TCP Port 5060 – SIP (Session Initiation Protocol)
Port 5060 is the standard port for SIP (Session Initiation Protocol), the IETF protocol used to establish, modify, and terminate voice and video calls over IP networks. SIP itself does not carry the audio or video; it handles the signaling, the equivalent of telephony’s setup-and-teardown messages, while the actual media flows over RTP (Real-time Transport Protocol) on separately-negotiated ports. When a softphone places a call, when a VoIP-enabled office desk phone registers with its server, or when a voice-over-cellular call uses VoLTE, SIP is the protocol coordinating the session.
SIP was specified in RFC 3261 in 2002, with companion updates including RFC 3263 (locating SIP servers via DNS, the basis for the current IANA reference). The protocol is text-based, modeled loosely on HTTP, with request methods like INVITE, REGISTER, BYE, and OPTIONS that map directly to telephony operations. UDP/5060 is the dominant transport, TCP/5060 sees moderate use particularly for connections that need reliable delivery, and SCTP/5060 is registered for telecommunications carrier deployments but is rarely encountered outside that context.
SIP’s TLS-protected variant runs on a separate port: SIPS (SIP over TLS) on TCP/5061. The plaintext SIP on port 5060 carries credentials and call metadata in the clear, which has security implications discussed below. Modern enterprise VoIP deployments increasingly favor SIPS, but plaintext SIP on 5060 remains widespread in small-business PBXes, residential VoIP services, and carrier-side interconnect.
The largest SIP deployments are operated by telecommunications carriers and by VoIP service providers, with smaller deployments running on enterprise PBX platforms (open-source platforms like Asterisk and FreePBX, or commercial systems from Cisco, Avaya, Mitel, and others) and on residential ATA devices that translate analog phone connections into SIP over a broadband link.
Inbound UDP/5060 to a designated SIP server or PBX from authorized SIP trunks or registered endpoints is normal. Inbound UDP/5060 from the public internet to a host that is not a designated SIP server is unusual. Outbound UDP/5060 from end-user devices is normal when those devices have softphone or VoIP clients configured.
About TCP Port 5060
Port 5060 carries the IANA assignment for sip. The IANA description reads: ‘SIP’.
Security Considerations
Our data shows 23 IDS rules referencing port 5060, split across UDP (18 rules) and TCP (5 rules). The dominant pattern is reconnaissance: scanning and information-gathering against SIP servers, accounting for 18 of the 23 rules.
The reconnaissance rules name several specific scanning tools by signature. Sample rules detect Smap (a SIP-aware version of nmap), Voiper (a SIP fuzzing toolkit), and the Voiper Torturer module specifically. A general-purpose rule detects SIP OPTIONS-based service-information-gathering attempts on both UDP and TCP transports. The pattern of activity these tools generate is unmistakable: high-volume probing of SIP user-agent endpoints, brute-forcing of SIP registration credentials, and enumeration of valid extensions on a target PBX.
The largest commercial threat against internet-exposed SIP infrastructure is toll fraud. An attacker who compromises a PBX or guesses a valid SIP extension credential can place outbound calls through the victim’s telephony service, often to international premium-rate numbers operated by the attacker’s confederates. A successfully compromised PBX can generate thousands of dollars in fraudulent charges in a single weekend before being noticed, and fraud-claim recovery is uneven. Voice-over-IP fraud is one of the better-organized criminal industries in telecommunications.
Smaller categories of rule activity include a Shellshock-pattern bash environment-variable injection rule (CVE-2014-6271) on both UDP and TCP, detecting the same Shellshock family that appears in our DHCP rules: a SIP server that passed header values through bash-handler scripts could be exploited via crafted SIP requests. A protocol-command-decode rule detects inbound INVITE messages, useful for monitoring whether SIP traffic is reaching hosts that should not receive it.
Defensive practice for internet-facing SIP services is well established. SIP credentials should be strong and unique per account, with account lockout after repeated failures. Outbound calling should be restricted by destination, with international and premium-rate numbers requiring explicit allowlisting. Geographic IP filtering on registration endpoints can sharply reduce scanning volume. SIPS (SIP over TLS) on port 5061 should be preferred over plaintext SIP for any deployment where the SIP signaling carries sensitive call metadata or credentials. Session Border Controllers can provide defense in depth at the network edge.
Inbound UDP/5060 to a host that is not a designated SIP server or PBX is unusual in 2026 and warrants investigation. SIP-scanning traffic against any internet-exposed PBX is constant; the volume itself is not noteworthy, but successful registration attempts followed by unusual call patterns are the early signal of toll-fraud compromise.
IDS Rule References
5 IDS / security rules reference TCP port 5060. Treat that number as context, not a danger score. Many detection rules are written against groups of ports rather than one service, web ports especially, so common web alternate ports inherit large counts while genuinely sensitive services can show few rules or none. Presence in IDS rules does not mean traffic on this port is malicious.
Rule categories (top 2): attempted-recon (3), attempted-admin (2).
Sample rule descriptions for TCP port 5060:
- PROTOCOL-VOIP Possible SIP OPTIONS service information gathering attempt
- OS-OTHER Bash environment variable injection attempt
- ET SCAN SipCLI VOIP Scan – TCP
- ET SCAN NMAP SIP Version Detection Script Activity
- ET EXPLOIT Possible CVE-2014-6271 Attempt Against SIP Proxy
Data Sources
This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), and Snort Community Rules (GPLv2).