Port reference
Port 61613 (TCP) – STOMP (ActiveMQ)
Default port for STOMP, the Simple Text Oriented Messaging Protocol, commonly enabled on Apache ActiveMQ brokers.
Quick facts
- Transport
- tcp
- Category
- Dynamic / private
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
When the STOMP connector is enabled, ActiveMQ listens on 61613. With default admin/admin credentials or anonymous access, exposed brokers allow reading and injecting messages.
What is port 61613 used for?
Port 61613 is the default for STOMP, the Simple Text Oriented Messaging Protocol, a lightweight text-based messaging protocol most commonly enabled on Apache ActiveMQ message brokers. Applications connect over it to send and subscribe to messages on queues and topics, which makes it easy to integrate clients written in many languages. The encrypted variant usually runs on 61614, and ActiveMQ's native protocol (OpenWire) on 61616.
When would you open it?
Open it on the internal network between your application services and the ActiveMQ broker when those services talk to the broker using STOMP. Keep it bound to a private interface and firewalled to the specific hosts that need it. If your apps use OpenWire or AMQP instead, you can leave the STOMP connector disabled.
Is it safe to open?
Brokers left on default credentials or exposed to the internet can be read from and written to by attackers, so set strong credentials, prefer TLS, and keep the broker patched. See the security notes below.
How to check if this port is open
ss -tulpn | grep :61613
nmap -p 61613 <target>netstat -ano | findstr :61613
Test-NetConnection <host> -Port 61613lsof -i :61613
nmap -p 61613 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 61613 to your device's local IP, internal port 61613, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 61613/tcpsudo firewall-cmd --permanent --add-port=61613/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 61613 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 61613" -Direction Inbound -Protocol TCP -LocalPort 61613 -Action AllowSecurity & risks
Common attacks
- Login with default ActiveMQ credentials over STOMP
- Subscribing to queues/topics to read message traffic
- Injecting messages into application destinations
- Pivot to the OpenWire broker on 61616 (e.g. CVE-2023-46604 RCE)
Hardening
- Change default admin/admin credentials and disable anonymous access
- Disable the STOMP connector if it is not required
- Use STOMP over TLS (commonly 61614) instead of plaintext 61613
- Bind to a private interface and firewall 61613 to trusted hosts
- Apply per-user destination authorization and keep ActiveMQ patched
How to block this port
sudo ufw deny 61613/tcpsudo firewall-cmd --permanent --remove-port=61613/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 61613 -j DROPNew-NetFirewallRule -DisplayName "Block 61613" -Direction Inbound -Protocol TCP -LocalPort 61613 -Action Blocknmap snippet
nmap -p61613 --script banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is STOMP on port 61613?
- STOMP is the Simple Text Oriented Messaging Protocol, a human-readable framing for messaging often enabled on Apache ActiveMQ. Plaintext 61613 lets clients connect and exchange messages; the TLS variant typically uses 61614.
- Is port 61613 affected by CVE-2023-46604?
- CVE-2023-46604 targets the OpenWire protocol on 61616, not STOMP. But an open 61613 indicates an ActiveMQ broker that likely also exposes the vulnerable 61616, so patch and firewall both.