Internet-Security raven logo internet-security.com

UDP 5351

ProtocolUDP
Port5351
LabelsNAT Port Mapping Protocol and Port Control Protocol—client-requested configuration for connections through network address translators and firewalls

Synopsis

  • UDP port 5351 is used by the NAT Port Mapping Protocol (NAT-PMP), implemented on many routers, including Apple AirPort Extreme/Time Capsule and router firmware using miniupnpd (pfSense/OPNsense, OpenWrt, and Ubiquiti EdgeRouter).
  • The Port Control Protocol (PCP, RFC 6887), the successor to NAT-PMP, also listens on UDP 5351 and is available in the same platforms (e.g., pfSense/OPNsense and OpenWrt via miniupnpd, and various ISP gateways).
  • Real-world client software that uses NAT-PMP/PCP to auto-open ports includes Transmission and qBittorrent (BitTorrent clients), Plex Media Server, Syncthing, Resilio Sync, and Tailscale.
  • Apple software and devices historically leveraged NAT-PMP in home networks, particularly with AirPort base stations.
  • Many home gateways expose a NAT-PMP/PCP toggle labeled “NAT-PMP/PCP” or “UPnP/NAT-PMP” in their admin UI; when enabled, they listen on UDP 5351 on the LAN side.
  • Security note: Misconfigured devices that expose NAT-PMP/PCP on the WAN have been abused for unauthorized port mappings and DDoS amplification (e.g., widely reported NAT-PMP exposure issues in 2013), so access should be restricted to the local network.

Observed activity

Last 30 days Detailed chart

More information