TCP Port 3306 – MySQL / MariaDB
Port 3306 is the default port for MySQL and MariaDB, two closely related open-source relational database servers. MySQL was originally released in 1995 by MySQL AB and became the dominant open-source database for web applications during the 2000s, particularly as part of the LAMP stack (Linux, Apache, MySQL, PHP) that powered much of the early dynamic web. After Oracle Corporation acquired MySQL in 2010, the original MySQL development community forked the codebase to create MariaDB, which has since evolved as a drop-in replacement and is the default in many Linux distributions.
Both databases speak the same wire protocol on port 3306, and most client libraries, applications, and management tools work with either server interchangeably. From a network perspective, MySQL traffic and MariaDB traffic are indistinguishable, and the IDS rules referencing port 3306 apply equally to both.
MySQL and MariaDB are most commonly used as the data layer for web applications: WordPress, Joomla, MediaWiki, and many custom internal applications store their data in a MySQL or MariaDB database and connect to it across the network on port 3306. In typical deployments, the database server and the web application server are separate machines on an internal network, and the database accepts connections only from authorized application servers, never from the public internet directly.
Outbound TCP/3306 from end-user devices is uncommon and usually indicates a database administration tool (MySQL Workbench, DBeaver, phpMyAdmin if accessed via a tunnel, command-line mysql client) connecting directly to a database server. Inbound TCP/3306 from the public internet to any host is unusual in 2026 and is widely treated as a serious exposure.
About TCP Port 3306
Port 3306 is registered with the Internet Assigned Numbers Authority (IANA) for mysql. The IANA description reads: ‘MySQL’.
Security Considerations
The dominant security concern for port 3306 is automated credential brute-forcing against the root account. Our data shows 16 IDS rules referencing this port, and almost every one targets variations of the same pattern: high-volume login attempts using the root username and common or breached password lists. Sample rules detect MySQL root login attempts across MySQL 4.0 and 4.1 versions, repeated brute-force attempts, multiple login failures within a short window, and connections from hosts that should not be reaching the database server. Any internet-facing MySQL or MariaDB server with a public IP receives a continuous stream of such attempts.
The post-authentication risk on MySQL and MariaDB is smaller than the equivalent on Microsoft SQL Server. The protocol does not provide built-in operating system command execution comparable to MSSQL’s xp_cmdshell, and the stored procedure model is more limited. However, several attack paths from credentialed access do exist. User-defined functions (UDFs) loaded from shared libraries can execute arbitrary code in the database engine’s process context if the attacker can write a library file to a path the server can read. The FILE privilege, if granted, allows reading and writing files within the server’s permitted paths. Vulnerabilities in specific MySQL and MariaDB versions have occasionally allowed authentication bypasses or privilege escalations, though most are patched within reasonable timeframes by both upstream projects.
Beyond authentication and post-auth concerns, the data stored in any database is itself a high-value target. Many of the most consequential corporate data breaches of the past decade have begun with an attacker obtaining database credentials (often through SQL injection in a web application that uses the database) and exfiltrating customer records directly.
Common practice today is to firewall port 3306 from the public internet entirely, restrict access to specific application server IP addresses, require strong passwords on all database accounts and especially the root account, disable remote root login where possible (binding root to localhost-only access), and use TLS for connections that traverse any untrusted network. Where MySQL or MariaDB is deployed in cloud environments, the database should be placed in a private subnet rather than reachable through a public IP.
Inbound TCP/3306 from the public internet to any host is a strong indicator of either a serious misconfiguration or an active brute-force attack and warrants immediate investigation.
IDS Rule References
16 IDS / security rules reference TCP port 3306. Presence in IDS rules does not mean traffic on this port is malicious. These are patterns security tools monitor.
Rule categories (top 5): protocol-command-decode (6), bad-unknown (4), attempted-recon (2), attempted-user (2), attempted-admin (2).
Sample rule descriptions for TCP port 3306:
- SERVER-MYSQL root login attempt
- SERVER-MYSQL show databases attempt
- SERVER-MYSQL 4.0 root login attempt
- ET SCAN MYSQL 4.0 brute force root login attempt
- ET SCAN MYSQL 4.1 brute force root login attempt
Data Sources
This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), and Snort Community Rules (GPLv2).