Port 3478 STUN – Free, Online, Private

What listens on 3478

Port 3478 is STUN and TURN. The IANA name stun is Session Traversal Utilities for NAT, RFC 8489. The same number also carries the service names turn, TURN over TCP and TURN over UDP, RFC 8656, and stun-behavior, RFC 5780. A WebRTC client asks a STUN server where its public mapping is, and it asks a TURN server to relay media when a direct path fails. The usual transport is UDP. TCP 3478 exists for networks that block UDP. TLS variants commonly move to 5349, which is not this page. A UDP hole-punching test that only opens TCP will not measure the network the media will use.

The IANA service name is stun: Session Traversal Utilities for NAT (STUN) port. The practical transport is TCP and UDP. The checks below include both TCP and UDP, because both transports matter for this service. A process can bind this port without being the service in the registry. The commands show who bound it. They do not prove the protocol on the wire is the one IANA named.

Service notes for port 3478

Service notes for port 3478: the IANA name is stun (Session Traversal Utilities for NAT (STUN) port), and the program people mean is STUN. Port 3478 is the IANA stun port, and also turn and stun-behavior. STUN and TURN clients use UDP first. TCP is the fallback. A STUN server is a small reflection service. A TURN server with no credentials is an open relay for UDP and TCP, which is worse. Require long-term credentials for TURN. Rate-limit STUN. Do not run an open TURN server because a sample config did. The credentials belong in the signaling channel, delivered to the client for that session, not hardcoded in a mobile app. A relay will be used to hide the source of other traffic if you leave it open. Nothing in that paragraph applies to a different number just because the software family is similar. If your listener is not on 3478, you are on the wrong page.

Clients fail when UDP 3478 is blocked and the client is not configured to try TCP, or when TCP is allowed and the TURN server has no TCP listener. Another trap is a symmetric NAT that makes STUN look successful in a browser test and fail for the actual peer. TURN is the fallback, and it only works if the credential and the realm match. Another is a load balancer that rewrites UDP mappings and breaks the very thing STUN is trying to observe. Test from the network the users are on, not from the server itself.

How to check whether it is open

On the machine itself, ask the kernel which socket is bound. ss and lsof do that. A firewall, a security group, and a Docker publish rule sit in front of that socket, so a listener is not the same thing as a port the internet can use. From somewhere else, nc -vz host 3478 tries a TCP handshake when the command is the TCP form. A refusal means something answered with a reset. A timeout means a filter dropped the packet or the host is unreachable. Those are different faults. A STUN server shows a UDP socket on 3478. A TCP LISTEN is optional and depends on whether you enabled the TCP transport. A local nc -vzu does not prove a remote client can get a binding response. Use a STUN client.

grep and findstr match text. A pattern of :80 also matches :8080 and :8000. The lsof and Get-NetTCPConnection forms take a numeric port and do not have that substring bug. Use them when the number is ambiguous. ss filters in the kernel with sport = :N, which is also exact. On macOS, netstat -p selects a protocol. It does not print the process the way Linux netstat -p does. lsof prints the process.

• stun, turn, and stun-behavior are separate service names on the same number.
• UDP is the transport that matters for media. TCP is a fallback.
• An open TURN port without credentials is a relay.
• 5349 is the usual STUN/TURN over TLS port, not 3478.

Linuxsudo ss -lpun 'sport = :3478'
sudo lsof -nP -iUDP:3478
sudo ss -lptn 'sport = :3478'
sudo lsof -nP -iTCP:3478 -sTCP:LISTEN

macOSsudo lsof -nP -iUDP:3478
netstat -anv -p udp | grep '\.3478[^0-9]'
sudo lsof -nP -iTCP:3478 -sTCP:LISTEN
netstat -anv -p tcp | grep '\.3478[^0-9]'

Windowsnetstat -ano | findstr :3478
Get-NetUDPEndpoint -LocalPort 3478
Get-NetTCPConnection -LocalPort 3478

Remotenc -vzu host 3478
nc -vz host 3478