Port 5432 PostgreSQL – Free, Online, Private

What listens on 5432

Port 5432 is PostgreSQL. The IANA name is postgresql, PostgreSQL Database. The postmaster binds it unless postgresql.conf changes the port. A client sends a startup packet after the TCP connection. TLS is requested in that packet, or required by the server. It is not implicit on the first byte the way 443 is. pg_hba.conf then decides whether this user from this address may authenticate, and by which method. A line of reject, or no matching line, closes a session that already connected. Unix-socket connections do not use the port. The registry lists UDP. Clients use TCP.

The IANA service name is postgresql: PostgreSQL Database. The practical transport is TCP. The checks below use TCP. IANA may also have a UDP row for 5432. The service described here is the TCP one. A process can bind this port without being the service in the registry. The commands show who bound it. They do not prove the protocol on the wire is the one IANA named.

Service notes for port 5432

Service notes for port 5432: the IANA name is postgresql (PostgreSQL Database), and the program people mean is PostgreSQL. TCP 5432 is the IANA postgresql port. The server speaks its own protocol, and it can reject a connection in pg_hba.conf after the TCP handshake succeeds. Do not publish 5432. Allow the application subnets. Use scram-sha-256, not trust and not md5. trust on 127.0.0.1 is a local decision. trust on a wider address is a login with no password. Require TLS for remote clients and set sslmode=verify-full on the client so the host name is checked. A superuser connection string in an application is a privilege bug. Give the app a role that owns its schema and nothing else. Replication uses the same port and a replication role. Treat that role as production access. Nothing in that paragraph applies to a different number just because the software family is similar. If your listener is not on 5432, you are on the wrong page.

The TCP port is open and the client gets 'no pg_hba.conf entry'. That is not a firewall. Edit the file and reload. Another trap is listen_addresses='localhost', so the port exists on 127.0.0.1 and the security group is irrelevant. Another is a client using sslmode=require, which encrypts and does not verify the certificate name. Another is a container publishing 5432 while the data directory is a new volume that has not run initdb, so the process restarts and the port flaps. Another is two clusters, 5432 and 5433, and a backup job pointed at the wrong one.

How to check whether it is open

On the machine itself, ask the kernel which socket is bound. ss and lsof do that. A firewall, a security group, and a Docker publish rule sit in front of that socket, so a listener is not the same thing as a port the internet can use. From somewhere else, nc -vz host 5432 tries a TCP handshake when the command is the TCP form. A refusal means something answered with a reset. A timeout means a filter dropped the packet or the host is unreachable. Those are different faults. postgres should own TCP 5432 on the address in listen_addresses. ss on the server plus a connection from the application host is the pair of tests. A reset means nothing is listening or a local policy rejected the SYN. An authentication error means you reached PostgreSQL.

grep and findstr match text. A pattern of :80 also matches :8080 and :8000. The lsof and Get-NetTCPConnection forms take a numeric port and do not have that substring bug. Use them when the number is ambiguous. ss filters in the kernel with sport = :N, which is also exact. On macOS, netstat -p selects a protocol. It does not print the process the way Linux netstat -p does. lsof prints the process.

• A successful TCP handshake can still die in pg_hba.conf.
• listen_addresses and the port are separate settings.
• UDP 5432 is not the client protocol.
• sslmode=require does not verify the server name. verify-full does.

Linuxsudo ss -lptn 'sport = :5432'
sudo lsof -nP -iTCP:5432 -sTCP:LISTEN

macOSsudo lsof -nP -iTCP:5432 -sTCP:LISTEN
netstat -anv -p tcp | grep '\.5432[^0-9]'

Windowsnetstat -ano | findstr :5432
Get-NetTCPConnection -LocalPort 5432

Remotenc -vz host 5432