Port 3306 MySQL – Free, Online, Private

What listens on 3306

Port 3306 is MySQL. The IANA name is mysql. MariaDB uses the same default because it speaks the same client protocol. The server accepts a TCP connection, then a handshake packet with a capability set and a scramble, and the client authenticates. TLS is a capability in that handshake, not a property of the port. A socket file, often /tmp/mysql.sock or /var/run/mysqld/mysqld.sock, is the local path and does not use 3306. skip-networking disables TCP entirely, which is correct for an app on the same host and a surprise for an app on another host. The registry lists UDP. Clients use TCP.

The IANA service name is mysql: MySQL. The practical transport is TCP. The checks below use TCP. IANA may also have a UDP row for 3306. The service described here is the TCP one. A process can bind this port without being the service in the registry. The commands show who bound it. They do not prove the protocol on the wire is the one IANA named.

Service notes for port 3306

Service notes for port 3306: the IANA name is mysql (MySQL), and the program people mean is MySQL. TCP 3306 is the IANA mysql port. MySQL and MariaDB listen here by default. The protocol is not encrypted unless you turn TLS on. A public 3306 is scanned for root with an empty password and for the passwords from every leaked .env. Bind it to the database subnet. Delete anonymous accounts, set a root password, and do not let root connect from %. Require TLS if the client crosses a network. A replication user is a user. Lock its host and its privileges. Port 3306 open to the application tier is normal. Port 3306 open to 0.0.0.0/0 is an incident. The server's own firewall and the cloud security group are two layers, and people update one. Nothing in that paragraph applies to a different number just because the software family is similar. If your listener is not on 3306, you are on the wrong page.

bind-address=127.0.0.1 makes ss show a listener and every remote client fail. That is the setting working. Another trap is a client using localhost, which on MySQL means the socket, while 127.0.0.1 means TCP. They can have different users in mysql.user, so one works and the other says the password is wrong. Another is a container that publishes 3306 while the data directory is still initializing, so the port opens and then resets. Another is MariaDB on 3306 and a second MySQL that failed to bind, with the app pointed at whichever came up first.

How to check whether it is open

On the machine itself, ask the kernel which socket is bound. ss and lsof do that. A firewall, a security group, and a Docker publish rule sit in front of that socket, so a listener is not the same thing as a port the internet can use. From somewhere else, nc -vz host 3306 tries a TCP handshake when the command is the TCP form. A refusal means something answered with a reset. A timeout means a filter dropped the packet or the host is unreachable. Those are different faults. mysqld should own TCP 3306 on the address clients use. A socket-only install shows no TCP port, which is what skip-networking means. Test from the application host, not only from the database host.

grep and findstr match text. A pattern of :80 also matches :8080 and :8000. The lsof and Get-NetTCPConnection forms take a numeric port and do not have that substring bug. Use them when the number is ambiguous. ss filters in the kernel with sport = :N, which is also exact. On macOS, netstat -p selects a protocol. It does not print the process the way Linux netstat -p does. lsof prints the process.

• localhost and 127.0.0.1 are different connection types in MySQL.
• TLS is negotiated. The port number does not imply it.
• UDP 3306 is not the client protocol.
• A listener on 127.0.0.1 is not a listener on the VPC address.

Linuxsudo ss -lptn 'sport = :3306'
sudo lsof -nP -iTCP:3306 -sTCP:LISTEN

macOSsudo lsof -nP -iTCP:3306 -sTCP:LISTEN
netstat -anv -p tcp | grep '\.3306[^0-9]'

Windowsnetstat -ano | findstr :3306
Get-NetTCPConnection -LocalPort 3306

Remotenc -vz host 3306