Internet-Security.com TCP port 104 details

Port 104/TCP is the well-known port for DICOM (formerly ACR-NEMA), the standard protocol used in medical imaging networks.
Hospitals and clinics use it for DICOM services such as C-STORE, C-FIND, and C-MOVE between imaging modalities and PACS/VNA systems.
Real-world software that listens on or connects via 104 includes Orthanc PACS, dcm4chee, Agfa Enterprise Imaging, GE Healthcare Centricity/Universal Viewer, Philips IntelliSpace PACS, Sectra PACS, and FUJIFILM Synapse.
Open-source toolkits and utilities such as DCMTK (storescp/movescu/findscu), dcm4che tools, and viewers like OsiriX/Horos and RadiAnt use this port when communicating with DICOM servers.
Imaging devices (e.g., Siemens MRI, GE CT, Philips ultrasound) commonly send studies to PACS over DICOM on port 104 by default, though many sites reconfigure to 11112.
Some deployments secure DICOM with TLS on alternative ports, but 104 remains widely used in legacy and current systems.
Security note: Internet-exposed DICOM services on 104/TCP have been abused to harvest PHI; scans have found misconfigured PACS/VNAs leaking images and metadata, so attackers often probe this port.
Administrators typically restrict 104 to internal networks and enforce authentication and encryption on DICOM nodes.

TCP 104