-cmd --permanent --remove-port=2123/udp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p udp --dport 2123 -j DROP
Windows
New-NetFirewallRule -DisplayName "Block 2123" -Direction Inbound -Protocol UDP -LocalPort 2123 -Action Block

nmap snippet

nmap -sU -p2123 --script banner <target>

Replace <target> with the host or range you're authorized to scan.

Related ports

Port 2152Port 3386Port 2152

Frequently asked questions

What is GTP-C and where is port 2123 used?
GTP-C is the control plane of the GPRS Tunnelling Protocol, used between mobile core nodes (SGSN/GGSN, S-GW/P-GW) to manage subscriber sessions and bearers. Port 2123 carries GTP-C; user data is tunnelled separately via GTP-U on 2152.
Why is GTP-C a security concern for operators?
GTP was designed for trusted operator interconnects, so forged GTP-C messages can spoof subscribers, tear down sessions, or disclose information. Roaming (GRX/IPX) exposure makes a GTP firewall essential.

Related guides