Port 3389 RDP – Free, Online, Private

What listens on 3389

Port 3389 is Remote Desktop. The IANA name is ms-wbt-server, MS WBT Server. The TCP connection carries the session setup. Current Windows also uses UDP 3389 for the bulk graphics once the session is up, so a firewall that allows only TCP gives you a session that connects and then stutters or falls back. The service is TermService. An exposed RDP host is a login prompt on the internet. Network Level Authentication asks for credentials before the full session. It is on by default on current Windows and off on old images. IANA lists UDP as well as TCP. For this service, both can matter.

The IANA service name is ms-wbt-server: MS WBT Server. The practical transport is TCP. The checks below use TCP. IANA may also have a UDP row for 3389. The service described here is the TCP one. A process can bind this port without being the service in the registry. The commands show who bound it. They do not prove the protocol on the wire is the one IANA named.

Service notes for port 3389

Service notes for port 3389: the IANA name is ms-wbt-server (MS WBT Server), and the program people mean is RDP. TCP 3389 is the IANA ms-wbt-server port, Remote Desktop Protocol. UDP 3389 is also used by newer RDP for the graphics stream. Public RDP is brute-forced all day. Do not publish 3389. Put it behind a VPN or an RD Gateway on 443, and require NLA and an account that is not a shared Administrator password. Account lockout policies lock out the real administrator if you are not careful with them, which is its own outage. Restrict who is in Remote Desktop Users. A bluekept-era host that is still unpatched does not belong on any network you care about. The port number is the least interesting part of the control. Nothing in that paragraph applies to a different number just because the software family is similar. If your listener is not on 3389, you are on the wrong page.

A security group allows TCP and the session is painful because UDP is blocked. Allow both, or accept the fallback. Another trap is a host that listens and a local Windows firewall that does not. ss or Get-NetTCPConnection shows LISTEN, and nc from another host times out. Another is NLA failing for a client that is not domain-joined and has no saved credential, which looks like a black screen after the port connected. Another is confusing 3389 with SMB on 445. Opening one does not open the other. A jump host that tunnels 3389 to localhost is not a public listener. Check the bind if you think you closed it.

How to check whether it is open

On the machine itself, ask the kernel which socket is bound. ss and lsof do that. A firewall, a security group, and a Docker publish rule sit in front of that socket, so a listener is not the same thing as a port the internet can use. From somewhere else, nc -vz host 3389 tries a TCP handshake when the command is the TCP form. A refusal means something answered with a reset. A timeout means a filter dropped the packet or the host is unreachable. Those are different faults. On Windows, TermService should own 3389. Get-NetTCPConnection and Get-NetUDPEndpoint both belong in the check if users complain about performance. From outside, a timeout is a filter. A credential prompt is a live RDP.

grep and findstr match text. A pattern of :80 also matches :8080 and :8000. The lsof and Get-NetTCPConnection forms take a numeric port and do not have that substring bug. Use them when the number is ambiguous. ss filters in the kernel with sport = :N, which is also exact. On macOS, netstat -p selects a protocol. It does not print the process the way Linux netstat -p does. lsof prints the process.

• The IANA name is ms-wbt-server, not rdp.
• UDP 3389 carries graphics on modern RDP. TCP alone can be a degraded session.
• A listener plus a timeout means the Windows firewall or a security group, not a stopped service.
• 445 is SMB. It is not part of opening Remote Desktop.

Linuxsudo ss -lptn 'sport = :3389'
sudo lsof -nP -iTCP:3389 -sTCP:LISTEN

macOSsudo lsof -nP -iTCP:3389 -sTCP:LISTEN
netstat -anv -p tcp | grep '\.3389[^0-9]'

Windowsnetstat -ano | findstr :3389
Get-NetTCPConnection -LocalPort 3389

Remotenc -vz host 3389