Android 11 wireless ADB has two ports, not one

I was setting up a phone as a portable pentesting lab and tripped on the very first step: adb connect 192.168.1.189:44609 failed. The port was reachable — nc -zv succeeded — but adb just refused.

Restarting the adb server didn’t help. Neither did anything else I tried for a minute. The port is open, the daemon is running, the handshake fails. What gives?

The mental model I had was wrong. On Android 11+, “Wireless debugging” doesn’t expose one port. It exposes two, and they do different things.

The two ports

Open Developer options → Wireless debugging on the device. The big number you see on the main screen — 192.168.1.189:44609 in my case — is the connection port. That’s what adb connect talks to. But the daemon behind it will only accept clients that have already been paired with this device.

To pair, you tap Pair device with pairing code, which opens a different screen showing a different IP:port and a 6-digit code. That’s the pairing port. It exists for the duration of that screen being open and then dies.

So the dance is:

adb pair 192.168.1.189:38035 959284   # pairing port + code, one-shot
adb connect 192.168.1.189:44609       # connection port, persistent-ish

The first time around I didn’t realize these were two different services on two different ports. The pairing screen shows a port; the main screen shows a port; I assumed they were the same thing displayed twice.

And the ports randomize

Both ports change every time. After a reboot — or sometimes just after toggling Wireless debugging off and on — the device picks new ones. The pairing trust survives, but the connection port doesn’t, so you re-adb connect to whatever the main screen says now. If the pairing was also cleared (happens after some reboots), you re-pair too, on yet another fresh pairing port.

This is why every guide that says “just run adb connect 192.168.1.189:5555” feels like it’s from a different planet. It is. Pre-Android 11, port 5555 was the convention and it was static. Android 11 randomized everything in the name of security and the muscle memory stopped working.

The escape hatch

If you don’t want to do the pairing dance every reboot, plug in USB once and run:

adb -d tcpip 5555
adb connect 192.168.1.189:5555

That puts the daemon back on the old static port. It survives until you reboot or toggle USB debugging. After every reboot, re-plug, two commands, done. No pairing, no random ports.

Worth it if you’re doing this daily. For a one-off, the pairing flow is fine — you just have to know there are two ports.

The takeaway

The bug wasn’t in adb or the network. It was in my model of the UI. “Wireless debugging” looks like one feature but it’s really two services — a short-lived pairing service and a longer-lived connection service — each on its own randomized port, each shown on its own screen. Once that clicked, the rest was muscle memory.

A small thing, but it ate ten minutes I’d rather have spent on the actual lab. Writing it down so future-me reads the right screen first.