Port reference
Port 515 (TCP) – LPD
Line Printer Daemon — the legacy LPR/LPD network printing protocol used to queue jobs to print servers.
Quick facts
- Transport
- tcp
- Category
- Well-known
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on legacy print servers, Unix print spoolers, and many network printers/MFPs that still expose LPD.
What is port 515 used for?
Port 515 is used by the Line Printer Daemon (LPD), the server side of the classic LPR/LPD network printing protocol. A client sends a print job to the daemon, which queues it and feeds it to a printer. It is supported by Unix and Linux printing systems such as CUPS, by legacy print servers, and by a large number of network printers and multifunction devices that still accept LPR jobs.
When would you open it?
You would open port 515 on a print server or printer so that computers on your network can submit print jobs to it over LPR. Only enable it if you actually rely on LPD printing; many setups now use IPP (port 631) or driverless printing instead.
Is it safe to open?
LPD has no real authentication or encryption, so anyone who can reach it can send jobs; keep printers on an internal network or VLAN, restrict access to known clients, and never expose port 515 to the internet. See the security notes below.
How to check if this port is open
ss -tulpn | grep :515
nmap -p 515 <target>netstat -ano | findstr :515
Test-NetConnection <host> -Port 515lsof -i :515
nmap -p 515 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 515 to your device's local IP, internal port 515, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 515/tcpsudo firewall-cmd --permanent --add-port=515/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 515 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 515" -Direction Inbound -Protocol TCP -LocalPort 515 -Action AllowSecurity & risks
Common attacks
- Buffer overflows in lpd/spooler implementations (historic pre-auth RCE)
- Unauthenticated print job submission and queue abuse
- Print job spoofing, paper/toner exhaustion DoS
- Information disclosure via queued job data and banners
Hardening
- Disable LPD where IPP (631) or driverless printing is available
- Restrict TCP/515 to print servers and known clients via ACLs
- Patch printer/MFP firmware and spooler software
- Require authentication / use a hardened print server instead of direct device access
- Never expose 515 to the internet; segment printers into their own VLAN
How to block this port
sudo ufw deny 515/tcpsudo firewall-cmd --permanent --remove-port=515/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 515 -j DROPNew-NetFirewallRule -DisplayName "Block 515" -Direction Inbound -Protocol TCP -LocalPort 515 -Action Blocknmap snippet
nmap -p515 --script banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is LPD on port 515 still secure to use?
- LPD has no real authentication or encryption and a history of buffer-overflow CVEs. Prefer IPP over TLS (631) and restrict 515 to internal print servers only.
- Why does my printer have port 515 open?
- Many printers and MFPs still expose LPD for compatibility with legacy LPR clients. If unused, disable it and keep firmware patched to avoid print-job abuse and overflows.