Port 631 IPP – Free, Online, Private

What listens on 631

Port 631 is IPP. The IANA name is ipp, Internet Printing Protocol, RFC 8011. CUPS uses it, and the same daemon often serves a web interface on that port. The protocol is HTTP with printing operations. ipps is IPP over TLS and is registered on 631 as well in the sense of the service name ipps. In practice, TLS IPP is often a URI scheme on 631 or on 443, so read the daemon's configuration rather than assuming a second number. Raw JetDirect printing is TCP 9100, a different service. Opening 631 does not open 9100.

The IANA service name is ipp: IPP (Internet Printing Protocol). The practical transport is TCP. The checks below use TCP. IANA may also have a UDP row for 631. The service described here is the TCP one. A process can bind this port without being the service in the registry. The commands show who bound it. They do not prove the protocol on the wire is the one IANA named.

Service notes for port 631

Service notes for port 631: the IANA name is ipp (IPP (Internet Printing Protocol)), and the program people mean is IPP. TCP 631 is the IANA ipp port, the Internet Printing Protocol. CUPS listens here. It is also a small HTTP server and should not be exposed. An open CUPS on 631 has a history of remote attacks, and the web UI can be an administration console. Do not publish it to the internet. Bind it to localhost if only the local machine prints, or to the print VLAN if a LAN needs it. Require authentication for administration. A printer that advertises itself is still a server. If you do not print from this host, disable CUPS. A container image that installed cups 'for PDF' may be listening. Nothing in that paragraph applies to a different number just because the software family is similar. If your listener is not on 631, you are on the wrong page.

People block 9100 and leave 631, or the reverse, and printing fails for one class of client. Know which protocol the clients use. Another trap is a CUPS web UI on http://host:631 that an SSH tunnel was supposed to be the only path to, and a later firewall change made it direct. Another is testing with a browser and concluding the port is a website. It is a website and a print protocol. Another is IPv6 left open when you filtered IPv4.

How to check whether it is open

On the machine itself, ask the kernel which socket is bound. ss and lsof do that. A firewall, a security group, and a Docker publish rule sit in front of that socket, so a listener is not the same thing as a port the internet can use. From somewhere else, nc -vz host 631 tries a TCP handshake when the command is the TCP form. A refusal means something answered with a reset. A timeout means a filter dropped the packet or the host is unreachable. Those are different faults. TCP 631 owned by cupsd is the usual finding. It should be on 127.0.0.1 unless you have a reason. From outside, it should not complete. A browser on the local machine showing the CUPS page proves the daemon, not the exposure.

grep and findstr match text. A pattern of :80 also matches :8080 and :8000. The lsof and Get-NetTCPConnection forms take a numeric port and do not have that substring bug. Use them when the number is ambiguous. ss filters in the kernel with sport = :N, which is also exact. On macOS, netstat -p selects a protocol. It does not print the process the way Linux netstat -p does. lsof prints the process.

• Port 9100 is raw printing, not IPP. They are different listeners.
• The CUPS UI is HTTP on 631. It is still an admin surface.
• UDP 631 in the registry is not how clients submit jobs.
• localhost access via an SSH tunnel is not the same as a public listener. Check the bind address.

Linuxsudo ss -lptn 'sport = :631'
sudo lsof -nP -iTCP:631 -sTCP:LISTEN

macOSsudo lsof -nP -iTCP:631 -sTCP:LISTEN
netstat -anv -p tcp | grep '\.631[^0-9]'

Windowsnetstat -ano | findstr :631
Get-NetTCPConnection -LocalPort 631

Remotenc -vz host 631