Port 3478STUN
Session Traversal Utilities for NAT (STUN) is a protocol that enables applications to discover their public IP address and the presence and type of network address translator (NAT) they are behind. This facilitates communication between devices located behind different NAT devices, which is crucial for peer-to-peer applications like voice and video chat..
- transport
- tcp · udp
- in transit
- cleartext
- assignment
- official
- risk
- 4/10
- lookups
- 7,045
2 transports registered
payload readable on path
registered with iana
caution
rank 727 of 993 · top 73%
Technical Details
what runs on :3478Session Traversal Utilities for NAT (STUN) is a standardized protocol defined in RFC 5389. Its primary purpose is assisting endpoints in communicating across firewalls and NATs by discovering their external (public) IP address and port mappings. It functions as a tool for NAT traversal by allowing clients to query a public STUN server, which responds with the IP and port as seen externally.
STUN works using a lightweight request/response model. The client sends a binding request to a well-known STUN server on port 3478 over UDP or TCP. The server returns the mapped IP address and port, enabling the client to learn its public-facing network information. This data helps applications attempt direct peer-to-peer connectivity in protocols such as WebRTC or SIP.
STUN is often combined with other protocols like TURN (Traversal Using Relays around NAT) and ICE (Interactive Connectivity Establishment) to create reliable NAT traversal mechanisms. STUN's simplicity favors low-latency NAT discovery, while TURN provides relay capabilities when direct connections fail.
Security Information
exposure of :3478risk score
4/ 10caution
worth attention. how exposed you are depends on configuration — don't leave it reachable from the internet without a reason.
network services averages 3.9 across 604 ports — this one sits 0.1 above.
in transit
cleartext
credentials and payloads are readable by anyone on path
assignment
official
registered with iana for this service — scanners fingerprint it by number
reachable over
tcp · udp
udp is connectionless — source addresses are trivially spoofed and it is a reflection favourite
security overview
Common Vulnerabilities:
- STUN does not provide built-in encryption or authentication, making responses susceptible to interception (man-in-the-middle attacks).
- Malicious servers could supply false external IP information or facilitate network reconnaissance.
- Exposure of internal/external IP mapping can aid attackers in fingerprinting devices or exploiting NAT behavior.
Common Mitigations:
- Use STUN over secure signaling channels (like DTLS-SRTP or HTTPS) to mitigate interception risks.
- Combine STUN with protocols that add authentication and encryption, such as TURN with proper access controls.
- Employ network firewalls and access control policies to limit unnecessary exposure of STUN services.
- Regularly audit and update STUN server software to patch vulnerabilities and enforce access restrictions.
Related Ports
the 8 most looked-up other ports in network services — 604 ports carry that label.
| port | service | risk | |||
|---|---|---|---|---|---|
| :9080 | Groove RPC | TCPUDP | Web Services | caution | 70.8k |
| :6543 | Jetnet | UDP | Network Services | caution | 65.3k |
| :5938 | TeamViewer | TCPUDP | Remote Access | caution | 65.0k |
| :8291 | Winbox MikroTik Admin | TCP | Security | caution | 62.9k |
| :3233 | WhiskerControl Protocol | TCPUDP | Network Services | caution | 61.9k |
| :3268 | Microsoft Global Catalog (GC) | TCPUDP | Security | caution | 54.6k |
| :135 | Microsoft EPMAP | TCPUDP | Security | caution | 51.9k |
| :3128 | Tatsoft Default HTTP Proxy | TCP | Web Services | caution | 46.8k |
risk mix of the 8 listed
- caution100%
0 of 8 encrypted