whatportis.com
suggest an edit →

Port 12222LWAPP Data

The Lightweight Access Point Protocol (LWAPP) is designed to enable centralized wireless LAN management by facilitating communication between wireless access points (APs) and wireless LAN controllers. LWAPP Data on port 12222 typically handles the exchange of user data packets between APs and controllers, supplementing the control and management communication. This centralized approach helps organizations streamline deployment, monitoring, and troubleshooting of wireless networks..

inSecurityNetwork ServicesIoT
transport
udp

single transport

in transit
cleartext

payload readable on path

assignment
official

registered with iana

risk
4/10

caution

lookups
6,667

rank 768 of 993 · top 77%

Technical Details

what runs on :12222

Overview

LWAPP, standardized in RFC 5412, facilitates a split-MAC architecture in which access points rely heavily on controllers for management and forwarding decisions. Port 12222 is primarily used for the transmission of data frames encapsulated within LWAPP tunnels. This allows the AP to forward user network traffic securely and efficiently to the controller for processing.

Data Handling

LWAPP operates over both UDP and TCP, but the data channel frequently utilizes UDP. The protocol encapsulates frames from wireless clients and transports them to the controller, where they can be routed or bridged within the enterprise LAN. This segmentation helps preserve the security and management of wireless client sessions and supports mobility across APs.

Deployment Context

Networks deploying LWAPP usually operate in controller-based wireless environments typical of enterprise-scale organizations. The data port (12222/UDP) complements the control port (other ports like 12223) to differentiate data streams from command and control traffic. This separation allows for optimized handling and scaling of wireless data transmission.

Security Information

exposure of :12222

risk score

4/ 10caution

worth attention. how exposed you are depends on configuration — don't leave it reachable from the internet without a reason.

security averages 3.8 across 216 ports — this one sits 0.2 above.

in transit

cleartext

credentials and payloads are readable by anyone on path

assignment

official

registered with iana for this service — scanners fingerprint it by number

reachable over

udp

udp is connectionless — source addresses are trivially spoofed and it is a reflection favourite

security overview

Common Vulnerabilities

  • Spoofing & Unauthorized Access: Attackers may attempt to spoof APs or controllers to intercept, manipulate, or inject data frames.
  • Replay Attacks: Unencrypted data traffic over LWAPP is potentially susceptible to replay attacks, where intercepted packets are resent maliciously.
  • Denial-of-Service (DoS): Flooding this UDP port can overwhelm the controller, disrupting wireless connectivity.

Common Mitigations

  • Traffic Encryption: Deploy LWAPP over encrypted tunnels (e.g., CAPWAP with DTLS or IPsec overlays) to secure data in transit.
  • Device Authentication: Enable mutual authentication of controllers and APs to prevent rogue devices.
  • Segmentation & Access Controls: Limit network access to LWAPP ports using firewalls and VLAN segmentation.
  • Rate Limiting & Monitoring: Implement rate limiting on control/data ports and actively monitor for anomalous traffic patterns indicating attacks.

Related Ports

all 216 in security →

the 8 most looked-up other ports in security — 216 ports carry that label.

portservicerisk
:8881Atlasz Secure Servercaution
:443HTTPScaution
:8291Winbox MikroTik Admincaution
:3268Microsoft Global Catalog (GC)caution
:135Microsoft EPMAPcaution
:3128Squid Proxy HTTPcaution
:8080HTTP Alternatecaution
:7000Vuze HTTPS Trackercaution

risk mix of the 8 listed

  • caution100%

3 of 8 encrypted