Port reference
Port 5004 (UDP) – RTP (Real-time Transport Protocol)
Default RTP port carrying real-time audio/video media for VoIP and streaming, negotiated by signaling protocols like SIP.
Quick facts
- Transport
- udp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Used for RTP media streams on VoIP endpoints and media servers; the media path is opened during call setup by SIP/H.323.
What is port 5004 used for?
Port 5004 is the default for RTP, the Real-time Transport Protocol, which carries the actual audio and video in VoIP calls and live streaming. RTP doesn't work alone: a signaling protocol like SIP (port 5060) sets up the call first, then the voice or video flows over RTP (with its control channel, RTCP, on 5005). It runs over UDP for low latency and is used by IP phones, softphones, and conferencing systems.
When would you open it?
Open or forward port 5004 (and the surrounding RTP range) on a firewall or NAT when you run VoIP equipment — a PBX, SIP trunk, or media server — and calls need to send media across networks. Many setups use a wider RTP port range, not just 5004.
Is it safe to open?
Plain RTP is unencrypted, so media can be eavesdropped or tampered with on the path. Use SRTP for encryption, key it via SIP over TLS, and keep VoIP on an isolated network. See the security notes below.
How to check if this port is open
ss -tulpn | grep :5004
nmap -sU -p 5004 <target>netstat -ano | findstr :5004
Test-NetConnection <host> -Port 5004 # TCP onlylsof -i :5004
nmap -sU -p 5004 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 5004 to your device's local IP, internal port 5004, protocol UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 5004/udpsudo firewall-cmd --permanent --add-port=5004/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 5004 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 5004" -Direction Inbound -Protocol UDP -LocalPort 5004 -Action AllowSecurity & risks
Common attacks
- Eavesdropping on unencrypted RTP audio/video streams
- RTP injection of spoofed audio/video into a call
- Stream disruption and denial of service via packet flooding
- SSRC/sequence manipulation to hijack or corrupt media
Hardening
- Use SRTP to encrypt and authenticate media streams
- Negotiate and key media securely via SIP over TLS
- Restrict RTP source addresses and validate SSRC/sequence
- Place VoIP media on an isolated VLAN, not the open internet
- Rate-limit and monitor RTP flows for injection/flooding
How to block this port
sudo ufw deny 5004/udpsudo firewall-cmd --permanent --remove-port=5004/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 5004 -j DROPNew-NetFirewallRule -DisplayName "Block 5004" -Direction Inbound -Protocol UDP -LocalPort 5004 -Action Blocknmap snippet
nmap -sU -p5004 --script banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is the relationship between RTP and SIP?
- SIP (port 5060) is the signaling that sets up a call and negotiates the media; RTP (port 5004) carries the actual audio/video. SIP opens the RTP path, so securing both — ideally SIP/TLS plus SRTP — is necessary.
- Can RTP streams be eavesdropped?
- Yes. Unencrypted RTP can be captured and replayed to recover the audio/video. Attackers on the media path can also inject spoofed RTP. SRTP encrypts and authenticates the stream to prevent this.