Port 7 echo · TCP and UDP

What runs on port 7

The echo service sends back whatever it receives. It was a debugging aid for early TCP/IP stacks and is a classic amplification and loop vector (echo pointed at chargen), which is why every modern system ships with it disabled.

Software that uses it: inetd/xinetd "simple services" · Windows Simple TCP/IP Services

Should port 7 be open?

Disable it. This is a legacy or insecure protocol. The recommendation is not to firewall it but to turn the service off and use the modern replacement.

• Use ping or a TCP connect test instead; nothing legitimate needs echo.

Check port 7

# on the host: is anything listening, and which process?
ss -ltnp 'sport = :7'
ss -lunp 'sport = :7'
sudo lsof -i :7

# from another machine: is it reachable?
nc -zv host 7
nmap -p 7 host
nc -zuv host 7
sudo nmap -sU -p 7 host
curl -v telnet://host:7      # raw TCP connect test, Ctrl-C to leave

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 7

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 7 proto tcp
sudo ufw allow from 10.0.0.0/8 to any port 7 proto udp
sudo ufw deny 7/tcp
sudo ufw deny 7/udp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 meta l4proto { tcp, udp } th dport 7 accept
nft add rule inet filter input meta l4proto { tcp, udp } th dport 7 drop

# iptables (legacy)
iptables -A INPUT -p tcp --dport 7 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 7 -j DROP
iptables -A INPUT -p udp --dport 7 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 7 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=7 protocol=tcp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 7" with no source is just "open".

Related ports

• 9 discard / Wake-on-LAN — WoL magic packets are often sent to UDP 9
• 13 daytime
• 37 time

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions