Port 4444 (Metasploit)
Port 4444 is registered with IANA for krb524 (a Kerberos 4-to-5 service), but in practice it is best known as the default listener port of Metasploit payloads, the penetration-testing framework.
- Service
- Metasploit
- Protocol
- TCP
- IANA registry
- Assigned to a different service: krb524 (KRB524), TCP/UDP; nv-video (NV Video default), TCP/UDP. The use described here is not registered.IANA note: krb524 assigned the port, nv used it without an assignment.
- Commonly used by
Check if a port is open on your IP
We only check the address you are visiting from, one TCP port at a time. You cannot enter someone else’s address: this is not a port scanner.
Is it safe to open port 4444?
Few legitimate home or office services use 4444. If you see unexpected traffic or a listening process on it, find the process (commands below) and check whether you installed it; security tools often flag 4444 for that reason.
“Port 4444 is already in use”: how to fix it
The error means another program is already listening on port 4444. Find its process ID (PID), then stop that program or start yours on a different port.
Windows (Command Prompt or PowerShell as administrator)
netstat -ano | findstr :4444taskkill /PID <PID> /FmacOS
lsof -nP -iTCP:4444 -sTCP:LISTENkill <PID>Linux
sudo ss -ltnp | grep :4444sudo lsof -i :4444sudo kill <PID>Replace <PID> with the number from the last column (Windows) or the PID column (macOS, Linux).
Why a port can look closed when your server is running
Most home networks sit behind a router doing NAT: the router owns the public address, and your computer has a private one such as 192.168.1.10. A connection from the internet reaches the router and stops there unless you add a port forwarding rule to your computer.
Many mobile and some home providers go further and use carrier-grade NAT (CGNAT): several customers share one public address, and your router itself gets an address from 100.64.0.0/10. Then no rule on your side can open a port; ask the provider for a public IP or use a tunnel or VPN service.
Even with forwarding in place, the firewall on the computer (Windows Defender Firewall, ufw, firewalld) must allow the port, and the program must listen on all interfaces (0.0.0.0), not only on 127.0.0.1.
UDP cannot be checked this way: a UDP service usually stays silent to packets it does not understand, so “no answer” means nothing. This check uses TCP only.
Frequently asked questions
What is port 4444 used for?
Port 4444 is registered with IANA for krb524 (a Kerberos 4-to-5 service), but in practice it is best known as the default listener port of Metasploit payloads, the penetration-testing framework.
Is port 4444 TCP or UDP?
Port 4444 uses TCP. This use is not registered with IANA.
Is it safe to open port 4444?
Few legitimate home or office services use 4444. If you see unexpected traffic or a listening process on it, find the process (commands below) and check whether you installed it; security tools often flag 4444 for that reason.
How do I free port 4444 if it is already in use?
Find the process: on Windows run netstat -ano | findstr :4444 and stop it with taskkill /PID <pid> /F; on macOS or Linux run lsof -i :4444 and stop it with kill <pid>.