Home / Guides / Ports and Protocols
Ports and Protocols for CCTV and IP Networks
A reference list of the standard ports and protocols you meet when you plan or secure an IP camera network, with what each one does and whether it is encrypted. Port numbers and names were checked against the IANA registry.
How to use this list
Use it when you set up a firewall, open a port to a recorder, or work out why a camera cannot reach a server. The descriptions are in plain words; the service names are written as in the IANA Service Name and Transport Protocol Port Number Registry. Statements about encryption are protocol facts: plain RTSP, HTTP, Telnet, FTP, TFTP, SMTP and MQTT on its default port are not encrypted by the protocol.
Video and discovery
| Port | Service | What it does |
|---|---|---|
| 554 | RTSP | Real Time Streaming Protocol: how players and recorders ask a camera for a live video stream. Plain RTSP does not encrypt the video. |
| 8554 | RTSP (alternate) | The alternate port for RTSP, used when 554 is taken or blocked. |
| 3702 | WS-Discovery | Web Services Discovery: lets ONVIF tools find cameras on the local network. Usually sent as UDP multicast. |
| 1900 | SSDP | Simple Service Discovery Protocol, used by UPnP to find devices. Keep it off the internet and switch UPnP off on cameras. |
| 5353 | mDNS | Multicast DNS: devices announce their names on the local network without a DNS server. |
Web and remote access
| Port | Service | What it does |
|---|---|---|
| 80 | HTTP | Web pages without encryption. Many cameras and recorders use it for their web interface; logins and pictures can be read on the network. |
| 443 | HTTPS | Web pages over TLS. Use it for the camera web interface whenever the device supports it. |
| 8080 | HTTP (alternate) | The alternate port for HTTP, often used when port 80 is taken or blocked. |
| 22 | SSH | Secure Shell: an encrypted remote command line. Some devices offer it for support; switch it off if you do not use it. |
| 23 | Telnet | A remote command line with no encryption. Switch it off on cameras and recorders. |
| 3389 | RDP | Remote Desktop: the remote screen of a Windows PC, for example a PC that runs video software. Do not open it to the internet. |
Network services
| Port | Service | What it does |
|---|---|---|
| 53 | DNS | Domain Name System: turns names into IP addresses. Cameras use it for a server name or a cloud address. |
| 67 | DHCP (server) | The DHCP server port: it hands out IP addresses to devices that ask. A camera set to automatic addressing gets its address this way. |
| 68 | DHCP (client) | The DHCP client port: where a device receives the answer from the DHCP server. |
| 69 | TFTP | Trivial File Transfer Protocol: simple file transfer with no encryption, sometimes used to load firmware. Keep it on the local network. |
| 123 | NTP | Network Time Protocol: sets the clock. Cameras and recorders need the same correct time so that their recordings match. |
| 161 | SNMP | Simple Network Management Protocol: lets a monitoring tool read the status of switches and other devices. Usually UDP. |
| 162 | SNMP trap | The port on which a monitoring server receives alerts that devices send by themselves (SNMP traps). |
| 389 | LDAP | Lightweight Directory Access Protocol: a central user directory, used by some recorders and software to sign users in against a company directory. |
| 514 | Syslog | Syslog over UDP: devices send their log messages to a log server. |
Files and mail
| Port | Service | What it does |
|---|---|---|
| 21 | FTP | File Transfer Protocol: file transfer with no encryption. Some cameras upload pictures with it; the password is sent in clear text. |
| 25 | SMTP | Sending mail between servers. Some cameras use it for alarm e-mails; it is usually not encrypted. |
| 587 | Mail submission | Mail submission from a device or app to a mail server, usually with a login. The usual port for camera alarm e-mails. |
Messaging and calls
| Port | Service | What it does |
|---|---|---|
| 1883 | MQTT | Message Queuing Telemetry Transport: small messages for smart-home and IoT systems. Not encrypted on this port. |
| 8883 | MQTT over TLS | MQTT over TLS: the encrypted version of MQTT. |
| 5060 | SIP | Session Initiation Protocol: starts and ends voice and video calls, for example for door stations and intercoms. |
| 5061 | SIP over TLS | SIP over TLS: the encrypted version of SIP. |
What is not listed, on purpose
Manufacturers' own ports, such as the service ports of particular camera brands, are not in the IANA registry as camera ports, so they are not listed here. Use the manual of the exact device for those. Port 8443 is left out because IANA assigns it to another service, so it is not the registered web alternate, and 1935 because the registry text names a different product.
Worked example
A recorder will be viewed in a browser from another building. HTTPS on 443 carries the web interface with encryption, RTSP on 554 carries video to players (not encrypted), and NTP on 123 keeps the clocks right. Do not forward 23 or 3389 to the internet.
Frequently asked questions
Which port does RTSP use?
RTSP uses port 554, and 8554 is the usual alternate. Plain RTSP does not encrypt the video.
Which ports should I never open to the internet?
Management ports such as Telnet (23), Remote Desktop (3389), SSH (22) and SNMP (161), unless you have a specific, protected reason. Use a VPN instead.
What is the difference between port 80 and 443?
Port 80 is HTTP, with no encryption. Port 443 is HTTPS, which uses TLS. Use 443 for a camera or recorder web interface whenever the device supports it.
Why do cameras need NTP?
Cameras and recorders need the same correct time so that their recordings and logs match.
Where do I find a camera maker's own ports?
In the manual of the exact device. They are not in the IANA registry as camera ports.