Port 2083RadSec
RadSec is a transport layer security (TLS) based protocol designed as a secure implementation of the RADIUS protocol. It protects RADIUS communication channels by encrypting data, ensuring confidentiality and integrity, making it suitable for exchanging authentication, authorization, and accounting information over untrusted networks such as the Internet..
- transport
- tcp
- in transit
- cleartext
- assignment
- official
- risk
- 4/10
- lookups
- 13,387
single transport
payload readable on path
registered with iana
caution
rank 275 of 993 · top 28%
1 other service is registered on port 2083. compare all 2 →
Technical Details
what runs on :2083RadSec, or RADIUS over TLS, is an extension of the traditional Remote Authentication Dial-In User Service (RADIUS) protocol to enhance security during transmission. Standard RADIUS messages are transmitted in cleartext over UDP, making them susceptible to interception and manipulation. RadSec addresses these limitations by encapsulating RADIUS packets within a TLS connection via TCP, thus adding encryption, authentication, and data integrity.
RadSec operates over port 2083/TCP by default. By leveraging TLS, it provides mutual authentication between RADIUS clients and servers, using certificates to verify identities before exchanging sensitive information. This encrypted channel ensures that credentials and other critical data remain protected in transit, particularly beneficial when roaming across multiple administrative domains or over public networks.
RadSec adoption continues to grow, especially within eduroam, Wi-Fi roaming, and large enterprise environments requiring secure AAA (authentication, authorization, and accounting) exchange. It integrates well with existing RADIUS infrastructure, typically requiring minimal modifications apart from configuring TLS certificates and ensuring software support for the protocol.
Security Information
exposure of :2083risk score
4/ 10caution
worth attention. how exposed you are depends on configuration — don't leave it reachable from the internet without a reason.
security averages 3.8 across 216 ports — this one sits 0.2 above.
in transit
cleartext
credentials and payloads are readable by anyone on path
assignment
official
registered with iana for this service — scanners fingerprint it by number
reachable over
tcp
every listening transport is another surface to filter at the edge
security overview
Common Vulnerabilities:
- TLS misconfiguration can expose the service to downgrade attacks or insecure cipher suites.
- Weak or expired certificates may allow man-in-the-middle (MitM) attacks, compromising the confidentiality of credentials.
- Poor access controls or network exposure may open the server to denial-of-service (DoS) attacks.
- Certificate chain validation failures can lead to unauthorized server acceptance.
Common Mitigations:
- Use strong, up-to-date TLS configurations with modern, secure cipher suites.
- Implement strict certificate management policies, including rotation, expiration monitoring, and revocation checking (CRL/OCSP).
- Restrict access to the server using firewalls, VPNs, or access control lists (ACLs).
- Monitor logs and network traffic for unauthorized connection attempts or anomalies.
- Regularly update and patch RADIUS/RadSec servers and TLS libraries.
Related Ports
the 8 most looked-up other ports in security — 216 ports carry that label.
| port | service | risk | |||
|---|---|---|---|---|---|
| :8881 | Atlasz Secure Server | TCP | Web Services | caution | 67.6k |
| :443 | HTTPS | TCPtls | Web Services | caution | 65.9k |
| :8291 | Winbox MikroTik Admin | TCP | Security | caution | 62.9k |
| :3268 | Microsoft Global Catalog (GC) | TCPUDP | Security | caution | 54.6k |
| :135 | Microsoft EPMAP | TCPUDP | Security | caution | 51.9k |
| :3128 | Squid Proxy HTTP | TCP | Web Services | caution | 45.8k |
| :8080 | HTTP Alternate | TCPtls | Web Services | caution | 44.9k |
| :7000 | Vuze HTTPS Tracker | TCPtls | Security | caution | 28.9k |
risk mix of the 8 listed
- caution100%
3 of 8 encrypted