Port reference
Port 514 (UDP) – Syslog
Syslog — the classic UDP transport for system and device log messages.
Quick facts
- Transport
- udp
- Category
- Well-known
- TLS
- Cleartext
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on syslog collectors and SIEM ingest points. Devices send to it; it should be reachable only from trusted log sources.
What is port 514 used for?
Port 514 carries syslog, the standard way devices and servers send log messages to a central collector or SIEM. Routers, firewalls, switches, Linux hosts, and appliances forward their events here so logs can be stored and searched in one place. Common collectors that listen on it include rsyslog, syslog-ng, Graylog, and Splunk. Classic syslog uses UDP 514 as simple fire-and-forget text. (The old rsh service historically also used TCP 514.)
When would you open it?
You open UDP 514 on the machine acting as your log collector so that your network devices and servers can send their logs to it. Only open it on that collector, and only allow your own log sources to reach it rather than the whole network.
Is it safe to open?
Plain syslog has no encryption or authentication, so messages can be read or spoofed in transit; keep it on a private management network, restrict it to known senders, or move to syslog over TLS. See the security notes below.
How to check if this port is open
ss -tulpn | grep :514
nmap -sU -p 514 <target>netstat -ano | findstr :514
Test-NetConnection <host> -Port 514 # TCP onlylsof -i :514
nmap -sU -p 514 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 514 to your device's local IP, internal port 514, protocol UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 514/udpsudo firewall-cmd --permanent --add-port=514/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 514 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 514" -Direction Inbound -Protocol UDP -LocalPort 514 -Action AllowSecurity & risks
Use a secure alternative
This is a legacy or cleartext protocol. Prefer the encrypted equivalent:
Common attacks
- Spoofed log messages forging or muddying the audit trail
- Log injection to corrupt or evade SIEM parsing and alerts
- Flooding the collector to drop or hide real events (DoS)
- Cleartext interception of sensitive data in log lines
Hardening
- Move to syslog over TLS (RFC 5425) on TCP 6514 instead of UDP 514
- Restrict UDP 514 to known log-source IPs with firewall rules
- Validate and sanitize incoming messages before SIEM ingest
- Rate-limit and monitor collector load to resist flooding
- Segment logging traffic onto a trusted management network
How to block this port
sudo ufw deny 514/udpsudo firewall-cmd --permanent --remove-port=514/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 514 -j DROPNew-NetFirewallRule -DisplayName "Block 514" -Direction Inbound -Protocol UDP -LocalPort 514 -Action Blocknmap snippet
nmap -sU -p514 --script syslog-info <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is syslog on UDP 514 secure?
- No. Classic syslog over UDP 514 has no authentication, integrity, or encryption, so messages can be spoofed, altered, or read in transit. Use syslog over TLS (TCP 6514) instead.
- Why does log spoofing matter?
- Forged log entries can hide an intrusion, frame innocent activity, or trigger false alerts — undermining the audit trail investigators rely on after an incident.