Port 1646RADIUS Accounting
Port 1646 is primarily used by RADIUS accounting services, often involving Cisco and Juniper Networks devices. It facilitates the transmission of user accounting information, enabling network administrators to track user activity, session statistics, and billing data. This port complements RADIUS authentication (usually on port 1812 or alternatives), ensuring comprehensive management of network access and resource utilization..
- transport
- tcp · udp
- in transit
- cleartext
- assignment
- unofficial
- risk
- 4/10
- lookups
- 13,109
2 transports registered
payload readable on path
used by convention
caution
rank 288 of 993 · top 29%
Technical Details
what runs on :1646The Remote Authentication Dial-In User Service (RADIUS) protocol is an AAA (Authentication, Authorization, and Accounting) protocol widely implemented for centralized network access management. While RADIUS authentication typically uses port 1812, port 1646 is a legacy alternative primarily dedicated to transmitting accounting information. This separation allows for streamlined management and better scalability within large network deployments.
RADIUS accounting messages provide administrators with session logs and usage metrics. These messages include data such as session time, data usage, user identities, and reasons for session termination. The protocol uses UDP by default; however, TCP support exists in some implementations to improve transmission reliability.
Cisco and Juniper Network devices historically default to port 1646 for this accounting functionality. With newer RFC standards (such as RFC 2866 and updated IANA port assignments), port 1813 superseded 1646 as the official accounting port. Nonetheless, many legacy and customized environments continue to leverage 1646, thus remaining relevant in network management scenarios.
Security Information
exposure of :1646risk score
4/ 10caution
worth attention. how exposed you are depends on configuration — don't leave it reachable from the internet without a reason.
security averages 3.8 across 216 ports — this one sits 0.2 above.
in transit
cleartext
credentials and payloads are readable by anyone on path
assignment
unofficial
used by convention, not registered — what answers here varies by deployment
reachable over
tcp · udp
udp is connectionless — source addresses are trivially spoofed and it is a reflection favourite
security overview
Common Vulnerabilities:
- Lack of encryption exposes accounting data to interception (sniffing) or modification (man-in-the-middle attacks).
- Unauthorized access to the RADIUS server can lead to data breaches revealing user activity.
- Open UDP port can be targeted for amplification in DDoS attacks.
- Potential for replay attacks where intercepted accounting packets are resent.
Common Mitigations:
- Use IPsec or transport layer encryption (e.g., DTLS/TLS) to secure RADIUS traffic.
- Implement strong firewall rules limiting access only to trusted RADIUS clients and servers.
- Enable authentication mechanisms like shared secrets and rotate them regularly.
- Monitor and log access attempts for early threat detection.
- Ensure RADIUS servers run the latest firmware and security patches.
- Consider migrating entirely to the officially assigned ports with enhanced security support.
Related Ports
the 8 most looked-up other ports in security — 216 ports carry that label.
| port | service | risk | |||
|---|---|---|---|---|---|
| :8881 | Atlasz Secure Server | TCP | Web Services | caution | 67.6k |
| :443 | HTTPS | TCPtls | Web Services | caution | 65.9k |
| :8291 | Winbox MikroTik Admin | TCP | Security | caution | 62.9k |
| :3268 | Microsoft Global Catalog (GC) | TCPUDP | Security | caution | 54.6k |
| :135 | Microsoft EPMAP | TCPUDP | Security | caution | 51.9k |
| :3128 | Squid Proxy HTTP | TCP | Web Services | caution | 45.8k |
| :8080 | HTTP Alternate | TCPtls | Web Services | caution | 44.9k |
| :7000 | Vuze HTTPS Tracker | TCPtls | Security | caution | 28.9k |
risk mix of the 8 listed
- caution100%
3 of 8 encrypted