NetSecWallFree trialDownload
Port 9001 · TCP

Port 9001: Tor relay

The default port for Tor relays.

Protocol
TCP
On Windows
Not part of Windows; installed software uses it
Risk if open to the internet
Low

Seeing it on your PC

Tor Browser connecting to Tor relays on 9001 (or on 443). Tor Browser also runs a local proxy on 127.0.0.1:9150.

Should you block it?

Expected if you use Tor Browser. A Tor connection from a program that is not Tor Browser is unusual: some malware uses Tor to hide where it reports to.

Check it on your PC

Run this in PowerShell to see what is using port 9001 right now, and which program owns it:

Get-NetTCPConnection -LocalPort 9001 -ErrorAction SilentlyContinue | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,@{n='Process';e={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}}

No output means nothing is using the port at the moment. For every connection at once, paste netstat -ano into the netstat explainer.