Skip to content
ProtocolPorts

Port reference

Port 5555 (TCP) – Android Debug Bridge (ADB)

TCP/IP listener for Android Debug Bridge — a full developer shell into Android devices.

tcpRegistered

Quick facts

Transport
tcp
Category
Registered
Risk level
High

Frequently targeted — restrict exposure and harden it.

Default state

Open when ADB-over-TCP is enabled. Commonly left exposed on rooted phones, IoT, TV boxes, and dev boards.

What is port 5555 used for?

Port 5555 is the default network port for the Android Debug Bridge (ADB) when it runs over Wi-Fi instead of USB. ADB is a developer tool used to install apps, read logs, take screenshots, and run shell commands on Android devices. Wireless ADB is handy for app developers and is sometimes enabled on rooted phones, Android TV boxes, and Android-based gadgets. Note that other applications occasionally use 5555 too, so the exact service depends on the device.

When would you open it?

Open port 5555 only on a trusted local network while you are actively debugging an Android device wirelessly, for example testing an app on a phone or TV box. Turn it off again afterward, and never forward it through your router to the internet.

Is it safe to open?

Wireless ADB often has no password, giving anyone who reaches the port full control of the device, so keep it disabled unless you are actively using it. See the security notes below.

How to check if this port is open

Linux
ss -tulpn | grep :5555
nmap -p 5555 <target>
Windows
netstat -ano | findstr :5555
Test-NetConnection <host> -Port 5555
macOS
lsof -i :5555
nmap -p 5555 <target>

How to open this port on your router

To reach this service from outside your network, forward the port on your router:

  1. Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
  2. Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
  3. Add a rule forwarding external port 5555 to your device's local IP, internal port 5555, protocol TCP.
  4. Save and reboot the router if prompted, then test the port from outside your network.

Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.

Allow this port through the firewall

Linux (ufw)
sudo ufw allow 5555/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --add-port=5555/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 5555 -j ACCEPT
Windows
New-NetFirewallRule -DisplayName "Allow 5555" -Direction Inbound -Protocol TCP -LocalPort 5555 -Action Allow

Security & risks

Common attacks

  • Unauthenticated shell access to the device over ADB
  • Silent app/APK installation and malware deployment
  • Cryptomining worms (e.g. ADB.Miner / Trinity) spreading device to device
  • Data theft, screen capture, and command execution as the shell user

Hardening

  • Disable ADB over TCP/IP (adb usb) and turn off Developer Options when not needed
  • Never expose 5555 to the internet or untrusted networks
  • Enforce ADB authorization (RSA key prompt) and reject unknown hosts
  • Firewall/segment IoT and TV devices away from the internet
  • Keep device firmware patched and avoid sideloaded/rooted exposure

How to block this port

Linux (ufw)
sudo ufw deny 5555/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --remove-port=5555/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 5555 -j DROP
Windows
New-NetFirewallRule -DisplayName "Block 5555" -Direction Inbound -Protocol TCP -LocalPort 5555 -Action Block

nmap snippet

nmap -p5555 -sV <target>

Replace <target> with the host or range you're authorized to scan.

Related ports

Port 5037Port 5900Port 4444Port 23

Frequently asked questions

Is ADB on port 5555 authenticated?
ADB has an RSA-key authorization prompt, but devices with ADB-over-TCP enabled and authorization disabled accept anyone. Exposed 5555 then gives a full unauthenticated device shell.
What is ADB.Miner?
A worm that scans for open 5555 ports, connects over ADB without authentication, installs a cryptominer, and uses the device to scan for more victims — spreading across phones, TVs, and IoT.

Related guides