Skip to main content
IMMUNITYSEC

Port 1521: Oracle Net Listener (Transparent Network Substrate)

TCP 1521 is the default address of the Oracle Net Listener, the process that receives client connection requests for Oracle Database and forwards them to database services. IANA has 1521 registered to ncube-lm (nCube License Manager) and flags known unauthorized use of the port. By default, the database registers its service information with the local listener on TCP 1521.

1521
TCP

Port Details

Port
1521
Transport
TCP
Service
Oracle TNS Listener
IANA service name
ncube-lm
Range
User port (1024-49151)

Security Exposure

A reachable listener lets any host that can route to it attempt database connections and probe the services it has registered. Oracle's listener compliance standard states that without valid node checking anyone can connect to the server, including a malicious user. It also notes that attacks on the listener can go unnoticed when listener logging is off.

Hardening

  • +Block TCP 1521 at the network perimeter and permit only application servers and database administration hosts.
  • +Enable valid node checking in sqlnet.ora (tcp.validnode_checking = YES with a tcp.invited_nodes allowlist) so the listener refuses connections from other addresses.
  • +Keep listener logging enabled so that connection attempts and refusals are recorded.
  • +Apply Oracle security patches as soon as they are available, as Oracle's database security guidelines advise.

Monitoring

Review the listener log for connection attempts from hosts outside the invited node list and for spikes in refused connections. Alert on new listeners bound to 1521 on hosts that are not database servers.

Tools for Auditing and Monitoring Oracle TNS Listener

Nmap

Free / Commercial
Penetration Testing Tools

Network discovery scanner and port auditor for discovering live hosts, open ports, running services, and OS fingerprints.

LicenseNPSL-0.95 (Nmap Public Source License, not OSI-approved)
PlatformLinux, macOS, Windows

OPENVAS

Free / Commercial
Vulnerability Scanning

Full-featured vulnerability scanner for identifying security flaws, missing patches, and weak configs across network hosts.

LicenseGPL-2.0-only (C scanner); GPL-2.0-or-later WITH OpenSSL-exception (Rust)
PlatformLinux

Nessus

Commercial
Vulnerability Scanning

Tenable vulnerability scanner with the industry’s largest plugin library; time-limited free Essentials license.

LicenseProprietary
PlatformLinux, Windows, Web

Related Tool Categories

Network Security Tools→

Zero trust access, secure web gateways, firewalls, and perimeter enforcement platforms.

Vulnerability Scanning→

Infrastructure scanners, CVE audit engines, container image inspectors, and exposure management platforms.

Frequently Asked Questions

What runs on port 1521?→

Port 1521 is the default TCP port of the Oracle Net Listener, which accepts client connections for Oracle Database. The IANA registry lists it as ncube-lm, an unrelated assignment.

Is port 1521 TCP or UDP?→

Oracle's default listener address uses PROTOCOL=tcp on port 1521. IANA lists both TCP and UDP 1521 under the unrelated ncube-lm registration.

How can access to the Oracle listener be restricted?→

Oracle documents valid node checking: set tcp.validnode_checking = YES and list permitted clients in tcp.invited_nodes in sqlnet.ora. Network firewalls in front of the database add a second layer.

Sources

Port assignments from the IANA Service Name and Transport Protocol Port Number Registry. Services can be configured to run on any port, so traffic on port 1521 is not guaranteed to be Oracle TNS Listener. Exploited-in-the-wild data from the CISA KEV catalog (CC0).