Port reference
Port 554 (TCP) – RTSP (Real Time Streaming Protocol)
Real Time Streaming Protocol controlling delivery of audio/video streams from cameras and media servers.
Quick facts
- Transport
- tcp
- Category
- Well-known
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on IP cameras, NVRs, and media servers; frequently exposed to the internet with weak or default credentials.
What is port 554 used for?
Port 554 is the default port for RTSP, the Real Time Streaming Protocol, which sets up and controls audio and video streams. It is the standard used by IP cameras, NVRs, and media servers, and is supported by players like VLC and FFmpeg. RTSP handles commands such as PLAY and PAUSE, while the actual video usually travels over RTP.
When would you open it?
You would forward or open port 554 if you run a camera, NVR, or media server and want to view its live feed from another network or device. In most home setups your NVR or camera app handles this locally, so you only open the port when you specifically need remote RTSP access.
Is it safe to open?
The main risk is exposing a live camera feed to anyone who finds it, so always require strong credentials and avoid putting it directly on the internet, reaching it through a VPN instead. See the security notes below.
How to check if this port is open
ss -tulpn | grep :554
nmap -p 554 <target>netstat -ano | findstr :554
Test-NetConnection <host> -Port 554lsof -i :554
nmap -p 554 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 554 to your device's local IP, internal port 554, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 554/tcpsudo firewall-cmd --permanent --add-port=554/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 554 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 554" -Direction Inbound -Protocol TCP -LocalPort 554 -Action AllowSecurity & risks
Common attacks
- Accessing live camera feeds with no or default authentication
- Stream URL/path brute forcing to find unprotected feeds
- Credential brute force against camera and NVR accounts
- Mass scanning and indexing of exposed RTSP streams
Hardening
- Require authentication and change all default camera credentials
- Never expose RTSP to the internet; place cameras on an isolated VLAN
- Access feeds through a VPN or secured gateway instead of port 554
- Patch camera/NVR firmware and disable unused ONVIF/RTSP endpoints
How to block this port
sudo ufw deny 554/tcpsudo firewall-cmd --permanent --remove-port=554/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 554 -j DROPNew-NetFirewallRule -DisplayName "Block 554" -Direction Inbound -Protocol TCP -LocalPort 554 -Action Blocknmap snippet
nmap -p554 --script rtsp-methods,rtsp-url-brute <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What uses RTSP on port 554?
- RTSP controls audio/video streaming and is the standard for IP cameras, NVRs, and many media servers, often alongside ONVIF. It sets up and tears down the stream, which then flows over RTP.
- Why are RTSP cameras a security risk?
- Huge numbers of IP cameras expose RTSP to the internet with default or no credentials. Attackers and search engines index these open feeds, exposing live video to anyone who finds the URL.