Ports Reference
Reference of well-known and registered ports: service names, protocol, typical use and common misconfigurations. Search by port number or service keyword.
About common ports
Entries marked Default are vendor defaults for admin interfaces, portals, VPNs, game and dev servers. Administrators often move them, so treat them as a starting point rather than a rule. Entries marked Insecure carry plaintext credentials, run without authentication or are known amplification or backdoor ports.
TCP and UDP ports identify services on a host. IANA maintains the registered-ports registry; this reference covers the ports developers, sysadmins and analysts encounter daily: SSH, HTTP, database servers, game servers, IoT devices, industrial control and more.
Searches also cover the complete IANA service name and port number registry, more than 6,000 registered services. They appear under Other registered. NetSight keeps its own copy, so lookups never leave this site.
The curated list is searchable instantly in your browser. Registry lookups run on NetSight; after a few searches you may be asked for a quick human check.
How it works
A port is a 16-bit number that lets a host separate traffic for many services on one IP address. Valid values run from 0 to 65535. The IP address selects the machine, the transport protocol (TCP or UDP) selects the transport, and the port selects the application that receives the data. A connection is identified by protocol, source address and port, and destination address and port, so one server port can serve thousands of clients at once.
The three ranges
- Well-known ports, 0 to 1023: assigned to core protocols such as 22 (SSH), 53 (DNS), 80 (HTTP) and 443 (HTTPS). On Unix-like systems, binding to them normally requires elevated privileges.
- Registered ports, 1024 to 49151: assigned on request to specific applications, for example 3306 (MySQL) or 5432 (PostgreSQL). Registration does not stop other software from using the number.
- Dynamic or private ports, 49152 to 65535: not assigned to any service. Clients use them as temporary source ports. Some operating systems choose a different ephemeral range, and Linux by default uses 32768 to 60999.
A server listens on a known port, while the client picks a free ephemeral port for its side of the connection. Seeing a high port number in a log is therefore usually the client side of a connection, and the low port is the service.
TCP and UDP
TCP sets up a connection with a handshake and guarantees ordered delivery. UDP sends independent datagrams without a handshake. TCP port 53 and UDP port 53 are separate endpoints, so a service can listen on one, the other or both.
How to read the results
- Port: the number, shown with the protocol it is registered or commonly used for.
- Protocol:
tcp,udportcp/udp. The last form means the service uses both, either for different purposes (DNS uses UDP for ordinary queries and TCP for large answers) or as alternatives (a VPN may prefer UDP and fall back to TCP). - Service: the short service name, followed by a description of what the port is used for.
- Group: the category chips above the results, such as Mail, Databases or Remote access, narrow the list to one topic. Entries from the complete registry appear under Other registered.
- Default and Insecure badges: Default means the port is a vendor default that administrators often change. Insecure means the protocol sends credentials in plaintext, has no authentication by default or is known for abuse.
Things to keep in mind
- A port number does not prove which software is listening. Any program can use any free port, so
8080may be a proxy, an application server or something else. - Several services can share one number when they use different protocols. One number can also be used by different products in practice, which is why descriptions of common ports list several uses.
- The same service can have a plaintext and an encrypted port, for example IMAP on 143 and IMAP over TLS on 993. Newer web protocol versions also use UDP on port 443 next to TCP.
- An open port is not automatically a problem. What matters is who can reach it and whether the service behind it is authenticated and patched.
Examples
Search for 53
The result lists DNS with the protocol tcp/udp. Firewall rules for a resolver therefore need to allow both protocols, since answers that do not fit into a single UDP response are retried over TCP.
Search for 6379
The entry is Redis and carries the Insecure badge, because a default installation has no authentication. Such a service should listen only on a loopback or internal interface and never be reachable from an untrusted network.
Search for 8443
The entry is an alternate HTTPS port with the Default badge. It is used by several management consoles because 443 is often taken by another service. If a scan of host 192.0.2.10 shows 8443 open, the number alone only suggests a web interface over TLS, so the certificate and the response should be checked to see what it is.
Common problems and how to fix them
- Connection refused: the host answered, but nothing listens on that port or protocol. Check that the service is running and bound to the expected address. A service bound to
127.0.0.1is not reachable from other machines. - Connection times out: packets are usually being dropped, often by a host firewall, a network firewall or a missing route. Check rules for the exact protocol and direction.
- Address already in use: another process already holds the port. On Linux,
ss -ltnplists listening TCP sockets with their process, and on Windowsnetstat -anoshows the owning process ID. - Works for TCP but not UDP: firewall rules are protocol specific, so a rule for TCP 53 does not cover UDP 53.
- Unexpected traffic on a high port: if it originates from your own host, it is most likely an ephemeral client port and not a listening service.