Skip to main content

Free Port Number Lookup – Search TCP/UDP Ports by Number or Name

Look up common TCP/UDP port numbers, their associated protocols, and security notes. Search by port number or service name across a curated reference of approximately 100 commonly queried ports.

Written & reviewed by Helperzy Editorial Team · Updated July 2026

~100 Common PortsTCP & UDPSecurity NotesFree

Filter by Category

104 Results

PortProtoServiceDescription
20TCPFTP (Data)File Transfer Protocol data channel, used to move the actual file bytes once a control session is open.
Sends file data unencrypted. Prefer SFTP (port 22) or FTPS.
21TCPFTP (Control)File Transfer Protocol command channel, used for login and directory navigation.
Sends the username and password in plaintext — avoid exposing to the open internet.
22TCPSSHSecure Shell — encrypted remote command-line login, also used to tunnel SFTP and Git-over-SSH.
23TCPTelnetLegacy remote terminal protocol from before encryption was standard.
Completely unencrypted, including the password. Should never be reachable from the internet today.
25TCPSMTPSimple Mail Transfer Protocol, used by mail servers to relay outgoing email to each other.
37BothTime ProtocolOne of the earliest network time-sync protocols, mostly superseded by NTP.
43TCPWHOISLooks up the registered owner of a domain name or IP address block.
53BothDNSDomain Name System — resolves domain names to IP addresses. UDP for normal queries, TCP for large responses and zone transfers.
67UDPDHCP (Server)Dynamic Host Configuration Protocol, the server side that hands out IP addresses to devices joining a network.
68UDPDHCP (Client)The client side of DHCP that a device uses to request an IP address.
69UDPTFTPTrivial File Transfer Protocol, a minimal file-transfer protocol often used to boot network devices and routers.
Has no authentication at all — restrict it to trusted internal networks only.
70TCPGopherA pre-web hierarchical document retrieval protocol, largely historical today.
79TCPFingerOld protocol for looking up information about a user on a remote system.
80TCPHTTPHypertext Transfer Protocol — standard unencrypted web traffic.
88BothKerberosNetwork authentication protocol used heavily inside Windows Active Directory domains.
110TCPPOP3Post Office Protocol v3, downloads email from a mailbox to a local client, usually removing it from the server.
111BothRPCbindMaps Remote Procedure Call program numbers to network ports, used by NFS and related services.
113TCPIdentIdentifies the user of a TCP connection; still queried by some IRC networks.
119TCPNNTPNetwork News Transfer Protocol, used by Usenet newsgroup readers and servers.
123UDPNTPNetwork Time Protocol — keeps a device's clock synchronised to a reference time source.
135TCPMS RPC Endpoint MapperWindows service that maps RPC program numbers to the dynamic port a service is actually listening on.
A frequent target for worms (e.g. Blaster). Should never be exposed to the internet.
137UDPNetBIOS Name ServiceResolves NetBIOS computer names to IP addresses on older Windows networks.
138UDPNetBIOS DatagramConnectionless NetBIOS datagram delivery, part of the legacy Windows networking stack.
139TCPNetBIOS Session (SMB)File and printer sharing over NetBIOS, the predecessor transport to direct SMB on port 445.
Legacy SMB transport with a long history of worm exploitation — block from the internet.
143TCPIMAPInternet Message Access Protocol, keeps email synced on the server so multiple devices see the same mailbox state.
161UDPSNMPSimple Network Management Protocol, used to monitor and configure routers, switches and servers remotely.
Default 'public'/'private' community strings are a common recon and takeover vector — change them.
162UDPSNMP TrapThe channel a managed device uses to push an unsolicited alert to a monitoring station.
179TCPBGPBorder Gateway Protocol, the routing protocol that exchanges reachability information between the internet's autonomous systems.
194TCPIRCInternet Relay Chat, a long-running real-time text chat protocol.
389BothLDAPLightweight Directory Access Protocol, queries directory services such as Active Directory for users and groups.
443TCPHTTPSHTTP encrypted with TLS — the standard for secure web traffic today.
445TCPSMBServer Message Block, modern Windows file and printer sharing.
One of the most abused ports on the internet — the entry point for WannaCry and many ransomware worms. Never expose to the internet.
465TCPSMTPSSMTP wrapped in TLS from the start of the connection, used for secure outgoing mail submission.
500UDPIKE / IPsecInternet Key Exchange, negotiates the encryption keys for an IPsec VPN tunnel.
514UDPSyslogStandard protocol for shipping log messages from a device to a central logging server.
515TCPLPDLine Printer Daemon, a classic Unix network printing protocol.
520UDPRIPRouting Information Protocol, an older distance-vector routing protocol for small networks.
546UDPDHCPv6 (Client)IPv6 equivalent of DHCP, the client side requesting an address.
547UDPDHCPv6 (Server)IPv6 equivalent of DHCP, the server side handing out addresses.
554BothRTSPReal Time Streaming Protocol, controls playback of streaming audio/video such as IP security cameras.
587TCPSMTP SubmissionThe port modern email clients use to submit outgoing mail to their provider's server, usually with STARTTLS.
631BothIPPInternet Printing Protocol, the modern standard most network printers and CUPS use.
636TCPLDAPSLDAP wrapped in TLS for encrypted directory queries.
989TCPFTPS (Data)Explicit/implicit FTP-over-TLS data channel.
990TCPFTPS (Control)Explicit/implicit FTP-over-TLS control channel.
993TCPIMAPSIMAP wrapped in TLS from the start of the connection.
995TCPPOP3SPOP3 wrapped in TLS from the start of the connection.
1080TCPSOCKS ProxyGeneral-purpose proxy protocol that can tunnel almost any TCP traffic, often used for VPN-like SSH tunnels.
1194UDPOpenVPNThe default port for the popular open-source OpenVPN tunnelling software.
1433TCPMicrosoft SQL ServerDefault listener port for Microsoft's relational database engine.
1521TCPOracle DatabaseDefault listener port for Oracle's relational database, used by the TNS listener.
1701UDPL2TPLayer 2 Tunneling Protocol, often paired with IPsec (L2TP/IPsec) for VPNs.
1723TCPPPTPPoint-to-Point Tunneling Protocol, an older VPN protocol built into early Windows versions.
Has known cryptographic weaknesses (MS-CHAPv2 can be broken). Prefer OpenVPN, WireGuard or IKEv2 instead.
1812UDPRADIUS (Auth)Remote Authentication Dial-In User Service, centralised authentication for VPNs, Wi-Fi and network devices.
1813UDPRADIUS (Accounting)The RADIUS channel that logs session usage data rather than authenticating.
1900UDPSSDP / UPnPSimple Service Discovery Protocol, lets devices on a LAN find each other automatically (Universal Plug and Play).
A well-known DDoS reflection/amplification vector when reachable from the internet.
2049BothNFSNetwork File System, the classic Unix protocol for sharing directories over a network.
2082TCPcPanelDefault unencrypted control-panel port for cPanel web hosting.
2083TCPcPanel (SSL)Encrypted cPanel control-panel access.
2181TCPZooKeeperCoordination service used by distributed systems such as Kafka and Hadoop clusters.
2222TCPAlternate SSHCommon fallback port for SSH when 22 is blocked or already used by another service, also DirectAdmin's default SSH.
2375TCPDocker API (plain)Unencrypted Docker Engine remote API.
An unauthenticated exposed Docker API gives an attacker full control of the host — never expose without TLS and auth.
2376TCPDocker API (TLS)TLS-secured Docker Engine remote API.
3000TCPCommon Dev ServerDefault local port for many development servers (Node.js, Rails, and similar frameworks).
3074BothXbox LiveUsed for Xbox Live multiplayer connectivity and voice chat.
3128TCPSquid ProxyDefault port for the widely used Squid caching web proxy.
3306TCPMySQL / MariaDBDefault listener port for MySQL and MariaDB relational databases.
3389TCPRDPRemote Desktop Protocol, Windows' built-in remote graphical desktop access.
One of the most brute-forced ports on the internet. Should never be exposed directly — put it behind a VPN.
3690TCPSubversion (SVN)Default port for the Subversion version-control server protocol.
3724TCPWorld of WarcraftGame server communication port for World of Warcraft.
4899TCPRadminRemote administration software port.
Historically abused by attackers as a persistence backdoor — verify it's intentionally installed.
5000TCPUPnP / Flask Dev ServerUsed by some UPnP implementations and is also the default port for Python's Flask development server.
5060BothSIPSession Initiation Protocol, sets up VoIP and video calls before media flows on a separate port.
5061TCPSIP-TLSSIP call signalling encrypted with TLS.
5222TCPXMPPExtensible Messaging and Presence Protocol, used for chat and presence in Jabber-based systems.
5432TCPPostgreSQLDefault listener port for the PostgreSQL relational database.
5631TCPpcAnywhere (Data)Legacy Symantec pcAnywhere remote-control data channel.
5900TCPVNCVirtual Network Computing, cross-platform remote desktop screen sharing.
Many VNC servers run with no password by default — always verify authentication is enabled.
5901TCPVNC (Display 1)A second VNC display; each additional display adds 1 to the base port.
5938TCPTeamViewerOutbound port TeamViewer uses to reach its relay network for remote support sessions.
6000TCPX11The X Window System display protocol used to show a Unix GUI remotely.
An unauthenticated exposed X11 server lets a remote attacker capture keystrokes and screens.
6379TCPRedisDefault listener port for the Redis in-memory data store, commonly used as a cache or message broker.
Frequently deployed with no password and directly reachable — a leading cause of data-exposure breaches. Bind to localhost or require auth.
6667TCPIRCThe most common plaintext IRC server port.
6881BothBitTorrentOne of the default ports BitTorrent clients use for peer connections.
7000TCPCassandra (Internode)Internal node-to-node communication for the Apache Cassandra database cluster.
8000TCPCommon Alt HTTPWidely used as an alternative HTTP port for local development and simple servers.
8080TCPHTTP AlternateThe most common alternate web port, often used for proxies, app servers and admin panels.
8081TCPHTTP Alternate (2)A second common alternate web/proxy port when 8080 is already taken.
8086TCPInfluxDBDefault HTTP API port for the InfluxDB time-series database.
8443TCPHTTPS AlternateThe most common alternate HTTPS port, used by many admin consoles and app servers.
8888TCPHTTP Alternate / JupyterA common alternate web port, notably the default for Jupyter Notebook.
9000TCPPHP-FPM / SonarQubeUsed by PHP-FPM's FastCGI listener and, separately, as SonarQube's default web port.
9042TCPCassandra (CQL)Client port for the Cassandra Query Language native protocol.
9092TCPKafkaDefault broker port for the Apache Kafka distributed event-streaming platform.
9200TCPElasticsearch (HTTP)REST API port for Elasticsearch, used for indexing and searching documents.
Historically exposed without authentication, leaking huge datasets — always secure with authentication in production.
9300TCPElasticsearch (Transport)Internal node-to-node transport port for an Elasticsearch cluster.
9418TCPGitThe native, unencrypted Git protocol used for fast read-only repository cloning.
10000TCPWebminDefault port for the Webmin web-based server administration panel.
11211BothMemcachedDefault port for the Memcached distributed memory object caching system.
Has no built-in authentication by default — restrict to trusted internal networks, and never expose UDP to the internet.
25565TCPMinecraftDefault port for Minecraft Java Edition multiplayer servers.
27015BothSource Engine GamesDefault game/server port for many Valve Source-engine titles (CS:GO, Team Fortress 2, and similar).
27017TCPMongoDBDefault listener port for the MongoDB document database.
Older MongoDB versions defaulted to no authentication and were mass-exposed to the internet — always enable auth.
27018TCPMongoDB (Shard)Default port for a MongoDB shard server in a sharded cluster.
28015BothRustDefault game server port for the survival game Rust.

Port Ranges Explained

0 – 1023

Well-Known Ports

Assigned to core, long-established services (HTTP, SSH, DNS...). On Unix-like systems, binding to one of these traditionally requires elevated privileges.

1024 – 49151

Registered Ports

Registered with IANA by software vendors for specific applications (MySQL 3306, RDP 3389...), but any user process can normally bind to them.

49152 – 65535

Dynamic / Ephemeral Ports

Not assigned to any service. Operating systems hand these out automatically as the temporary source port for outgoing connections.

This is a curated list of roughly 100 commonly searched ports, not the full IANA Service Name and Transport Protocol Port Number Registry (which lists thousands of entries). For an exhaustive, authoritative list, see the IANA registry directly at iana.org/assignments/service-names-port-numbers.

100% Private

This reference table is bundled with the page. Nothing you search is sent anywhere.

How to Use Port Number Lookup

1

Enter a Port Number or Service Name

Type a numeric port (like 443) or a service/protocol name (like SSH, MySQL, or HTTPS) into the search field. The tool searches both the number and the name/description columns simultaneously.

2

Browse Results by Category

Results are grouped by category — web, mail, database, remote-access, file-transfer, gaming, and network — so you can scan related ports quickly. Each entry shows protocol (TCP/UDP/Both) and a description.

3

Read the Security Notes

Ports with known security concerns display a warning note explaining the risk and suggesting safer alternatives, like using SFTP (22) instead of FTP (21), or enabling TLS on database connections.

Understanding TCP/UDP Port Numbers and Their Role in Networking

A port number lookup tool lets you search for a specific TCP or UDP port number and instantly see which service or protocol conventionally uses it, along with a brief security assessment. Every network connection on the internet is identified not just by an IP address but by a 16-bit port number (0–65535) that directs traffic to the correct application on the receiving host. IANA (the Internet Assigned Numbers Authority) maintains the official Service Name and Transport Protocol Port Number Registry, dividing the range into well-known ports (0–1023, assigned to core protocols like HTTP/80, HTTPS/443, SSH/22), registered ports (1024–49151, used by application vendors), and dynamic/ephemeral ports (49152–65535, assigned temporarily by the OS for outgoing connections). This tool covers the roughly 100 ports that people actually look up in practice. When a browser connects to https://example.com, it opens a TCP socket to the server's IP on port 443; the server listens on that port because the TLS/HTTPS convention established by RFC 2818 designates it. Similarly, SSH listens on port 22 (RFC 4253), SMTP on 25 (RFC 5321), DNS on 53 (RFC 1035, both TCP and UDP), and MySQL on 3306 by convention. The tool's curated list includes protocol name, a plain-language description of what the port does, whether it uses TCP, UDP, or both, a category tag (web, mail, database, remote-access, file-transfer, gaming, network, other), and an optional security note warning when the protocol is unencrypted or otherwise risky to expose to the public internet. Searching for port 3306, for example, returns MySQL with a note that it transmits credentials in plaintext unless TLS is configured, and that exposing it directly to the internet is a common attack vector for brute-force and SQL-injection campaigns. Port 6379 shows Redis with a warning that it ships with no authentication by default and should never be bound to a public interface. Port 25 (SMTP) notes that residential ISPs routinely block outbound port 25 to prevent spam relays, and that submission on port 587 with STARTTLS is the modern alternative for sending mail from a client. These context notes turn a dry lookup into actionable guidance. System administrators use this when writing firewall rules: before opening a port on a production server, they confirm which service expects it and whether an encrypted alternative exists. Developers debugging a connection timeout search by service name ("PostgreSQL") to confirm the default port (5432) matches their configuration. Penetration testers identify services running on non-standard ports by cross-referencing scan results with the well-known list to spot anomalies. Students studying for the CompTIA Network+ or CCNA memorise the classic ports and use this as a quick-check reference during practice labs. This reference is curated, not exhaustive: it covers approximately 100 of the most commonly queried ports rather than IANA's full 8,000-plus registered entries, because the vast majority of those are obscure legacy protocols nobody will ever search for. If a port is not in the list, the tool says so clearly rather than guessing. A common misunderstanding is treating a port number as inherently secure or insecure; the number itself is just a routing label, and safety depends entirely on the protocol running on it and whether that protocol is encrypted. Port 22 is safe because SSH encrypts everything, while port 23 is dangerous because Telnet sends passwords in the clear over the identical transport. That is why the security notes describe the protocol's behaviour rather than the number. Every lookup is a simple client-side filter on a static in-memory table — no network request is made, no external API is called, and no query data leaves your browser, so the reference works identically whether you are online or offline.

Port Number Lookup Formula & Method

Port number space: 16-bit integer, range 0 to 65535 (2^16 addresses). IANA classification by range: 0-1023 = well-known / system ports (bind requires elevated privilege on Unix); 1024-49151 = registered / user ports (vendor-assigned); 49152-65535 = dynamic / private / ephemeral ports (OS-assigned for outbound connections). A socket is uniquely identified by the 4-tuple: (source IP, source port, destination IP, destination port).

Examples: Port Number Lookup

Input

Port 443

Result

HTTPS (HTTP over TLS) — TCP — Web category

RFC 2818 designates port 443 for HTTP encrypted with TLS. All modern browsers default to this port for https:// URLs.

Input

Port 22

Result

SSH — TCP — Remote Access category

RFC 4253 defines SSH on port 22. Used for encrypted remote shell access, SFTP file transfers, and Git-over-SSH operations.

Input

Search: 'MySQL'

Result

Port 3306 — TCP — Database category — Security: credentials in plaintext without TLS

MySQL's default port. The tool warns that direct internet exposure is a common attack vector.

Frequently Asked Questions – Port Number Lookup

TCP provides reliable, ordered delivery with connection setup (3-way handshake) and retransmission. UDP is connectionless with no delivery guarantee, lower overhead, and lower latency — used by DNS, gaming, and streaming where speed matters more than guaranteed delivery.