Internet-Security raven logo internet-security.com

TCP 20000

ProtocolTCP
Port20000
LabelsDistributed Network Protocol (DNP)

Synopsis

  • DNP3 (Distributed Network Protocol) for SCADA/ICS commonly uses TCP port 20000, deployed by electric, water, and gas utilities with equipment from vendors such as SEL (Schweitzer), GE, and ABB.
  • Usermin, the user-facing companion to Webmin, listens on TCP/20000 by default for webmail and account management.
  • SOGo groupware (the sogod service) defaults to TCP/20000, typically proxied by Apache or Nginx.
  • Security note: DNP3 on TCP/20000 is frequently targeted—legacy deployments often lack encryption/authentication, and attackers scan this port to discover exposed substations/RTUs; multiple ICS-CERT advisories describe denial-of-service and command/traffic manipulation risks when DNP3 is internet-accessible.

Observed activity

Last 30 days Detailed chart

More information