Port 6667 – IRC
TCPPort 6667 is the standard IRC (Internet Relay Chat) default port. IRC provides real-time text messaging in channels and private messages. Port 6667 is unencrypted – all messages, nicknames, and server passwords travel in cleartext. Use port 6697 (IRC over TLS) for any connection where privacy matters.
Port Number
6667
Protocol
TCP
Service
Internet Relay Chat (Default)
Range
IANA Registered (1024–49151)
Description
Security risks
- 1Botnet command-and-control: port 6667 is the single most common IRC C2 channel for malware. Botnets like Mirai, Storm, and Zeus variants connect to IRC channels on 6667 to receive DDoS instructions, spam targets, and credential dumps. Enterprise IDS systems specifically flag outbound 6667 traffic as high-risk.
- 2No encryption: all protocol messages on port 6667 are plaintext. NickServ IDENTIFY passwords (sent via PRIVMSG), private messages, and channel content are readable by any network observer. MITM trivially intercepts IRC sessions for credential theft.
- 3Channel flooding / DDoS: IRC servers on port 6667 can be targets of JOIN floods, CTCP floods, and channel message storms. Compromised accounts spam channels with malicious links or phishing content, leveraging the real-time nature of IRC for social engineering.
- 4Nick hijacking: without SASL authentication (available on TLS ports), NickServ password identification on port 6667 sends credentials in cleartext. Intercepted NickServ passwords allow nick takeover, channel access, and impersonation.
- 5ISP/corporate blocking: many ISPs and corporate firewalls block port 6667 outright due to its botnet association. This blocking is justified – legitimate IRC users should migrate to 6697 (TLS) which is less commonly blocked and actually secure.
Firewall guidance
Diagnosis commands
Check for active IRC connections (unexpected connections indicate potential compromise)
ss -tnp | grep ':6667'Identify IRC server software and version
nmap -sV -p 6667 targetQuick IRC server detection – sends minimal handshake
nc target 6667 <<< 'NICK test
USER test 0 * :test
QUIT'Capture plaintext IRC traffic (demonstrates why TLS is needed)
tcpdump -i eth0 port 6667 -A | head -50Usage examples
irssi -c irc.libera.chat -p 6667
HexChat: /server irc.libera.chat 6667
telnet irc.server.com 6667Common services on this port
Related ports
History
IRC was created in 1988 at the University of Oulu, Finland. Port 6667 became the de facto standard through convention in the early 1990s (never formally assigned by IANA for IRC specifically). IRC powered the early internet's real-time communication – predating web chat, instant messaging, and social media. The protocol remains in RFC 2812 (2000). Botnet abuse of port 6667 began in the late 1990s and peaked in the 2000s, leading to widespread blocking. Libera.Chat (2021, successor to Freenode) and OFTC remain the largest IRC networks for open-source coordination.
FAQ
Is IRC still used for legitimate purposes?
Yes – Libera.Chat hosts channels for Linux kernel development, Debian, Fedora, Python, Ruby, and hundreds of open-source projects. OFTC serves FreeBSD, Tor, and QEMU communities. IRC's simplicity, logging capabilities, and bot ecosystem (for CI/CD notifications, automated ops) keep it relevant for developer coordination. But all legitimate use should be on port 6697 (TLS), not 6667.
How do I detect IRC botnet traffic on my network?
Monitor outbound connections to ports 6660-6669 and 6697 from servers that have no business using IRC. Look for: periodic connections from the same host to the same external IP, encoded/obfuscated PRIVMSG content, rapid JOIN/PART cycling, and connections from servers to previously-unknown IRC networks. Tools: Zeek/Bro has IRC protocol analyzer, Snort has IRC botnet signatures (SID 2001569-2001583).