Port 1589Cisco VQP / VMPS
Cisco's VLAN Query Protocol (VQP) facilitates dynamic VLAN assignments by querying VLAN Management Policy Servers (VMPS). Operating primarily over UDP, it allows network switches to determine which VLAN a device should belong to based on its MAC address. This aids in automated network policy enforcement and scalable, dynamic network segmentation..
- transport
- udp
- in transit
- cleartext
- assignment
- unofficial
- risk
- 4/10
- lookups
- 6,176
single transport
payload readable on path
used by convention
caution
rank 810 of 993 · top 82%
Technical Details
what runs on :1589Overview:
Cisco VLAN Query Protocol (VQP) is employed on Cisco Catalyst switches to automate VLAN assignments for network devices. It typically leverages UDP port 1589 to communicate queries from a switch acting as a client to a VLAN Management Policy Server (VMPS). The VMPS responds with VLAN configuration details based on the device's MAC address.
Operation:
When a device connects to a switch port set for dynamic VLAN membership, the switch sends a VQP query over UDP 1589 to the VMPS. The request includes the device's MAC address and port information. The VMPS server determines which VLAN the device belongs to, instructing the switch to assign the VLAN dynamically. This streamlines network management in environments with many devices or frequent changes.
Deployment:
VQP and VMPS are proprietary Cisco technologies and generally used within Cisco-centric infrastructures. While VQP simplifies VLAN administration, it lacks encryption or strong authentication mechanisms. Over time, industry best practice has shifted towards more secure options like IEEE 802.1X with dynamic VLAN assignment via RADIUS, which provide enhanced security and flexibility.
Security Information
exposure of :1589risk score
4/ 10caution
worth attention. how exposed you are depends on configuration — don't leave it reachable from the internet without a reason.
security averages 3.8 across 216 ports — this one sits 0.2 above.
in transit
cleartext
credentials and payloads are readable by anyone on path
assignment
unofficial
used by convention, not registered — what answers here varies by deployment
reachable over
udp
udp is connectionless — source addresses are trivially spoofed and it is a reflection favourite
security overview
Common Vulnerabilities
- Lack of Encryption: Communication over UDP 1589 is unencrypted, exposing VLAN assignment data to eavesdropping.
- No Strong Authentication: Because VQP lacks robust mutual authentication, attackers can spoof VMPS replies or impersonate clients.
- Potential VLAN Hopping: Attackers may manipulate VQP queries/responses to gain unauthorized access to VLANs (VLAN hopping).
Common Mitigations
- Restrict VMPS Communication: Use access control lists (ACLs) to limit which devices can send/receive on UDP 1589.
- Network Segmentation: Place VMPS servers in secure, isolated management VLANs.
- Transition to Secure Standards: Consider replacing VMPS/VQP with IEEE 802.1X and RADIUS, which support encryption and better authentication.
- Monitoring: Enable detailed logging on switches to detect suspicious VQP traffic or unauthorized VLAN changes.
Related Ports
the 8 most looked-up other ports in security — 216 ports carry that label.
| port | service | risk | |||
|---|---|---|---|---|---|
| :8881 | Atlasz Secure Server | TCP | Web Services | caution | 67.6k |
| :443 | HTTPS | TCPtls | Web Services | caution | 65.9k |
| :8291 | Winbox MikroTik Admin | TCP | Security | caution | 62.9k |
| :3268 | Microsoft Global Catalog (GC) | TCPUDP | Security | caution | 54.6k |
| :135 | Microsoft EPMAP | TCPUDP | Security | caution | 51.9k |
| :3128 | Squid Proxy HTTP | TCP | Web Services | caution | 45.8k |
| :8080 | HTTP Alternate | TCPtls | Web Services | caution | 44.9k |
| :7000 | Vuze HTTPS Tracker | TCPtls | Security | caution | 28.9k |
risk mix of the 8 listed
- caution100%
3 of 8 encrypted