Port reference
Port 5683 (UDP) – CoAP (Constrained Application Protocol)
Lightweight UDP-based REST-like protocol for constrained IoT devices; secure variant CoAPS runs on 5684 with DTLS.
Quick facts
- Transport
- udp
- Category
- Registered
- TLS
- Cleartext
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on many IoT devices and gateways, frequently with no authentication. Plain CoAP on 5683 is unencrypted; the secured form (CoAPS) uses DTLS on 5684.
What is port 5683 used for?
Port 5683 is the default port for CoAP, the Constrained Application Protocol, a lightweight web-style protocol designed for low-power IoT devices and sensors. It works like a stripped-down HTTP (with GET, POST, PUT, DELETE) but runs over UDP so it suits battery-powered and memory-limited hardware. You will find it in smart-home gear, industrial sensors, and IoT platforms; the encrypted version, CoAPS, runs on UDP 5684.
When would you open it?
Open port 5683 only within a local or segmented IoT network so devices and their gateway or controller can talk to each other. It should stay off the public internet; remote access is better handled by a cloud platform or gateway rather than exposing devices directly.
Is it safe to open?
Plain CoAP is usually unencrypted and unauthenticated and can be abused for amplification attacks, so prefer CoAPS on 5684 and keep devices on a private network. See the security notes below.
How to check if this port is open
ss -tulpn | grep :5683
nmap -sU -p 5683 <target>netstat -ano | findstr :5683
Test-NetConnection <host> -Port 5683 # TCP onlylsof -i :5683
nmap -sU -p 5683 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 5683 to your device's local IP, internal port 5683, protocol UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 5683/udpsudo firewall-cmd --permanent --add-port=5683/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 5683 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 5683" -Direction Inbound -Protocol UDP -LocalPort 5683 -Action AllowSecurity & risks
Use a secure alternative
This is a legacy or cleartext protocol. Prefer the encrypted equivalent:
Common attacks
- UDP reflection/amplification DDoS using CoAP responses
- Unauthenticated resource enumeration and device control
- Spoofed requests to read or change sensor/actuator state
- Exploitation of vulnerable embedded CoAP stacks
Hardening
- Use CoAPS (DTLS) on 5684 instead of plaintext CoAP on 5683
- Never expose 5683 directly to the internet; keep IoT on segmented networks
- Disable multicast discovery and amplifiable responses on public interfaces
- Require authentication/authorization for sensitive resources
- Patch device firmware and rate-limit UDP at the gateway
How to block this port
sudo ufw deny 5683/udpsudo firewall-cmd --permanent --remove-port=5683/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 5683 -j DROPNew-NetFirewallRule -DisplayName "Block 5683" -Direction Inbound -Protocol UDP -LocalPort 5683 -Action Blocknmap snippet
nmap -sU -p5683 --script coap-resources <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is CoAP on port 5683 encrypted?
- No. Plain CoAP on 5683 is unencrypted and typically unauthenticated. The secure variant, CoAPS, runs on UDP 5684 and uses DTLS for confidentiality and authentication.
- Why is CoAP a DDoS amplification risk?
- CoAP runs over connectionless UDP, so requests can be spoofed and a small query can elicit a larger response. Attackers abuse exposed devices as reflectors to amplify traffic toward a victim.