Port reference
Port 31337 (UDP) – Back Orifice
Default port of the Back Orifice Windows backdoor — the iconic "eleet" port and a classic IDS signature.
Quick facts
- Transport
- udp
- Category
- Registered
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
Not a normal service. A listening 31337 is a strong compromise indicator and a long-standing IDS detection signature.
What is port 31337 used for?
Port 31337 is best known as the default port of Back Orifice, the infamous Windows backdoor released by the Cult of the Dead Cow in 1998. The number spells "eleet" in leetspeak, which made it a lasting icon in hacker culture, and it is still reused today by various malware as a command-and-control or reverse-shell port. It is not a legitimate service that normal software runs.
When would you open it?
You would not. There is no legitimate application that needs port 31337, so you should never deliberately open or forward it. A machine found listening on 31337 usually points to a malware infection or backdoor, and should be investigated rather than opened.
Is it safe to open?
No — an open 31337 typically signals a compromised host, so block it at the firewall and scan the machine with reputable security software. See the security notes below.
How to check if this port is open
ss -tulpn | grep :31337
nmap -sU -p 31337 <target>netstat -ano | findstr :31337
Test-NetConnection <host> -Port 31337 # TCP onlylsof -i :31337
nmap -sU -p 31337 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 31337 to your device's local IP, internal port 31337, protocol UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 31337/udpsudo firewall-cmd --permanent --add-port=31337/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 31337 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 31337" -Direction Inbound -Protocol UDP -LocalPort 31337 -Action AllowSecurity & risks
Common attacks
- Back Orifice remote-administration backdoor control channel
- Covert remote control of an infected Windows host over UDP
- Use of 31337 as a generic C2 / reverse-shell port by other malware
- Mass scanning for the iconic "eleet" backdoor port
Hardening
- Treat a listening 31337 as a likely compromise and investigate the host
- Run a reputable AV/EDR scan to remove Back Orifice and similar RATs
- Alert on 31337 in IDS/IPS — it is a long-standing signature
- Block inbound UDP 31337 at the perimeter firewall
How to block this port
sudo ufw deny 31337/udpsudo firewall-cmd --permanent --remove-port=31337/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 31337 -j DROPNew-NetFirewallRule -DisplayName "Block 31337" -Direction Inbound -Protocol UDP -LocalPort 31337 -Action Blocknmap snippet
nmap -sU -p31337 -sV --script banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Why is port 31337 famous?
- 31337 spells "eleet" in leetspeak and is the default port of the 1990s Back Orifice backdoor. It became a cultural icon and a standard IDS signature for backdoor traffic.
- Is an open port 31337 dangerous?
- Yes. It is the classic Back Orifice backdoor port and is also reused as a generic C2 port by other malware, so a listening 31337 is a strong indicator of compromise to investigate.