Port 1433 – Microsoft SQL Server

TCP

Port 1433 is the default Microsoft SQL Server port. Like all database ports, it must never be exposed to the public internet. SQL Server supports TLS encryption on port 1433 with certificate-based authentication. Windows Firewall should restrict access to only application server IPs. Named instances use SQL Server Browser on UDP 1434 to resolve to dynamic ports.

Port Number

1433

Protocol

TCP

Service

Microsoft SQL Server

Range

IANA Registered (1024–49151)

Description

SQL Server listens on TCP port 1433 for default instances. Named instances use dynamic ports assigned at startup, with UDP port 1434 (SQL Server Browser service) providing port resolution. SQL Server 2014+ encrypts connections by default when certificates are configured. SQL Server on Azure uses port 1433 with forced TLS and AAD authentication.

Security risks

1sa account brute-force: the default 'sa' (system administrator) account is the #1 target on exposed SQL Server instances. Disable sa, use Windows Authentication, or rename sa and enforce strong passwords with account lockout.
2xp_cmdshell RCE: if an attacker gains sysadmin access, EXEC xp_cmdshell 'command' executes OS commands as the SQL Server service account. Disable xp_cmdshell: sp_configure 'xp_cmdshell', 0; RECONFIGURE;
3SQL Server Browser (UDP 1434) information disclosure: the Browser service responds to broadcast probes with instance names, versions, and ports. Disable the Browser service if all clients use static ports. Block UDP 1434 at the firewall.
4Unencrypted TDS: SQL Server's TDS protocol transmits data in cleartext by default unless Force Encryption is enabled on the server or Encrypt=true in the connection string. Login packets are always encrypted, but subsequent data is not.

Firewall guidance

Allow inbound 1433 only from application server IPs and DBA jump boxes. Never use 0.0.0.0/0. Azure SQL Database forces TLS and uses AAD auth by default. On-premises: enable Force Encryption in SQL Server Configuration Manager and use Windows Integrated Authentication over SQL Authentication where possible.

Diagnosis commands

Test connectivity and show SQL Server version

shell

sqlcmd -S host,1433 -U sa -P pass -Q 'SELECT @@VERSION'

Remote SQL Server detection and version fingerprinting

shell

nmap -sV -p 1433 --script ms-sql-info target

PowerShell TCP connectivity test to SQL Server

shell

Test-NetConnection -ComputerName host -Port 1433

Usage examples

Port 1433 – Microsoft SQL Server

shell

sqlcmd -S localhost,1433 -U sa -P password
jdbc:sqlserver://localhost:1433;databaseName=mydb
ssh -L 1433:localhost:1433 user@server

Common services on this port

Microsoft SQL ServerAzure SQL DatabaseAmazon RDS SQL ServerSQL Server Express

Related ports

1434

SQL Server Browser (UDP)

3306

MySQL (similar role)

5432

PostgreSQL (similar role)

History

SQL Server was originally co-developed by Microsoft and Sybase in 1989. Microsoft took full ownership with SQL Server 7.0 (1998). Port 1433 was registered with IANA for ms-sql-s. Azure SQL Database (2010) made port 1433 the standard for cloud SQL Server with forced TLS.

FAQ

Why does SQL Server use both TCP 1433 and UDP 1434?

TCP 1433 carries the actual database protocol (TDS). UDP 1434 runs the SQL Server Browser service which maps instance names to their actual TCP ports (named instances use dynamic ports). If you only run one default instance, you do not need UDP 1434.

How do I connect to Azure SQL Database?

Azure SQL enforces TLS on port 1433 with no option to disable it. Connection string: Server=tcp:yourserver.database.windows.net,1433;Encrypt=True;TrustServerCertificate=False. Firewall rules in Azure portal must allowlist your client IP.