Port 1521 Oracle listener – Free, Online, Private

What listens on 1521

The registry assigns 1521 to ncube-lm, nCube License Manager, and the entry carries a note that use is known on this port and that the use is unauthorized. The known use is the Oracle Net listener. A default listener.ora uses TCP 1521 and a service name that is not ncube-lm. Clients connect with a connect descriptor, or with EZCONNECT host:1521/service. The listener then hands the session to a database process, sometimes on the same port and sometimes by redirecting to another port. If you only opened 1521 and the listener redirects, the session fails after the first handshake. IANA also lists UDP. Oracle Net uses TCP.

The IANA service name is ncube-lm: nCube License Manager. The practical transport is TCP. The checks below use TCP. IANA may also have a UDP row for 1521. The service described here is the TCP one. A process can bind this port without being the service in the registry. The commands show who bound it. They do not prove the protocol on the wire is the one IANA named.

Service notes for port 1521

Service notes for port 1521: the IANA name is ncube-lm (nCube License Manager), and the program people mean is Oracle listener. TCP 1521 is the IANA ncube-lm port, nCube License Manager. Oracle Database's listener uses 1521 by long convention, and that use is not the IANA service name. An Oracle listener on a public address is a database login. Keep it on the data network. Set a listener password on old versions that still have a remote administration interface, and do not use it on versions where that interface has been removed. Default accounts and sample schemas should be locked. A listener that answers from the internet will be probed. TNS poisoning and old listener bugs are the reason this port does not belong on a security-group allow-all. Encrypt the session if it crosses a network you do not trust. The port number is not a secret. Nothing in that paragraph applies to a different number just because the software family is similar. If your listener is not on 1521, you are on the wrong page.

People document 1521 as 'the Oracle port assigned by IANA'. It is not. The page has to say both, or a compliance check that compares the binary to the registry will flag a false mismatch, and a check that only knows ncube-lm will miss a real database. Another pitfall is the redirect. Another is a RAC or a scan listener on 1521 with the database registered under a service name the client does not have. The port is open. The ORA error is about the service. Another is a host firewall on the database server that the cloud security group does not know about.

How to check whether it is open

On the machine itself, ask the kernel which socket is bound. ss and lsof do that. A firewall, a security group, and a Docker publish rule sit in front of that socket, so a listener is not the same thing as a port the internet can use. From somewhere else, nc -vz host 1521 tries a TCP handshake when the command is the TCP form. A refusal means something answered with a reset. A timeout means a filter dropped the packet or the host is unreachable. Those are different faults. lsnrctl status on the host names the port and the services. ss shows tnslsnr, or a similar listener process, on TCP 1521. A TCP connect proves the listener socket, not a successful database logon.

grep and findstr match text. A pattern of :80 also matches :8080 and :8000. The lsof and Get-NetTCPConnection forms take a numeric port and do not have that substring bug. Use them when the number is ambiguous. ss filters in the kernel with sport = :N, which is also exact. On macOS, netstat -p selects a protocol. It does not print the process the way Linux netstat -p does. lsof prints the process.

• The IANA service name is ncube-lm, not oracle. Oracle's use is convention, and the registry marks that use as known and unauthorized.
• A listener redirect can move the session off 1521.
• UDP 1521 is not how SQL*Net connects.
• An open port with the wrong service name still fails the client.

Linuxsudo ss -lptn 'sport = :1521'
sudo lsof -nP -iTCP:1521 -sTCP:LISTEN

macOSsudo lsof -nP -iTCP:1521 -sTCP:LISTEN
netstat -anv -p tcp | grep '\.1521[^0-9]'

Windowsnetstat -ano | findstr :1521
Get-NetTCPConnection -LocalPort 1521

Remotenc -vz host 1521