Port reference
Port 4444 (TCP) – Metasploit / Reverse-Shell C2
De-facto reverse-shell and C2 port — Metasploit's default Meterpreter listener, also abused by the MSBlaster worm.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
Not a standard service. Appears when a Metasploit handler is listening or malware opens a reverse-shell channel; alerting on it is a detection signal.
What is port 4444 used for?
Port 4444 has no standard, fixed legitimate service. It is best known as the default listener port for Metasploit's Meterpreter payload — a penetration-testing and attack framework. When an exploit runs, the compromised machine typically calls back to a handler on 4444. The port also has history: the 2003 MSBlaster worm used 4444 to open a remote shell on infected Windows PCs.
When would you open it?
You would not open port 4444 for any normal purpose — it isn't a real service you would run. Outside of a controlled, authorized penetration-testing lab, an open or outbound 4444 is a red flag: it strongly suggests malware or a reverse shell, i.e. a likely compromise.
Is it safe to open?
No. Treat any 4444 traffic as suspicious by default, block it, and use egress filtering and EDR to catch reverse shells and command-and-control activity. See the security notes below.
How to check if this port is open
ss -tulpn | grep :4444
nmap -p 4444 <target>netstat -ano | findstr :4444
Test-NetConnection <host> -Port 4444lsof -i :4444
nmap -p 4444 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 4444 to your device's local IP, internal port 4444, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 4444/tcpsudo firewall-cmd --permanent --add-port=4444/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 4444 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 4444" -Direction Inbound -Protocol TCP -LocalPort 4444 -Action AllowSecurity & risks
Common attacks
- Metasploit Meterpreter reverse-shell callbacks to a 4444 handler
- Command-and-control (C2) and post-exploitation traffic
- Historic MSBlaster worm propagation via MSRPC (CVE-2003-0352, port 135)
- Bind-shell payloads listening on 4444 for attacker connect-back
Hardening
- Treat outbound/inbound 4444 as suspicious — alert and block by default
- Egress-filter so internal hosts cannot dial out on arbitrary high ports
- Hunt for Meterpreter behaviour, not just the port number
- Patch the underlying RCE/MSRPC bugs that drop these payloads (e.g. MS03-026)
- Use EDR to detect in-memory Meterpreter and process injection
How to block this port
sudo ufw deny 4444/tcpsudo firewall-cmd --permanent --remove-port=4444/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 4444 -j DROPNew-NetFirewallRule -DisplayName "Block 4444" -Direction Inbound -Protocol TCP -LocalPort 4444 -Action Blocknmap snippet
nmap -p4444 -sV --script metasploit-info <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Why is port 4444 considered malicious?
- It is Metasploit's default Meterpreter listener and a common reverse-shell/C2 port, so traffic to or from 4444 is a strong indicator of exploitation. It carries no single fixed legitimate service.
- What is the connection between port 4444 and MSBlaster?
- The 2003 MSBlaster worm exploited the MSRPC DCOM bug (CVE-2003-0352 on port 135) and used 4444 to spawn a remote shell on victims, cementing the port's reputation.