TCP Port 1433 – Microsoft SQL Server (MSSQL)
Port 1433 is the default port for Microsoft SQL Server, the relational database product Microsoft has shipped under various names since the late 1980s. MSSQL is one of the most widely deployed enterprise databases, particularly in Windows-centric environments. When a business application stores customer records in a structured database, when a SharePoint server keeps document metadata, when a custom internal tool tracks inventory or accounting data on a Windows server, the underlying database is often Microsoft SQL Server reachable on TCP port 1433.
SQL Server uses port 1433 as the default for the primary database engine, but a single host can run multiple SQL Server instances simultaneously, with secondary instances using dynamically assigned ports. The SQL Server Browser service on UDP port 1434 helps clients discover which port a named instance is using; this is the same port that the SQL Slammer worm targeted in 2003.
SQL Server is typically deployed in one of two configurations. In smaller environments, it runs on the same machine as the application using it, and only local connections are allowed. In larger environments, a dedicated database server hosts SQL Server and accepts connections from application servers across an internal network. In both cases, port 1433 should be reachable only from authorized application servers, never from the public internet directly.
Outbound TCP/1433 from end-user devices is uncommon and usually indicates an administrative tool (SQL Server Management Studio, Azure Data Studio) connecting directly to a database. Inbound TCP/1433 from the public internet to any host is unusual in 2026 and is widely treated as a serious exposure.
About TCP Port 1433
Port 1433 carries the IANA assignment for ms-sql-s. The IANA description reads: ‘Microsoft-SQL-Server’.
Security Considerations
MSSQL on port 1433 has a security history shaped by two main concerns: the historical exposure of database servers directly to the internet, and the unusual breadth of what an attacker with valid database credentials can do on the host operating system.
The historical concern is anchored by the SQL Slammer worm of January 2003, which exploited a buffer overflow in the SQL Server Resolution Service (UDP port 1434, paired with TCP 1433) and infected an estimated 75,000 hosts in roughly ten minutes. Slammer caused widespread internet outages and made “do not expose MSSQL to the internet” a near-universal best practice from that point forward. Slammer’s success was possible because thousands of organizations had MSSQL servers reachable from anywhere on the internet, often unintentionally and almost always with default configurations. The practical lessons of that event have been internalized for over twenty years, and direct internet exposure of port 1433 is much rarer in 2026 than it was in 2003.
The post-authentication concern is more current. Microsoft SQL Server provides an unusually rich set of system stored procedures and extended stored procedures that allow privileged actions on the host operating system from inside the database engine. Our data shows 26 IDS rules referencing port 1433, dominated by attempted-user classtypes, with sample rules detecting abuse of specific procedures: sp_start_job (run a scheduled job as the SQL Server service account), sp_password (change passwords), sp_adduser (create database users), xp_reg-prefixed procedures (read and write the Windows registry), and most notably xp_cmdshell, which executes arbitrary operating system commands as the SQL Server service account. An attacker who obtains valid MSSQL credentials, whether through brute force against the sa account, through SQL injection in a web application that uses the database, or through stolen credentials, can frequently escalate from database access to full host compromise using these built-in features.
Common practice today is to keep the SQL Server engine reachable only from authorized application servers on internal networks, disable xp_cmdshell on production database servers unless it is genuinely required, use Windows authentication rather than SQL Server authentication where possible, enforce strong passwords on the sa account or disable it entirely in favor of named accounts with limited privileges, and monitor authentication logs for brute-force patterns.
Inbound TCP/1433 from the public internet to any host is a strong indicator of either a serious misconfiguration or an active attack scan and warrants immediate investigation.
IDS Rule References
26 IDS / security rules reference TCP port 1433. Presence in IDS rules does not mean traffic on this port is malicious. These are patterns security tools monitor.
Rule categories (top 6): attempted-user (13), trojan-activity (6), unsuccessful-user (3), shellcode-detect (2), misc-activity (1), bad-unknown (1).
Sample rule descriptions for TCP port 1433:
- SQL sp_start_job – program execution
- SQL sp_password – password change
- SQL sp_delete_alert log file deletion
- SQL sp_adduser – database user creation
- SERVER-MSSQL xp_reg* – registry access
Malware Activity
A meaningful share of monitored traffic on this port involves malware indicators.
6 of 26 IDS rules for TCP port 1433 involve malware activity.
Families observed (top 1): Banload (1).
Data Sources
This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), and Snort Community Rules (GPLv2).