Port 5060 – SIP

TCP/UDP

Port 5060 is the SIP (Session Initiation Protocol) port for VoIP call signaling. SIP on port 5060 handles call setup, teardown, and presence – the actual voice/video flows over RTP on dynamic ports. Unencrypted SIP exposes call metadata and enables toll fraud. Use SIPS on port 5061 (TLS) for production VoIP.

Port Number

5060

Protocol

TCP/UDP

Service

Session Initiation Protocol

Range

IANA Registered (1024–49151)

Description

SIP on port 5060 is the signaling protocol for VoIP, video conferencing, and unified communications. It handles INVITE (call setup), BYE (call teardown), REGISTER (device registration), and SUBSCRIBE/NOTIFY (presence). The actual media streams use RTP on separate ports negotiated via SDP. Exposed SIP on port 5060 is a prime target for toll fraud – attackers register rogue endpoints and make international calls billed to the victim. SIP scanners (sipvicious) constantly probe port 5060 on the internet. Protect with: strong registration passwords, fail2ban for SIP auth failures, topology hiding (SBC/session border controller), and TLS on port 5061 for encrypted signaling.

Security risks

1Toll fraud: exposed SIP on port 5060 is the #1 target for telecom fraud – attackers register rogue extensions and make international calls billed to the PBX owner ($46B/year global fraud per CFCA)
2CVE-2022-26499: Asterisk SIP INVITE handling RCE – specially crafted SIP message causes buffer overflow in the dialog handling code (CVSS 9.8)
3SIP credential brute-force: registration attempts with username enumeration (different error codes for 'user exists' vs 'user doesn't exist') enable targeted password attacks
4Eavesdropping: SIP signaling on port 5060 is plaintext – call metadata (who called whom, when, duration) and sometimes DTMF tones (credit card numbers entered via phone) are visible
5Call hijacking/interception: without SRTP for media, an attacker who captures SIP signaling (5060) knows the RTP ports and can intercept the audio stream directly

Firewall guidance

Never expose port 5060 directly to the internet. Deploy a Session Border Controller (SBC) as the public-facing SIP endpoint – it handles NAT traversal, rate limiting, and topology hiding. For SIP trunking: use port 5061 (TLS) with mutual authentication. Internally: restrict 5060 to IP phones' VLAN and the PBX subnet. Enable fail2ban for SIP (ban after 5 failed registrations).

Diagnosis commands

Scan for SIP devices on the network (security audit)

shell

sipvicious svmap 10.0.0.0/24

Enumerate valid SIP extensions (should fail if properly configured)

shell

sipvicious svwar -e 100-200 target

Asterisk: list registered SIP endpoints and their status

shell

asterisk -rx 'sip show peers'

Capture SIP messages (look for plaintext credentials in REGISTER)

shell

tcpdump -i eth0 -n port 5060 -c 5 -A

Usage examples

Port 5060 – SIP

shell

sipvicious svmap 192.168.1.0/24
sngrep -d eth0 port 5060
asterisk -rx 'sip show peers'

Common services on this port

Asterisk PBXFreeSWITCHKamailio SIP Proxy3CXTwilio (SIP trunking)Microsoft Teams (Direct Routing)

Related ports

5060

SIP UDP/TCP (this port, unencrypted)

5061

SIP TLS (encrypted signaling)

5060

SIP (this port)

10000

RTP media (dynamic range 10000-20000)

History

SIP (Session Initiation Protocol) was standardized in RFC 3261 (2002), designed by IETF as the VoIP signaling protocol to replace H.323. Port 5060 was assigned for both UDP and TCP. SIP became the dominant VoIP protocol powering IP telephony worldwide. The protocol was designed for trusted networks – security was an afterthought. Toll fraud via exposed SIP servers became a $46B/year industry. Modern deployments require SBCs, TLS, and SRTP as minimum security measures.

FAQ

How do I protect Asterisk from toll fraud?

1. Never expose 5060 to internet without an SBC. 2. Set alwaysauthreject=yes in sip.conf (prevents username enumeration). 3. Use strong passwords (16+ chars) for all extensions. 4. Set call-limit per extension. 5. Block international dialing by default (deny dial pattern _011. and _00.). 6. Install fail2ban with Asterisk filter (ban after 3 failed registrations). 7. Monitor CDR for unusual patterns (calls to premium rate numbers, calls at unusual hours).

SIP vs WebRTC for modern VoIP?

SIP (port 5060/5061): established protocol with massive ecosystem (phones, PBXes, PSTN gateways), supports PSTN interconnection natively, requires dedicated infrastructure (SBC, SIP trunks). WebRTC: browser-native, peer-to-peer capable, mandatory encryption (DTLS-SRTP), works through firewalls via TURN/STUN. Many modern systems use both: WebRTC for browser/app clients, SIP for PSTN connectivity and desk phones. They interwork via a gateway.

Specification

RFC 3261 – Port 5060 specification →