Port 4444 · Metasploit Default

Port 4444 is Metasploit Default, TCP.

Default Metasploit Framework listener port. Seeing inbound connections to this port strongly indicates compromise or pentest activity.

Palo Alto

Create the service object for this port, then allow the App-ID on it. Restricting the rule to the port's service object keeps the rule working on a non-default port and stops the App-ID matching on other ports. Replace the placeholders with your own rule name and zones.

set service tcp-4444 protocol tcp port 4444

set rulebase security rules <rule-name> from <from-zone> to <to-zone> source any destination any application unknown service tcp-4444 action allow

Risk and exposure

Rated high risk. Services on this port are commonly targeted by attackers. Keep it off the internet, or put it behind a VPN or a strict source allow-list, and monitor access.

Check it

• Linux ss -tlnp | grep :4444
• PowerShell Test-NetConnection <host> -Port 4444
• nmap nmap -p 4444 <host>

Related ports

• 4445 Metasploit Alt
• 6667 IRC
• 1080 SOCKS Proxy

← Search all ports