Skip to main content
IMMUNITYSEC

Port 7680: Windows Delivery Optimization peer-to-peer

Port 7680 is used by Windows Delivery Optimization to share update and app content between peers on the network. Microsoft documents a binary peer protocol over TCP 7680 and states the service registers and opens the port automatically. IANA registers ms-do on TCP and UDP 7680.

7680
TCP

Port Details

Port
7680
Transport
TCP
Service
Delivery Optimization
IANA service name
ms-do
Range
User port (1024-49151)
Related ports
3544

Security Exposure

Microsoft states that Delivery Optimization cannot be used to download or send personal content and does not access personal files. Peer-to-peer is enabled by default in Windows client using LAN download mode, so Windows hosts commonly listen on 7680. Microsoft notes the service shuts down and stops listening when idle, so the port may appear and disappear.

Hardening

  • +Allow 7680 only between internal client subnets that should share content.
  • +Use DODownloadMode, DOGroupID and DORestrictPeerSelection to keep peering within the intended group.
  • +Block 7680 and UDP 3544 at the internet perimeter.
  • +Where peer sharing is not wanted, set DODownloadMode to 0, which Microsoft lists as the setting for not using peer-to-peer.

Monitoring

Watch for TCP 7680 connections between network segments that should not share content and for connections from the internet.

Tools for Auditing and Monitoring Delivery Optimization

Microsoft Defender for Endpoint

Commercial
SIEM Tools

Microsoft enterprise EDR covering Windows, macOS, Linux, and mobile from one console.

LicenseProprietary
PlatformWindows, macOS, Linux, iOS, Android, Web

Nmap

Free / Commercial
Penetration Testing Tools

Network discovery scanner and port auditor for discovering live hosts, open ports, running services, and OS fingerprints.

LicenseNPSL-0.95 (Nmap Public Source License, not OSI-approved)
PlatformLinux, macOS, Windows

Zeek

Open Source
Network Monitoring Tools

Network security monitoring framework that translates raw packet traffic into structured transaction logs and network events.

LicenseBSD-3-Clause
PlatformLinux, FreeBSD, macOS, OpenBSD

Related Tool Categories

Network Monitoring Tools→

Packet capture tools, protocol analyzers, and network security monitors for traffic visibility.

Network Security Tools→

Zero trust access, secure web gateways, firewalls, and perimeter enforcement platforms.

Frequently Asked Questions

What is port 7680 on Windows?→

It is the Delivery Optimization peer-to-peer port. Windows devices use it to download update content from other devices on the network.

What happens if port 7680 is blocked?→

Microsoft states that blocking 7680 disables peer-to-peer functionality, and devices still download content over HTTP or HTTPS.

Sources

Port assignments from the IANA Service Name and Transport Protocol Port Number Registry. Services can be configured to run on any port, so traffic on port 7680 is not guaranteed to be Delivery Optimization. Exploited-in-the-wild data from the CISA KEV catalog (CC0).