PORT 3389 / TCP/UDPSecurity & RemoteExposure Risk: Critical

Port 3389: RDP — Microsoft Remote Desktop Protocol

Provides graphical remote desktop access to Windows servers. Frequently targeted by brute-force bots; place behind a VPN or Bastion host.

Default Service

RDP

Process: svchost.exe (TermService)

Transport Protocol

TCP/UDP

IANA Registered Port 3389

Docker Port Flag

-p 3389:3389

Container to Host Mapping

How to Check & Kill Process on Port 3389 (EADDRINUSE Fix)

macOS & Linux (lsof / kill)

# Find process using port 3389
sudo lsof -i :3389

# Instantly kill process on port 3389
lsof -ti:3389 | xargs kill -9

Windows (PowerShell & CMD)

# Find PID listening on port 3389
netstat -ano | findstr :3389

# Force kill by PID
taskkill /PID <PID_NUMBER> /F

Cross-Platform Node.js One-Liner

# Kill port 3389 via npx
npx kill-port 3389

# Or diagnose via Castov CLI
npx castov fix "EADDRINUSE :::3389"

Linux Firewall (UFW) & Connectivity Test

# Test if port 3389 is reachable
nc -zv localhost 3389

# Allow or deny port 3389 in UFW
sudo ufw allow 3389/tcp

Frequently Asked Questions about Port 3389

What is Port 3389 used for?

Port 3389 is the standard network port for RDP (Microsoft Remote Desktop Protocol) operating over TCP/UDP. The typical system daemon or process is svchost.exe (TermService).

How do I kill a process running on Port 3389 (EADDRINUSE)?

On macOS and Linux, run: lsof -ti:3389 | xargs kill -9 (or npx kill-port 3389). On Windows PowerShell/CMD, run: netstat -ano | findstr :3389 and then taskkill /PID <PID> /F.

Is it safe to expose Port 3389 to the internet?

Port 3389 has a Critical security risk profile. Provides graphical remote desktop access to Windows servers. Frequently targeted by brute-force bots; place behind a VPN or Bastion host.