Port 7 ECHO
Port 7 is the IANA-assigned echo port for Echo (TCP / UDP).
What is port 7 used for?
Port 7 is assigned to echo and uses TCP / UDP. The IANA registry describes the service as “Echo”. It sits in the well-known range, which operating systems reserve for core network services, so software expects it at this number by default.
Ports are the transport-layer address a service listens on. A client that wants to reach echo connects to port 7. A TCP connection is refused when nothing is listening, while a UDP request simply goes unanswered. That is why a port conflict appears whenever two processes try to bind the same number.
Use the commands below to confirm whether port 7 is actually in use before you change firewall rules. Blocking the port stops new inbound traffic at the firewall, but it does not stop a local process from listening, and it does not remove the service from the machine.
Source: IANA Service Name and Transport Protocol Port Number Registry. Registered assignee: [Jon_Postel].
Check and block port 7
Copy-ready commands for the protocols assigned to this port. Run the check first, then block only what should not be reachable.
Check on Linux
sudo ss -tlpn 'sport = :7'
sudo ss -ulpn 'sport = :7'Check on Windows
Get-NetTCPConnection -LocalPort 7 -State Listen -ErrorAction SilentlyContinue
Get-NetUDPEndpoint -LocalPort 7 -ErrorAction SilentlyContinueBlock with UFW
sudo ufw deny 7/tcp
sudo ufw deny 7/udpBlock with iptables
sudo iptables -A INPUT -p tcp --dport 7 -j DROP
sudo iptables -A INPUT -p udp --dport 7 -j DROPThese commands are examples for a typical host. Check the listener before you change firewall rules, and persist iptables rules with iptables-save or netfilter-persistent. On Windows, use Windows Defender Firewall or New-NetFirewallRule for persistent blocks. The iptables rules here cover IPv4; mirror them with ip6tables if IPv6 is enabled.
Is port 7 safe to expose?
This port is not on our curated list of services with a widely exploited profile. Exposure is only safe when the listening service is intended, patched and protected by a firewall. Keep the listening service patched and remove it if unused. A default-deny firewall policy with explicit allow rules is still the safest baseline.
Where port 7 is usually used
Most traffic on port 7 falls into these scenarios. The demo below is a safe way to confirm the listener before you change anything.
- Core infrastructure that clients expect to find at its default number.
- Firewall reviews that baseline which classic services are reachable.
- Troubleshooting connectivity when an application assumes the standard port.
Probe the port
Confirm something is listening before you debug the client. Replace 127.0.0.1 with the host you are testing.
nc -vz 127.0.0.1 7Common problems with port 7
Connection refused or timed out
Refused usually means the host is reachable but nothing is listening on port 7. A timeout more often means a firewall drop, a wrong host or a service bound to a different interface.
Port already in use
Find the process holding the port with sudo ss -tlpn 'sport = :7' or sudo lsof -i :7. Stop that process or configure it to bind another port; killing it without identifying it can take down a production service.
Firewall rule did not survive a reboot
UFW and Windows Firewall keep rules across restarts. Raw iptables rules do not: save them with iptables-save or the netfilter-persistent package, and re-apply after upgrades that reset the ruleset.
The port is blocked but still reachable
A firewall rule filters inbound traffic; it does not close the listener. Confirm with the check command above and bind the service to 127.0.0.1 when only local clients need it.
Port 7 at a glance
| Port number | 7 |
|---|---|
| Service name | echo |
| Transport protocol | TCP / UDP |
| Category | Core network services |
| Range | Well-known port (0–1023) |
| Risk level | Standard/Low |
| Registered assignee | [Jon_Postel] |
| Registry description | Echo |
| Source | IANA Service Name and Transport Protocol Port Number Registry |
Frequently asked questions
What is port 7 used for?
Port 7 (ECHO) uses TCP / UDP. Echo.
How do I check if port 7 is open?
On Linux run `sudo ss -tlpn 'sport = :7'` and `sudo ss -ulpn 'sport = :7'`. On Windows run `Get-NetTCPConnection -LocalPort 7 -State Listen -ErrorAction SilentlyContinue` and `Get-NetUDPEndpoint -LocalPort 7 -ErrorAction SilentlyContinue` in PowerShell. If the port is open, the output shows a process listening on port 7; empty output usually means nothing is bound to it.
How do I block port 7?
With UFW run `sudo ufw deny 7/tcp` and `sudo ufw deny 7/udp`. With iptables run `sudo iptables -A INPUT -p tcp --dport 7 -j DROP` and `sudo iptables -A INPUT -p udp --dport 7 -j DROP`. Persist the iptables rules with your distribution's netfilter-persistent or iptables-save tooling so they survive a reboot.
Is port 7 safe to expose?
This port is not on our curated list of services with a widely exploited profile. Exposure is only safe when the listening service is intended, patched and protected by a firewall. Nevertheless, keep the listening service patched and remove it if unused. A default-deny firewall policy with explicit allow rules is still the safest baseline.
Related ports
Primary data: IANA Service Name and Transport Protocol Port Number Registry.
Last reviewed 2026-10-30 · Methodology · About · Privacy