logo

Port 7 – ECHO (Echo Protocol)

Service:

ECHO

Protocol:

TCP/UDP

Port:

7

Used for:

Network testing and diagnostics

Port 7 is the default port for the Echo Protocol (RFC 862), a diagnostic service that sends back (“echoes”) any data it receives, over both TCP and UDP. It was designed to test network connectivity and measure round-trip latency between hosts. On a modern network there is almost no legitimate reason to run it, so an open port 7 is usually a misconfiguration and a common building block for UDP reflection/amplification DDoS attacks.

Why It’s Open

Echo is one of the original “small services” (echo 7, discard 9, daytime 13, chargen 19) that historically shipped enabled in inetd/xinetd on UNIX systems and in the simple-TCP/IP-services feature on older Windows. Today it mostly turns up on legacy servers, network appliances, printers, and embedded/IoT devices where the small-services bundle was never disabled. It’s a close relative of Daytime on port 13 and Chargen on port 19 — if you find one enabled, check for the others.

Common Risks

  • UDP reflection & amplification. Because UDP echo replies to a spoofed source address, attackers use it to bounce and amplify traffic at a victim. This is the technique behind the Fraggle DDoS attack.
  • Echo↔Chargen loopback DoS. Pointing UDP echo (7) at chargen (19) creates a self-sustaining packet storm that consumes CPU and bandwidth (CVE-1999-0103).
  • Network reconnaissance. A live echo service confirms the host is reachable and reveals latency, MTU behavior, and firewall gaps.
  • Bandwidth & resource exhaustion. A flood of echo requests can saturate a low-powered device or its uplink.
  • Attack surface with no upside. The service performs no authentication and offers no modern value, so every open instance is pure risk.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

logo-cta

Enumeration & Testing

Detect the service (TCP and UDP)

Terminal window
nmap -sV -p 7 <target>
nmap -sU -sV -p 7 <target>

TCP echo test with netcat

Terminal window
echo "PENTEST" | nc <target> 7

A working service echoes PENTEST straight back.

UDP echo test

Terminal window
echo "PENTEST" | nc -u -w1 <target> 7

Check the amplification / loopback pair

Terminal window
# Is chargen (19) also open? echo+chargen = loopback DoS
nmap -sU -sV -p 7,19 <target>


# Measure UDP echo responsiveness (useful for reflection risk assessment)
hping3 -2 -p 7 -d 100 -c 5 <target>

Record every exposed instance you confirm so it lands in the final pentest report.

What to Look For

Checkpoint What it means
TCP port 7 echoes data back Echo service is active — confirm it is actually needed
UDP port 7 responds UDP echo enabled — usable for reflection/amplification (Fraggle)
Ports 7 and 19 both open Echo + Chargen UDP packet storm / loopback DoS (CVE-1999-0103)
Large replies to small UDP requests Service is usable in a reflected DDoS
Echo reachable from outside the LAN Firewall gap — small services should never be Internet-facing

Known CVEs and Exploits

  • CVE-1999-0103 — Echo and chargen (or other UDP service combinations) can be pointed at each other to flood a host, the classic “UDP bomb” / packet storm. Closely related to the Fraggle amplification technique.
  • CVE-1999-0635 — The echo service is running. Flagged by scanners as an unnecessary exposed service that should be disabled.
  • Fraggle DDoS technique — UDP echo/chargen used with spoofed broadcast source addresses to reflect and amplify traffic at a target; still referenced in amplification-DDoS research today.

Mitigation

  • Disable the echo service. In xinetd, set disable = yes for echo (TCP and UDP) and restart; on Windows, remove the “Simple TCP/IP Services” feature.
  • Disable the whole small-services bundle. While you’re there, turn off discard (9), daytime (13), and chargen (19) too.
  • Firewall UDP/TCP 7 at the perimeter — these services should never be reachable from the Internet.
  • Block spoofed traffic with BCP 38 / uRPF ingress filtering so your hosts can’t be used as reflectors.
  • Rescan after remediation to confirm both the TCP and UDP listeners are gone.

Real-World Example

The Fraggle attack, released in 1998 as a UDP-based cousin of the Smurf attack, weaponized exactly this service: the attacker sends UDP packets to the echo (7) and chargen (19) ports of a broadcast address, spoofing the victim’s IP as the source. Every host that answers floods the victim, amplifying a small amount of attacker bandwidth into a large DDoS. Decades later, disabling UDP echo remains standard hardening guidance precisely because of this reflection potential.

FAQ

Is port 7 dangerous?

The Echo Protocol has no known remote code-execution bugs, but an open UDP port 7 is a real risk because it can be abused for reflection/amplification DDoS and echo↔chargen loopback denial of service. Since the service has no modern purpose, the safe move is to close it.

What service runs on port 7?

The Echo Protocol (RFC 862), a diagnostic service that returns any data sent to it over TCP or UDP. It’s one of the legacy “small services” alongside discard (9), daytime (13), and chargen (19).

How do I close port 7?

Disable the echo service in your inetd/xinetd configuration (disable = yes) or remove Windows Simple TCP/IP Services, then firewall TCP/UDP 7 at the perimeter and rescan to confirm both listeners are gone.

TL;DR

  • Service: Echo Protocol (RFC 862), a data-echoing diagnostic service
  • Default port: 7/TCP and 7/UDP
  • Biggest risk: UDP reflection/amplification DDoS and echo↔chargen loopback DoS (CVE-1999-0103)
  • Mitigation: disable the service, turn off the small-services bundle, and firewall port 7