Port 1556 is officially registered with IANA for Veritas's PBX (Private Branch Exchange) service.1 If you work with enterprise backup systems, this port is already open on your network. If you don't, you've probably never heard of it.
What This Port Does
The Veritas PBX service (pbx_exchange) is a connection multiplexer. It listens on port 1556 and routes inbound connections to local NetBackup processes that have registered with it.2
This solves a specific problem: NetBackup has many different services that need to communicate between servers—backup jobs, catalog queries, media management, job scheduling. Without PBX, each service would need its own firewall port. With PBX, they all share port 1556.
It's a switchboard operator for backup traffic. One port accepts all incoming calls, then routes them to the right extension.
Why It Exists
Enterprise networks have firewalls. Firewalls have rules. Every open port is a security decision that needs approval, documentation, and monitoring.
Before PBX, NetBackup required multiple ports to be opened between backup servers. After PBX, administrators could configure one port—1556—and route all NetBackup traffic through it.3
The name "PBX" isn't metaphorical. It's literally named after telephone Private Branch Exchanges, which do the same thing: one trunk line from the phone company, internal switching to route calls to individual extensions.
How It Works
When a NetBackup process starts and needs to accept network connections, it registers with the local PBX service. PBX then listens on port 1556 on behalf of that process.
When a connection arrives on port 1556, PBX examines it, determines which registered process should handle it, and transfers the connection to that process using a randomly assigned local port.
From the remote system's perspective, it only connected to port 1556. The internal routing is invisible.4
The Hard-Coded Reality
Since NetBackup 7.0, port 1556 is hard-coded. You cannot change it.5
This is unusual for enterprise software, which typically allows port configuration for exactly the kind of conflicts that might arise. But Veritas registered port 1556 with IANA specifically for this purpose, and they made the decision: this is the PBX port. Period.
If another application is using port 1556 on your network, you have a problem. NetBackup will not start. The other application needs to move.
Firewall Requirements
For NetBackup to function across network boundaries, port 1556 must be open bidirectionally between:
- Primary backup servers and media servers
- Primary servers and clients (for certain backup types)
- Administrative consoles and backup servers6
NetBackup 8.0 added TLS/SSL support on port 1556, encrypting backup traffic that previously traveled in cleartext.7
Security Considerations
Port 1556 has been the target of security vulnerabilities. In 2017, researchers disclosed critical vulnerabilities in NetBackup's PBX implementation that could allow remote code execution.8
Any service that multiplexes connections is a high-value target—compromise the switchboard, and you control the routing.
If you run NetBackup, keep it patched. If you don't run NetBackup, block port 1556 at your perimeter firewall.
Checking What's Listening
To see if anything is listening on port 1556:
Linux/macOS:
Windows:
If you see pbx_exchange or bpcd (NetBackup Client Daemon), it's Veritas. If you see something else, investigate.
The Registered Port Space
Port 1556 belongs to the registered port range (1024-49151). These ports are assigned by IANA to specific services upon request. Once registered, the port is supposed to be reserved for that service globally.
In practice, enforcement is voluntary. Nothing prevents you from running a different service on port 1556. But doing so on a network that also runs NetBackup will cause conflicts—and since NetBackup won't change its port, you'll have to change yours.
Why Unassigned Ports Matter
Most ports in the registered range are unassigned. They're available for applications to use dynamically, for private services, for testing.
Port 1556 is different. It's spoken for. Veritas owns it. And if you're a backup administrator, you've probably spent time making sure it's open, reachable, and not blocked by an overzealous firewall rule.
That's what registered ports are for—predictability. Port 1556 means NetBackup PBX, everywhere, always. You don't have to guess. You don't have to configure. You just need to know.
Frequently Asked Questions About Port 1556
Var den här sidan till hjälp?