Port reference
Port 6881 (TCP/UDP) – BitTorrent
Classic default port for BitTorrent peer connections and DHT, used by clients to exchange pieces and discover peers.
Quick facts
- Transport
- tcp, udp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on hosts running BitTorrent clients; the listening port is often forwarded through NAT for better connectivity.
What is port 6881 used for?
Port 6881 is the classic default port for BitTorrent peer traffic. Clients such as qBittorrent, Transmission, Deluge, and uTorrent use it to connect to other peers, exchange file pieces, and discover peers through the DHT (distributed hash table). It carries the actual file-sharing traffic between you and the swarm, over both TCP and UDP.
When would you open it?
Forwarding 6881 (or whatever port your client uses) through your router can improve download and upload speeds by letting other peers connect to you directly. It is optional, since clients still work behind NAT, but forwarding helps with connectivity.
Is it safe to open?
BitTorrent is public by design, so other peers can see your IP address; using a VPN bound to your client is the common way to stay private. See the security notes below.
How to check if this port is open
ss -tulpn | grep :6881
nmap -p 6881 <target>netstat -ano | findstr :6881
Test-NetConnection <host> -Port 6881lsof -i :6881
nmap -p 6881 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 6881 to your device's local IP, internal port 6881, protocol TCP/UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 6881/tcpsudo firewall-cmd --permanent --add-port=6881/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 6881 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 6881" -Direction Inbound -Protocol TCP -LocalPort 6881 -Action AllowSecurity & risks
Common attacks
- IP exposure and privacy leakage of downloading peers
- DDoS amplification/reflection abusing DHT and tracker responses
- Malicious peers serving fake or malware-laden pieces
- Tracker/DHT poisoning to redirect or disrupt swarms
Hardening
- Bind the client to a VPN interface and avoid IP leaks
- Disable or firewall DHT/PEX if not needed to limit exposure
- Restrict the listening port and use a non-default port
- Verify content sources and keep the client patched
- Rate-limit connections and block known abusive peers
How to block this port
sudo ufw deny 6881/tcpsudo firewall-cmd --permanent --remove-port=6881/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 6881 -j DROPNew-NetFirewallRule -DisplayName "Block 6881" -Direction Inbound -Protocol TCP -LocalPort 6881 -Action Blocknmap snippet
nmap -sU -p6881 --script banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Does BitTorrent on port 6881 expose my IP address?
- Yes. Every peer in a swarm sees your IP, and trackers/DHT publish it. Anyone can enumerate participants in a torrent. Use a VPN bound to the client to avoid leaking your real address.
- How is BitTorrent used in DDoS attacks?
- DHT and tracker responses can be larger than requests, so spoofed queries reflect amplified traffic at a victim. Misconfigured clients and open DHT nodes have been abused as reflectors.