Skip to content
ProtocolPorts

Port reference

Port 7 (TCP/UDP) – Echo Protocol

Legacy diagnostic service that echoes back any data it receives, used for connectivity testing.

tcpudpWell-known

Quick facts

Transport
tcp, udp
Category
Well-known
Risk level
High

Frequently targeted — restrict exposure and harden it.

Default state

Disabled on modern systems but still found on legacy Unix hosts, network gear, and printers via inetd.

What is port 7 used for?

Port 7 runs the Echo Protocol (RFC 862), one of the original "simple" TCP/IP diagnostic services. The server simply sends back any data it receives, so a client could confirm a connection was alive and measure round-trip behaviour. It was historically provided by Unix's inetd and as a Windows Simple TCP/IP Service, and the same idea lives on in the ping-style echo built into many network appliances. Today it is essentially obsolete.

When would you open it?

In practice you almost never need to. The only realistic reason is bringing up an old piece of lab gear or a legacy appliance that still expects an echo responder for connectivity tests. Only enable it if you are genuinely running such a service and have a specific use for it.

Is it safe to open?

The main risk is that the UDP echo can be abused for reflection floods, so keep it off public networks and limit it to a trusted LAN or VPN if you must run it. See the security notes below.

How to check if this port is open

Linux
ss -tulpn | grep :7
nmap -p 7 <target>
Windows
netstat -ano | findstr :7
Test-NetConnection <host> -Port 7
macOS
lsof -i :7
nmap -p 7 <target>

How to open this port on your router

To reach this service from outside your network, forward the port on your router:

  1. Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
  2. Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
  3. Add a rule forwarding external port 7 to your device's local IP, internal port 7, protocol TCP/UDP.
  4. Save and reboot the router if prompted, then test the port from outside your network.

Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.

Allow this port through the firewall

Linux (ufw)
sudo ufw allow 7/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --add-port=7/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 7 -j ACCEPT
Windows
New-NetFirewallRule -DisplayName "Allow 7" -Direction Inbound -Protocol TCP -LocalPort 7 -Action Allow

Security & risks

Common attacks

  • UDP amplification / reflection DDoS, often paired with chargen (port 19)
  • Echo-chargen packet storm loops between two hosts
  • Bandwidth exhaustion via spoofed-source floods

Hardening

  • Disable the echo service in inetd/xinetd entirely
  • Block UDP and TCP port 7 inbound at the perimeter
  • Remove legacy simple-TCP/UDP services from network devices
  • Filter spoofed source addresses with BCP 38 ingress filtering

How to block this port

Linux (ufw)
sudo ufw deny 7/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --remove-port=7/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 7 -j DROP
Windows
New-NetFirewallRule -DisplayName "Block 7" -Direction Inbound -Protocol TCP -LocalPort 7 -Action Block

nmap snippet

nmap -sU -p7 --script banner <target>

Replace <target> with the host or range you're authorized to scan.

Related ports

Port 19Port 13Port 17Port 53

Frequently asked questions

What is the Echo Protocol on port 7?
Echo (RFC 862) is a diagnostic service that sends back any data it receives. It was meant for connectivity testing but is now obsolete and considered a security risk.
Why is port 7 dangerous?
On UDP, an attacker can spoof a victim's source address so the echo reply floods the victim. Paired with chargen on port 19, two open servers can be looped into a packet storm.

Related guides