TCP Port 514 – syslog / rsh (Network Logging / Legacy Remote Shell)
Port 514 is one of the few ports that registers two genuinely different protocols, one per transport. UDP/514 is the standard port for syslog, the protocol for forwarding system log messages from one host to another. TCP/514 is the legacy port for the Berkeley Remote Shell (rsh), a 1980s-era remote command execution protocol that has been almost entirely replaced by SSH.
The syslog side is the more relevant assignment in modern environments. Syslog originated in BSD Unix in the 1980s as part of the sendmail mail-transfer agent and was generalized into a system-wide logging mechanism. The network protocol was first documented in RFC 3164 (informational, 2001) and standardized in RFC 5424 (standards-track, 2009) with companion RFC 5426 covering UDP transport. A syslog collector, typically a dedicated server or an appliance running software like rsyslog, syslog-ng, or a SIEM ingest pipeline, listens on UDP/514 and receives forwarded log messages from network devices, servers, and applications. Outbound UDP/514 is therefore common from any host configured to forward logs.
The rsh side belongs to a family of Berkeley remote-access protocols (rsh, rlogin, rcp, rexec) that were standard on BSD Unix systems from the early 1980s into the 1990s. Authentication relied on IP-based trust through a host’s .rhosts or /etc/hosts.equiv file, and credentials and session contents were sent in plaintext. rsh was rendered obsolete by SSH on port 22 in the late 1990s and has been removed from default installations of every major Unix distribution for decades. Encountering live rsh traffic in 2026 is unusual and almost always indicates a legacy system, a honeypot, or a misconfiguration.
Inbound UDP/514 to a designated log collector is normal. Inbound UDP/514 to a host that is not a log collector is unusual. Inbound or outbound TCP/514 in any modern environment is unusual.
About TCP Port 514
The Internet Assigned Numbers Authority (IANA) registers port 514 for shell. The IANA description reads: ‘cmd like exec, but automatic authentication is performed as for login server’.
Security Considerations
Our data shows 5 IDS rules referencing port 514, all on TCP, and all targeting the legacy rsh service rather than syslog. The rules detect classic 1990s-era attacks against rsh: connections attempting to log in as the bin system account, attempts to log in as root, the historical “echo + +” pattern that exploited overly permissive .rhosts configurations granting passwordless access from any host and any user, and an exploit-classified rsh login attempt as bin.
These rules reflect rsh’s fundamental security model, or rather its lack of one. Authentication relied on the source IP address being listed in a trust file on the destination host. Credentials, when transmitted, were sent in cleartext, as was the session content. An attacker who could spoof IP addresses, observe network traffic, or exploit a permissive .rhosts file could compromise a system trivially. rsh was the textbook example of why network protocols cannot rely on source-address authentication, and it was a primary motivator for the development of SSH in the mid-1990s.
In modern networks, the appearance of TCP/514 rsh traffic is itself a finding. The rules in our dataset persist for legacy-system detection, honeypot use, and forensic review of older incidents. Production environments should not run rsh on any host.
The syslog side of port 514 has a distinct security profile that does not appear in the IDS rule data here but is worth noting. UDP/514 syslog has no built-in authentication or encryption; messages sent across untrusted networks can be observed, modified, or forged. For security-critical logging, RFC 5425 specifies TLS-protected syslog on TCP/6514, which provides authenticity and confidentiality, and modern SIEM ingest pipelines typically prefer this transport. Logs intended as forensic evidence should use authenticated transport rather than plain UDP/514.
Defensive practice is straightforward. rsh should not exist in production environments; SSH on port 22 covers every legitimate use case. Syslog forwarding should be restricted to dedicated management networks. Where logs cross untrusted segments or are subject to integrity requirements, TLS-protected syslog on TCP/6514 should be used in place of UDP/514.
Inbound TCP/514 from a public internet source is unusual and warrants investigation. Inbound UDP/514 to a non-log-collector host is unusual. Outbound UDP/514 from a log-forwarding host to its designated collector is normal.
IDS Rule References
5 IDS / security rules reference TCP port 514. Treat that number as context, not a danger score. Many detection rules are written against groups of ports rather than one service, web ports especially, so common web alternate ports inherit large counts while genuinely sensitive services can show few rules or none. Presence in IDS rules does not mean traffic on this port is malicious.
Rule categories (top 2): attempted-user (3), attempted-admin (2).
Sample rule descriptions for TCP port 514:
- PROTOCOL-SERVICES rsh bin
- PROTOCOL-SERVICES rsh echo + +
- PROTOCOL-SERVICES rsh froot
- PROTOCOL-SERVICES rsh root
- GPL EXPLOIT rsh bin
Data Sources
This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), and Snort Community Rules (GPLv2).