I had look at the firewall logs and i can see my production server connects to microsoft ( on UDP port 3544. A quick reading suggests this is to do with Teredo tunneling (IPV6 translation tech). Unless I am mistaken this done by Windows server; if so does this OS Service can post data to this port creating a risk of exposing sensitive data on the server?

Should I be dropping these UDP packets at firewall as risk avoidance measure?

Does anyone know whether an outbound call to on port 3544 is a well known action by windows servers (2012 R2 ver for instance)?

  • As you've already assessed the possible traffic going over the network on this one port you could sample the packets such as with Wireshark. You'll have to weigh the risk with potentially causing a outage on a production server. Ideally replicate the traffic on a test server with fake data and block it there. Just be ready to rollback your firewall change and notify your colleagues who might need to do the rollback.
    – lloyd
    Dec 21, 2016 at 5:05
  • So you are stating there is definite risk in allowing this call. I am more inclined to know whether the teredo call is a legitimate call and should be ignored from the statistical anomaly detection
    – Lin
    Dec 21, 2016 at 20:25
  • 1
    Not enough information to determine the risk level. There is a definite risk in blocking a port based on a anomaly.
    – lloyd
    Dec 22, 2016 at 3:07
  • added one more query summarise the real question in mind
    – Lin
    Dec 23, 2016 at 0:18

1 Answer 1


Recommendation at: https://www.stigviewer.com/stig/windows_7/2013-10-01/finding/V-17449 Is to block outbound IPv6 UDP 3544 for Windows Servers Reason: IPv6 transition technologies, which tunnel packets through other protocols, do not provide visibility. Blocking UDP 3544 with the firewall aids in preventing this.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .