Port reference
Port 5631 (TCP) – pcAnywhere
Symantec pcAnywhere remote-control data channel for legacy graphical remote access to Windows hosts.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
Open on hosts running the discontinued pcAnywhere host service. Should not be present on modern systems; where it survives it is often unpatched.
What is port 5631 used for?
Port 5631 is the main data channel for Symantec pcAnywhere, an older remote-control program that let an operator see and drive a Windows desktop from another machine, similar to VNC or Remote Desktop. The host computer listened on 5631 while a companion discovery channel used UDP 5632. pcAnywhere has been discontinued for years, so today the port mostly turns up on legacy systems that were never decommissioned.
When would you open it?
There is little reason to open this port on a modern network, since pcAnywhere is no longer supported. If you still depend on it during a migration, allow it only inside a private network or VPN and plan a move to a maintained remote-access tool.
Is it safe to open?
pcAnywhere is end-of-life with well-known unpatched vulnerabilities, so the safe choice is to retire it rather than expose it. See the security notes below.
How to check if this port is open
ss -tulpn | grep :5631
nmap -p 5631 <target>netstat -ano | findstr :5631
Test-NetConnection <host> -Port 5631lsof -i :5631
nmap -p 5631 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 5631 to your device's local IP, internal port 5631, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 5631/tcpsudo firewall-cmd --permanent --add-port=5631/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 5631 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 5631" -Direction Inbound -Protocol TCP -LocalPort 5631 -Action AllowSecurity & risks
Common attacks
- Pre-auth buffer overflows in the pcAnywhere host service
- Brute force of weak pcAnywhere authentication
- Scanning for exposed legacy 5631 hosts to gain remote control
- Eavesdropping on poorly encrypted sessions
Hardening
- Retire pcAnywhere — it is end-of-life and unsupported
- If it must run, never expose 5631 to the internet; gate behind VPN
- Restrict source IPs and require strong authentication
- Apply the final Symantec security patches if still installed
- Migrate to a maintained remote-access solution
How to block this port
sudo ufw deny 5631/tcpsudo firewall-cmd --permanent --remove-port=5631/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 5631 -j DROPNew-NetFirewallRule -DisplayName "Block 5631" -Direction Inbound -Protocol TCP -LocalPort 5631 -Action Blocknmap snippet
nmap -p5631 --script banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is pcAnywhere still safe to use?
- No. pcAnywhere is end-of-life and has well-documented buffer-overflow vulnerabilities. Source-code exposure in 2012 prompted Symantec to advise disabling it. Migrate to a supported tool.
- What is port 5632 used for with pcAnywhere?
- pcAnywhere uses TCP 5631 for the data/control channel and UDP 5632 for host discovery (status). Both should be closed on the internet edge.