Filter by Category
104 Results
| Port | Proto | Service | Description |
|---|---|---|---|
| 20 | TCP | FTP (Data) | File Transfer Protocol data channel, used to move the actual file bytes once a control session is open. Sends file data unencrypted. Prefer SFTP (port 22) or FTPS. |
| 21 | TCP | FTP (Control) | File Transfer Protocol command channel, used for login and directory navigation. Sends the username and password in plaintext — avoid exposing to the open internet. |
| 22 | TCP | SSH | Secure Shell — encrypted remote command-line login, also used to tunnel SFTP and Git-over-SSH. |
| 23 | TCP | Telnet | Legacy remote terminal protocol from before encryption was standard. Completely unencrypted, including the password. Should never be reachable from the internet today. |
| 25 | TCP | SMTP | Simple Mail Transfer Protocol, used by mail servers to relay outgoing email to each other. |
| 37 | Both | Time Protocol | One of the earliest network time-sync protocols, mostly superseded by NTP. |
| 43 | TCP | WHOIS | Looks up the registered owner of a domain name or IP address block. |
| 53 | Both | DNS | Domain Name System — resolves domain names to IP addresses. UDP for normal queries, TCP for large responses and zone transfers. |
| 67 | UDP | DHCP (Server) | Dynamic Host Configuration Protocol, the server side that hands out IP addresses to devices joining a network. |
| 68 | UDP | DHCP (Client) | The client side of DHCP that a device uses to request an IP address. |
| 69 | UDP | TFTP | Trivial File Transfer Protocol, a minimal file-transfer protocol often used to boot network devices and routers. Has no authentication at all — restrict it to trusted internal networks only. |
| 70 | TCP | Gopher | A pre-web hierarchical document retrieval protocol, largely historical today. |
| 79 | TCP | Finger | Old protocol for looking up information about a user on a remote system. |
| 80 | TCP | HTTP | Hypertext Transfer Protocol — standard unencrypted web traffic. |
| 88 | Both | Kerberos | Network authentication protocol used heavily inside Windows Active Directory domains. |
| 110 | TCP | POP3 | Post Office Protocol v3, downloads email from a mailbox to a local client, usually removing it from the server. |
| 111 | Both | RPCbind | Maps Remote Procedure Call program numbers to network ports, used by NFS and related services. |
| 113 | TCP | Ident | Identifies the user of a TCP connection; still queried by some IRC networks. |
| 119 | TCP | NNTP | Network News Transfer Protocol, used by Usenet newsgroup readers and servers. |
| 123 | UDP | NTP | Network Time Protocol — keeps a device's clock synchronised to a reference time source. |
| 135 | TCP | MS RPC Endpoint Mapper | Windows service that maps RPC program numbers to the dynamic port a service is actually listening on. A frequent target for worms (e.g. Blaster). Should never be exposed to the internet. |
| 137 | UDP | NetBIOS Name Service | Resolves NetBIOS computer names to IP addresses on older Windows networks. |
| 138 | UDP | NetBIOS Datagram | Connectionless NetBIOS datagram delivery, part of the legacy Windows networking stack. |
| 139 | TCP | NetBIOS Session (SMB) | File and printer sharing over NetBIOS, the predecessor transport to direct SMB on port 445. Legacy SMB transport with a long history of worm exploitation — block from the internet. |
| 143 | TCP | IMAP | Internet Message Access Protocol, keeps email synced on the server so multiple devices see the same mailbox state. |
| 161 | UDP | SNMP | Simple Network Management Protocol, used to monitor and configure routers, switches and servers remotely. Default 'public'/'private' community strings are a common recon and takeover vector — change them. |
| 162 | UDP | SNMP Trap | The channel a managed device uses to push an unsolicited alert to a monitoring station. |
| 179 | TCP | BGP | Border Gateway Protocol, the routing protocol that exchanges reachability information between the internet's autonomous systems. |
| 194 | TCP | IRC | Internet Relay Chat, a long-running real-time text chat protocol. |
| 389 | Both | LDAP | Lightweight Directory Access Protocol, queries directory services such as Active Directory for users and groups. |
| 443 | TCP | HTTPS | HTTP encrypted with TLS — the standard for secure web traffic today. |
| 445 | TCP | SMB | Server Message Block, modern Windows file and printer sharing. One of the most abused ports on the internet — the entry point for WannaCry and many ransomware worms. Never expose to the internet. |
| 465 | TCP | SMTPS | SMTP wrapped in TLS from the start of the connection, used for secure outgoing mail submission. |
| 500 | UDP | IKE / IPsec | Internet Key Exchange, negotiates the encryption keys for an IPsec VPN tunnel. |
| 514 | UDP | Syslog | Standard protocol for shipping log messages from a device to a central logging server. |
| 515 | TCP | LPD | Line Printer Daemon, a classic Unix network printing protocol. |
| 520 | UDP | RIP | Routing Information Protocol, an older distance-vector routing protocol for small networks. |
| 546 | UDP | DHCPv6 (Client) | IPv6 equivalent of DHCP, the client side requesting an address. |
| 547 | UDP | DHCPv6 (Server) | IPv6 equivalent of DHCP, the server side handing out addresses. |
| 554 | Both | RTSP | Real Time Streaming Protocol, controls playback of streaming audio/video such as IP security cameras. |
| 587 | TCP | SMTP Submission | The port modern email clients use to submit outgoing mail to their provider's server, usually with STARTTLS. |
| 631 | Both | IPP | Internet Printing Protocol, the modern standard most network printers and CUPS use. |
| 636 | TCP | LDAPS | LDAP wrapped in TLS for encrypted directory queries. |
| 989 | TCP | FTPS (Data) | Explicit/implicit FTP-over-TLS data channel. |
| 990 | TCP | FTPS (Control) | Explicit/implicit FTP-over-TLS control channel. |
| 993 | TCP | IMAPS | IMAP wrapped in TLS from the start of the connection. |
| 995 | TCP | POP3S | POP3 wrapped in TLS from the start of the connection. |
| 1080 | TCP | SOCKS Proxy | General-purpose proxy protocol that can tunnel almost any TCP traffic, often used for VPN-like SSH tunnels. |
| 1194 | UDP | OpenVPN | The default port for the popular open-source OpenVPN tunnelling software. |
| 1433 | TCP | Microsoft SQL Server | Default listener port for Microsoft's relational database engine. |
| 1521 | TCP | Oracle Database | Default listener port for Oracle's relational database, used by the TNS listener. |
| 1701 | UDP | L2TP | Layer 2 Tunneling Protocol, often paired with IPsec (L2TP/IPsec) for VPNs. |
| 1723 | TCP | PPTP | Point-to-Point Tunneling Protocol, an older VPN protocol built into early Windows versions. Has known cryptographic weaknesses (MS-CHAPv2 can be broken). Prefer OpenVPN, WireGuard or IKEv2 instead. |
| 1812 | UDP | RADIUS (Auth) | Remote Authentication Dial-In User Service, centralised authentication for VPNs, Wi-Fi and network devices. |
| 1813 | UDP | RADIUS (Accounting) | The RADIUS channel that logs session usage data rather than authenticating. |
| 1900 | UDP | SSDP / UPnP | Simple Service Discovery Protocol, lets devices on a LAN find each other automatically (Universal Plug and Play). A well-known DDoS reflection/amplification vector when reachable from the internet. |
| 2049 | Both | NFS | Network File System, the classic Unix protocol for sharing directories over a network. |
| 2082 | TCP | cPanel | Default unencrypted control-panel port for cPanel web hosting. |
| 2083 | TCP | cPanel (SSL) | Encrypted cPanel control-panel access. |
| 2181 | TCP | ZooKeeper | Coordination service used by distributed systems such as Kafka and Hadoop clusters. |
| 2222 | TCP | Alternate SSH | Common fallback port for SSH when 22 is blocked or already used by another service, also DirectAdmin's default SSH. |
| 2375 | TCP | Docker API (plain) | Unencrypted Docker Engine remote API. An unauthenticated exposed Docker API gives an attacker full control of the host — never expose without TLS and auth. |
| 2376 | TCP | Docker API (TLS) | TLS-secured Docker Engine remote API. |
| 3000 | TCP | Common Dev Server | Default local port for many development servers (Node.js, Rails, and similar frameworks). |
| 3074 | Both | Xbox Live | Used for Xbox Live multiplayer connectivity and voice chat. |
| 3128 | TCP | Squid Proxy | Default port for the widely used Squid caching web proxy. |
| 3306 | TCP | MySQL / MariaDB | Default listener port for MySQL and MariaDB relational databases. |
| 3389 | TCP | RDP | Remote Desktop Protocol, Windows' built-in remote graphical desktop access. One of the most brute-forced ports on the internet. Should never be exposed directly — put it behind a VPN. |
| 3690 | TCP | Subversion (SVN) | Default port for the Subversion version-control server protocol. |
| 3724 | TCP | World of Warcraft | Game server communication port for World of Warcraft. |
| 4899 | TCP | Radmin | Remote administration software port. Historically abused by attackers as a persistence backdoor — verify it's intentionally installed. |
| 5000 | TCP | UPnP / Flask Dev Server | Used by some UPnP implementations and is also the default port for Python's Flask development server. |
| 5060 | Both | SIP | Session Initiation Protocol, sets up VoIP and video calls before media flows on a separate port. |
| 5061 | TCP | SIP-TLS | SIP call signalling encrypted with TLS. |
| 5222 | TCP | XMPP | Extensible Messaging and Presence Protocol, used for chat and presence in Jabber-based systems. |
| 5432 | TCP | PostgreSQL | Default listener port for the PostgreSQL relational database. |
| 5631 | TCP | pcAnywhere (Data) | Legacy Symantec pcAnywhere remote-control data channel. |
| 5900 | TCP | VNC | Virtual Network Computing, cross-platform remote desktop screen sharing. Many VNC servers run with no password by default — always verify authentication is enabled. |
| 5901 | TCP | VNC (Display 1) | A second VNC display; each additional display adds 1 to the base port. |
| 5938 | TCP | TeamViewer | Outbound port TeamViewer uses to reach its relay network for remote support sessions. |
| 6000 | TCP | X11 | The X Window System display protocol used to show a Unix GUI remotely. An unauthenticated exposed X11 server lets a remote attacker capture keystrokes and screens. |
| 6379 | TCP | Redis | Default listener port for the Redis in-memory data store, commonly used as a cache or message broker. Frequently deployed with no password and directly reachable — a leading cause of data-exposure breaches. Bind to localhost or require auth. |
| 6667 | TCP | IRC | The most common plaintext IRC server port. |
| 6881 | Both | BitTorrent | One of the default ports BitTorrent clients use for peer connections. |
| 7000 | TCP | Cassandra (Internode) | Internal node-to-node communication for the Apache Cassandra database cluster. |
| 8000 | TCP | Common Alt HTTP | Widely used as an alternative HTTP port for local development and simple servers. |
| 8080 | TCP | HTTP Alternate | The most common alternate web port, often used for proxies, app servers and admin panels. |
| 8081 | TCP | HTTP Alternate (2) | A second common alternate web/proxy port when 8080 is already taken. |
| 8086 | TCP | InfluxDB | Default HTTP API port for the InfluxDB time-series database. |
| 8443 | TCP | HTTPS Alternate | The most common alternate HTTPS port, used by many admin consoles and app servers. |
| 8888 | TCP | HTTP Alternate / Jupyter | A common alternate web port, notably the default for Jupyter Notebook. |
| 9000 | TCP | PHP-FPM / SonarQube | Used by PHP-FPM's FastCGI listener and, separately, as SonarQube's default web port. |
| 9042 | TCP | Cassandra (CQL) | Client port for the Cassandra Query Language native protocol. |
| 9092 | TCP | Kafka | Default broker port for the Apache Kafka distributed event-streaming platform. |
| 9200 | TCP | Elasticsearch (HTTP) | REST API port for Elasticsearch, used for indexing and searching documents. Historically exposed without authentication, leaking huge datasets — always secure with authentication in production. |
| 9300 | TCP | Elasticsearch (Transport) | Internal node-to-node transport port for an Elasticsearch cluster. |
| 9418 | TCP | Git | The native, unencrypted Git protocol used for fast read-only repository cloning. |
| 10000 | TCP | Webmin | Default port for the Webmin web-based server administration panel. |
| 11211 | Both | Memcached | Default port for the Memcached distributed memory object caching system. Has no built-in authentication by default — restrict to trusted internal networks, and never expose UDP to the internet. |
| 25565 | TCP | Minecraft | Default port for Minecraft Java Edition multiplayer servers. |
| 27015 | Both | Source Engine Games | Default game/server port for many Valve Source-engine titles (CS:GO, Team Fortress 2, and similar). |
| 27017 | TCP | MongoDB | Default listener port for the MongoDB document database. Older MongoDB versions defaulted to no authentication and were mass-exposed to the internet — always enable auth. |
| 27018 | TCP | MongoDB (Shard) | Default port for a MongoDB shard server in a sharded cluster. |
| 28015 | Both | Rust | Default game server port for the survival game Rust. |
Port Ranges Explained
0 – 1023
Well-Known Ports
Assigned to core, long-established services (HTTP, SSH, DNS...). On Unix-like systems, binding to one of these traditionally requires elevated privileges.
1024 – 49151
Registered Ports
Registered with IANA by software vendors for specific applications (MySQL 3306, RDP 3389...), but any user process can normally bind to them.
49152 – 65535
Dynamic / Ephemeral Ports
Not assigned to any service. Operating systems hand these out automatically as the temporary source port for outgoing connections.
This is a curated list of roughly 100 commonly searched ports, not the full IANA Service Name and Transport Protocol Port Number Registry (which lists thousands of entries). For an exhaustive, authoritative list, see the IANA registry directly at iana.org/assignments/service-names-port-numbers.
100% Private
This reference table is bundled with the page. Nothing you search is sent anywhere.