Port 5672 – AMQP

TCP

Port 5672 is the default AMQP 0-9-1 port used by RabbitMQ and other message brokers. AMQPS (AMQP over TLS) uses port 5671. AMQP is the protocol behind RabbitMQ queues, exchanges, and bindings. Port 5672 should only be accessible from application servers, not the public internet.

Port Number

5672

Protocol

TCP

Service

Advanced Message Queuing Protocol

Range

IANA Registered (1024–49151)

Description

AMQP (Advanced Message Queuing Protocol) on port 5672 is the standard protocol for message queuing systems. RabbitMQ is the most widely deployed AMQP broker. AMQP defines exchanges (routing), queues (storage), and bindings (rules). Port 5672 is plaintext – production should use port 5671 (AMQPS) or a TLS-terminating proxy. The RabbitMQ management UI runs on port 15672.

Security risks

1Default credentials: RabbitMQ ships with guest/guest credentials that have full admin access. The guest user is restricted to localhost connections only since 3.3.0, but older versions allowed it from any host. Change immediately: rabbitmqctl change_password guest or delete the user.
2Unencrypted credentials: AMQP PLAIN authentication on port 5672 sends credentials in cleartext. Use AMQPS on port 5671 or require EXTERNAL (client cert) authentication in production. Alternatively, use AMQP SASL SCRAM-SHA-256.
3Queue/exchange manipulation: a user with full permissions can delete queues (losing messages), purge contents, or create bindings that intercept messages meant for other consumers. Use vhost isolation and fine-grained permissions (configure/write/read per vhost).

Firewall guidance

Allow inbound 5672 only from application servers that publish/consume messages. Never expose to the internet. The management UI (15672) should be on a separate admin network. Use AMQPS (5671) for any connection traversing untrusted networks. In Kubernetes, expose via ClusterIP service (not LoadBalancer).

Diagnosis commands

Check RabbitMQ node health, Erlang version, and listener ports

shell

rabbitmqctl status

List active AMQP connections and their states

shell

rabbitmqctl list_connections name state

RabbitMQ management API – overview stats (queues, messages, rates)

shell

curl -u admin:pass http://localhost:15672/api/overview

Detect AMQP service and RabbitMQ version remotely

shell

nmap -sV -p 5672 target

Usage examples

Port 5672 – AMQP

shell

amqp://user:password@localhost:5672/vhost
rabbitmqctl list_queues -p / name messages
python -m pika connection_params host=localhost port=5672

Common services on this port

RabbitMQApache QpidAzure Service Bus (AMQP)Amazon MQLavinMQApache ActiveMQ Artemis

Related ports

5671

AMQPS (TLS encrypted)

15672

RabbitMQ Management UI

1883

MQTT (alternative messaging)

History

AMQP was designed by JPMorgan Chase in 2003 for reliable financial messaging. AMQP 0-9-1 (2008) became the de facto standard implemented by RabbitMQ. AMQP 1.0 (2012, OASIS standard) is a different wire protocol – RabbitMQ supports both via plugin. Port 5672 was registered with IANA for AMQP.

FAQ

RabbitMQ vs Kafka – when to use which?

RabbitMQ (AMQP, port 5672): message routing, task queues, request-reply patterns, when you need flexible exchange-based routing and per-message acknowledgment. Kafka (port 9092): event streaming, log aggregation, replay capability, when you need high-throughput append-only logs with consumer groups reading at their own pace.

What is the management port 15672?

RabbitMQ's HTTP management API and web UI run on port 15672. It provides queue/exchange/binding management, connection monitoring, and message publishing for debugging. Enable with: rabbitmq-plugins enable rabbitmq_management. Restrict to admin networks.