Skip to main content
IMMUNITYSEC

Port 1723: Point-to-Point Tunneling Protocol

TCP 1723 carries the PPTP control connection, while the tunneled PPP data travels in an enhanced GRE encapsulation (IP protocol 47) as described in RFC 2637. PPTP is a legacy remote access VPN protocol. Windows Routing and Remote Access lists PPTP on TCP 1723 together with GRE.

1723
TCP

Port Details

Port
1723
Transport
TCP
Service
PPTP
IANA service name
pptp
Range
User port (1024-49151)

Security Exposure

RFC 2637 states that PPTP control channel messages are neither authenticated nor integrity protected and that the GRE tunnel packets are not cryptographically protected. An attacker on the path may therefore hijack the control connection or tamper with PPP negotiations. Microsoft has deprecated PPTP in Windows Server and advises moving to SSTP or IKEv2.

Hardening

  • +Retire PPTP VPN access and migrate users to IKEv2 or SSTP.
  • +Close TCP 1723 and GRE (IP protocol 47) at the perimeter once PPTP is no longer in use.
  • +Keep PPTP disabled on new Windows Server 2025 RRAS installations, which no longer accept PPTP connections by default.
  • +Where PPTP must remain for a short transition, restrict TCP 1723 to known client address ranges.

Monitoring

Alert on inbound TCP 1723 connections and GRE traffic to hosts that are not approved VPN servers. On remaining PPTP servers, log and review authentication failures.

Tools for Auditing and Monitoring PPTP

Nmap

Free / Commercial
Penetration Testing Tools

Network discovery scanner and port auditor for discovering live hosts, open ports, running services, and OS fingerprints.

LicenseNPSL-0.95 (Nmap Public Source License, not OSI-approved)
PlatformLinux, macOS, Windows

Wireshark

Open Source
Network Monitoring Tools

Network packet analyzer and protocol inspection tool for capturing live traffic and debugging network communications in detail.

LicenseGPL-2.0-or-later
PlatformWindows, macOS, Linux, BSD

Zeek

Open Source
Network Monitoring Tools

Network security monitoring framework that translates raw packet traffic into structured transaction logs and network events.

LicenseBSD-3-Clause
PlatformLinux, FreeBSD, macOS, OpenBSD

Related Tool Categories

Network Monitoring Tools→

Packet capture tools, protocol analyzers, and network security monitors for traffic visibility.

Network Security Tools→

Zero trust access, secure web gateways, firewalls, and perimeter enforcement platforms.

Frequently Asked Questions

Is PPTP secure?→

RFC 2637 notes that the PPTP control channel lacks authentication and integrity protection and that GRE tunnel packets are not cryptographically protected. Microsoft has deprecated PPTP and recommends SSTP or IKEv2.

Which ports does PPTP need?→

PPTP uses TCP 1723 for its control connection and GRE (IP protocol 47) for tunneled data. GRE is an IP protocol, not a TCP or UDP port.

Should port 1723 be open?→

Only on a server that still terminates PPTP. Microsoft advises migrating away from PPTP, after which TCP 1723 and GRE can be closed.

Sources

Port assignments from the IANA Service Name and Transport Protocol Port Number Registry. Services can be configured to run on any port, so traffic on port 1723 is not guaranteed to be PPTP. Exploited-in-the-wild data from the CISA KEV catalog (CC0).