Port 4334NETCONF Call Home over SSH

TCP 4334 is the standard listener port for NETCONF managers receiving SSH Call Home connections from managed devices.

transport: tcp
in transit: encrypted
assignment: official
risk: 7/10
lookups: 0

also known as netconf-ch-ssh, NETCONF Call Home SSH

Technical Details

what runs on :4334

TCP 4334 is the registered port for NETCONF Call Home over SSH. The NETCONF manager listens on this port, and the managed device initiates the TCP connection and SSH session; SSH roles and NETCONF client/server roles therefore do not line up in the usual way. After SSH authentication, the device requests the netconf subsystem, and NETCONF messages use the SSH transport framing defined by RFC 6242. This is a distinct service from ordinary SSH on TCP 22, though both use SSH.

Security Information

exposure of :4334

risk score

7/ 10risk

treat as sensitive. widely scanned and regularly exploited when reachable — restrict it to known sources.

remote access averages 3.8 across 204 ports — this one sits 3.2 above.

in transit

encrypted

payloads are protected on the wire

assignment

official

registered with iana for this service — scanners fingerprint it by number

reachable over

tcp

every listening transport is another surface to filter at the edge

security overview

SSH encrypts the connection and provides authentication, but a NETCONF session can expose powerful network configuration and operational data. Keep the listener restricted to expected managed-device addresses, require strong authentication, and apply least privilege; avoid exposing it broadly to the internet. An attacker who can authenticate with suitable NETCONF permissions may be able to alter device configuration.

Record

iana registry entry

port: :4334
service: NETCONF Call Home over SSH
transport: TCP
encryption: tls / encrypted
assignment: iana registered
risk: 7/10risk
category: Remote Access Network Services
usage: A managed network device initiates an SSH connection to a NETCONF manager listening on TCP 4334, reversing the usual direction of a NETCONF connection. This is used to let devices reach a manager through networks where inbound access to the device is unavailable; the port is not commonly found open in internet-wide scans.
lookups: 0rank 993
added: 2026-10-04
updated: 2026-10-04
references: IANA service name registry — port 4334
RFC 8071

Something wrong?

This record is maintained by the engineers who use port 4334. Every field on it is editable — change what's wrong, say how you know, and a reviewer publishes it, usually within a minute. Last touched 2026-10-04.

01edit any field on a page of its own
02a model checks it for accuracy and spam
03clean and confident goes live immediately

edit this record →back to the registry

Related Ports

all 204 in remote access →

the 8 most looked-up other ports in remote access — 204 ports carry that label.

port	service	proto	category	risk	views
:8000	Intel Remote Desktop / Alternate HTTP Port	TCP	Web Services	safe	84.3k
:8888	D2GS Admin Console	TCP	Remote Access	caution	83.7k
:8881	Atlasz Secure Server	TCP	Web Services	caution	67.6k
:5938	TeamViewer	TCPUDP	Remote Access	caution	65.0k
:8291	Winbox MikroTik Admin	TCP	Security	caution	62.9k
:8008	IBM HTTP Server Admin	TCP	Web Services	caution	58.3k
:135	Microsoft EPMAP	TCPUDP	Security	caution	51.9k
:23	Telnet	TCP	Remote Access	caution	34.8k

risk mix of the 8 listed

safe13%
caution88%

0 of 8 encrypted

Port :4334NETCONF Call Home over SSH

Technical Details

Security Information

Related Ports

Port 4334NETCONF Call Home over SSH