Skip to content
ToolBoxGeniehome

Network Port Lookup

Developer Tools · Added

A reference for the port numbers that turn up in firewall rules, compose files, security groups and connection errors. Search by number or by service name, and each entry says which transport it uses, whether the protocol encrypts on its own, and — where it matters — why putting it on a public address is a known bad idea.

A number from 0 to 65535, a service name, or a word from a description.

Filter by kind

81 common ports

File transfer

PortProtocolServiceWhat it is
20TCPFTP dataThe data channel of active-mode FTP. Opened by the server back to the client, which is why active FTP and NAT fight.
21TCPFTP controlFTP commands and responses. The data itself moves on a second connection, which is why FTP and firewalls fight.Credentials and data both travel in clear text. Use SFTP over port 22, or FTPS.
69UDPTFTPTrivial FTP, used for network boot and switch firmware. No authentication at all by design.Anonymous read and write with no authentication. Keep it on a provisioning VLAN.
445TCPSMBWindows file and printer sharing over TCP.The vector for several worms, WannaCry among them. Should never cross an internet boundary.
873TCPrsyncThe rsync daemon protocol, separate from rsync run over SSH.
989TCPFTPS dataTLSThe FTPS data channel, wrapped in TLS from the first byte rather than upgraded by a command.
990TCPFTPS controlTLSImplicit TLS FTP control channel.
2049TCP + UDPNFSNetwork File System. Modern NFSv4 needs only this port; v3 also needs the portmapper on 111.

Remote access

PortProtocolServiceWhat it is
22TCPSSH / SFTP / SCPTLSEncrypted shell, and the file transfer protocols tunnelled inside it.Safe to expose with key-only authentication. With passwords enabled it will be brute-forced continuously.
23TCPTelnetUnencrypted remote shell. Superseded by SSH in the 1990s.Sends credentials in clear text. There is no configuration that makes this safe on an untrusted network.
3389TCP + UDPRDPTLSWindows Remote Desktop. Also answers on UDP for the faster transport RDP prefers when it is available.A standing target for credential stuffing and for RDP-specific exploits. Put it behind a VPN or a gateway rather than on the open internet.
5900TCPVNCRemote framebuffer. 5901 and upward are additional displays.The base protocol has no transport encryption and a weak password scheme. Tunnel it over SSH.
5985TCPWinRM (HTTP)Windows Remote Management over HTTP. What PowerShell remoting uses.
5986TCPWinRM (HTTPS)TLSWindows Remote Management over TLS.

Mail

PortProtocolServiceWhat it is
25TCPSMTPServer-to-server mail transfer. Not the port a mail client should be submitting on.Most consumer ISPs and cloud providers block outbound 25 to limit spam.
110TCPPOP3Downloads mail and normally deletes the server copy.
143TCPIMAPReads mail while leaving it on the server.
465TCPSMTPS (submission)TLSMail submission wrapped in TLS from the first byte. Deprecated, then un-deprecated by RFC 8314.
587TCPSMTP submissionTLSThe port a mail client should use to send. Starts plain and upgrades with STARTTLS.
993TCPIMAPSTLSIMAP wrapped in TLS from the first byte, and what every modern mail client should be configured to use.
995TCPPOP3STLSPOP3 wrapped in TLS from the first byte. The plain port can also upgrade with STARTTLS instead.

Network infrastructure

PortProtocolServiceWhat it is
53TCP + UDPDNSName resolution. UDP for ordinary queries, TCP for zone transfers and any response too large for a datagram.An open recursive resolver will be used for amplification attacks. Serve recursion only to your own networks.
67UDPDHCP serverAddress assignment, server side.
68UDPDHCP clientAddress assignment, client side.
111TCP + UDPPortmapper / rpcbindMaps RPC programs to ports. Needed by NFSv3 and by older NIS.Enumerating it lists every RPC service on the host, and it has been used for amplification.
123UDPNTPTime synchronisation. Clock drift breaks TLS, Kerberos and time-based one-time passwords.Older versions answered monlist, which made them powerful amplifiers. Keep the daemon current.
161UDPSNMPDevice monitoring and polling — interface counters, temperatures, uptime — pulled by a monitoring system.SNMP v1 and v2c authenticate with a community string in clear text, and 'public' is still the default on far too much equipment.
162UDPSNMP trapUnsolicited alerts from devices to a monitoring station.
179TCPBGPThe routing protocol between autonomous systems.
500UDPIKE (IPsec)TLSIPsec key exchange. 4500 carries NAT traversal.
514UDPSyslogLog shipping. Fire and forget, with no delivery guarantee.
853TCP + UDPDNS over TLSTLSEncrypted DNS. The UDP form is DNS over QUIC.
1194TCP + UDPOpenVPNTLSOpenVPN's default, UDP by preference.
4500UDPIPsec NAT-TTLSIPsec encapsulated in UDP so it can cross NAT.
51820UDPWireGuardTLSWireGuard's default. Silent to unauthenticated packets, so it does not answer scans.

Web

PortProtocolServiceWhat it is
80TCPHTTPUnencrypted web traffic. Usually kept open only to redirect to 443 and to answer ACME challenges.
443TCP + UDPHTTPS / QUICTLSTLS-encrypted web traffic over TCP, and HTTP/3 over UDP using QUIC. The UDP half is why HTTP/3 fails on firewalls that only opened TCP.
8080TCPHTTP alternateThe conventional second web port: proxies, Tomcat, and anything run without root.
8443TCPHTTPS alternateTLSTLS on a non-privileged port. Common for admin consoles and appliances.

Directory and auth

PortProtocolServiceWhat it is
88TCP + UDPKerberosTLSTicket granting. Central to Active Directory authentication.
389TCP + UDPLDAPDirectory queries in clear text, optionally upgraded with STARTTLS.
464TCP + UDPKerberos password changeTLSkpasswd, used to change a principal's password.
636TCPLDAPSTLSLDAP wrapped in TLS from the first byte. Active Directory also offers STARTTLS on the plain port.
1812UDPRADIUS authenticationNetwork access authentication, used by Wi-Fi and VPN concentrators.
1813UDPRADIUS accountingRADIUS accounting: start, stop and interim records for a session, sent separately from the authentication.
3268TCPGlobal CatalogActive Directory forest-wide LDAP. 3269 is its TLS counterpart.

Media and voice

PortProtocolServiceWhat it is
554TCP + UDPRTSPStream control for IP cameras and media servers.A large share of exposed RTSP cameras still run on default credentials, and public indexes of them exist.
1935TCPRTMPReal-Time Messaging Protocol, still the standard way to push a live stream to an ingest server.
3478TCP + UDPSTUN / TURNNAT traversal for WebRTC. STUN discovers the public address; TURN relays when a direct path is impossible.
5060TCP + UDPSIPCall setup and teardown for voice over IP. The audio itself travels separately over RTP on high UDP ports.Exposed SIP endpoints are scanned constantly for toll fraud, and a compromised one runs up international call charges fast.
5061TCPSIP over TLSTLSSIP signalling over TLS. It protects the call setup only; encrypting the audio is a separate matter, SRTP.

Databases

PortProtocolServiceWhat it is
1433TCPMicrosoft SQL ServerThe default instance. Named instances are assigned dynamically and discovered over UDP 1434.
1521TCPOracle TNSOracle's TNS listener, which brokers the connection and can hand the client off to another port entirely.
3306TCPMySQL / MariaDBThe classic relational default, and the port most often found accidentally open on a public address.Bind it to localhost or a private network. An exposed database port is scanned within minutes.
5432TCPPostgreSQLPostgreSQL's wire protocol. TLS is negotiated inside it rather than on a separate port.Same rule as MySQL: private networks only, and require TLS if it has to cross one.
5984TCPCouchDBCouchDB's HTTP API, which is also its admin interface — the database speaks REST rather than a binary protocol.
6379TCPRedisThe Redis serialization protocol. Fast, simple, and with no authentication at all in its default configuration.Historically unauthenticated by default, and its CONFIG command can write files. Never expose it.
7000TCPCassandra internodeCluster gossip. 9042 carries client queries.
9042TCPCassandra CQLThe CQL client protocol, which is what drivers connect to. Cluster gossip runs separately on 7000.
9200TCPElasticsearch HTTPThe REST API. 9300 is the internal transport between nodes.An open Elasticsearch endpoint hands over every index it holds. Security is off by default in older versions.
11211TCP + UDPMemcachedA cache with no authentication in its base protocol.The UDP side has been used for very large reflection attacks. Disable UDP and bind to localhost.
27017TCPMongoDBMongoDB's wire protocol. 27018 and 27019 are shard and config servers.Older releases shipped with no authentication and bound to every interface, which produced a long run of mass data extortion. Check both settings.

Messaging and queues

PortProtocolServiceWhat it is
1883TCPMQTTLightweight publish and subscribe, widely used by IoT devices.
5222TCPXMPP clientClient to server. 5269 is server to server.
5672TCPAMQPRabbitMQ and other AMQP 0-9-1 brokers. 5671 is the TLS port.
6667TCPIRCInternet Relay Chat. 6697 is the TLS port.
8883TCPMQTT over TLSTLSThe encrypted counterpart to 1883.
9092TCPKafkaKafka broker traffic. Clients are redirected to whichever broker leads a partition, so every broker must be reachable.
15672TCPRabbitMQ managementThe web management UI and its HTTP API.

Development

PortProtocolServiceWhat it is
2375TCPDocker API (plain)The Docker daemon's remote API without TLS.Access to this is root on the host: anyone who can reach it can run a privileged container that mounts the filesystem. Never expose it.
2376TCPDocker API (TLS)TLSThe Docker daemon's remote API with client certificate authentication.
2379TCPetcd clientetcd's client API. 2380 is peer traffic.etcd holds every Kubernetes secret. Read access to it is read access to the cluster.
3000TCPNode / dev serverNot an assignment — a convention. Next.js, Express, Rails and Grafana all default here.
4000TCPDevelopment serverPhoenix, Jekyll and several static-site tools default here.
5000TCPFlask / .NET / AirPlayA crowded number: Flask's default, ASP.NET Core's default, and on macOS the AirPlay receiver, which is why a Flask app on a Mac often will not bind.
5173TCPVite dev serverVite's default. Serves the unbuilt application with hot reloading.
6443TCPKubernetes APITLSThe cluster control plane's API server.
8000TCPHTTP developmentDjango, Python's http.server and PHP's built-in server all default here.
9090TCPPrometheusThe Prometheus server's web UI and query API.
9100TCPPrometheus node exporterHost metrics in Prometheus text format, served for a scraper to poll. No authentication in the default build.Publishes a detailed inventory of the host — kernel version, mounted filesystems, network interfaces — to anyone who asks.
25565TCPMinecraftThe Java edition server default. Bedrock uses UDP 19132.

The three ranges

System (well-known)
0–1023
User (registered)
1024–49151
Dynamic (ephemeral)
49152–65535
  • System (well-known). Assigned by IANA and, on Unix-like systems, bindable only by root or by a process holding CAP_NET_BIND_SERVICE. That restriction is why web servers start as root and drop privileges, and why development servers run on 3000 or 8080 instead.
  • User (registered). Registered with IANA on request but bindable by any user. Most application and database defaults live here.
  • Dynamic (ephemeral). Never assigned. This is the pool an operating system draws from for the client side of an outbound connection. Linux actually defaults to 32768-60999, so the practical ephemeral range is wider than the standard's.

This is a reference table, not a scanner. It never contacts a host, and it cannot tell you what is listening anywhere — only what a number conventionally means. Assignments are conventions: any service can be configured onto any port, and moving one is often a reasonable thing to do.

How to use the network port lookup

  1. 1Type a port number to see what conventionally runs there, or a service name such as "postgres" or "ssh".
  2. 2Filter by kind if you are browsing rather than looking something up.
  3. 3Read the range panel for any number: it says whether binding it needs root and whether it is in the ephemeral pool.
  4. 4Check the exposure note on anything you are about to open in a firewall.

Examples

The HTTP/3 surprise

Input
443
Result
HTTPS over TCP and QUIC over UDP

A firewall that opened only TCP 443 silently blocks HTTP/3, and the symptom is a slow fallback rather than an error.

Why a Flask app will not start on a Mac

Input
5000
Result
Flask, ASP.NET Core — and the macOS AirPlay receiver

The address-in-use error has nothing to do with your code.

A number with no assignment

Input
47821
Result
No conventional service, and inside the dynamic range

That is the pool an operating system draws from for the client end of an outbound connection.

About the network port lookup

How the numbering came to look like this

The three ranges are set by RFC 6335, which also governs the IANA registry the assignments live in. System ports, 0 to 1023, are assigned by IANA and privileged to bind. User ports, 1024 to 49151, are registered on request but bindable by anyone — most application and database defaults live here. Dynamic ports, 49152 upward, are never assigned to anything.

The registry itself is enormous and mostly unread. Thousands of entries record a protocol somebody registered decades ago, and a good many of them are for software nobody runs any more. The ports people actually look up are a couple of hundred, which is what this table holds. Several of the most familiar are not registered at all: 3000 and 8080 are conventions that spread by imitation, not assignments.

Encrypted and unencrypted pairs

A recurring pattern in the table is a plain port and a TLS one: 80 and 443, 143 and 993, 110 and 995, 389 and 636, 21 and 990, 1883 and 8883. The second of each pair wraps the protocol in TLS from the first byte, which is called implicit TLS.

There is a third pattern too, and it is the one that catches people. STARTTLS keeps the plain port and upgrades the connection to TLS after an initial exchange — SMTP submission on 587 and LDAP on 389 both work this way. It means a plain port number does not tell you whether a connection was encrypted, and it introduces a downgrade risk: an attacker who can modify the stream can strip the upgrade offer unless the client insists. RFC 8314 recommends implicit TLS over STARTTLS for mail for exactly this reason.

Reading a firewall rule

The practical use of a table like this is checking a rule before it goes live. Three questions usually settle it: what does this number conventionally mean, does the protocol authenticate and encrypt on its own, and is the source restricted to somewhere you trust.

A rule allowing 3306 from anywhere fails the second and third questions at once. A rule allowing 22 from anywhere passes if key authentication is enforced and fails if passwords are enabled, because the port will be brute-forced continuously — not as a targeted attack but as background noise on the internet. And a rule allowing 443 that forgets UDP will work perfectly until a browser tries HTTP/3.

Frequently asked questions

Does a port number tell me what is actually running?
No. An assignment is a convention, not an enforcement — any service can be configured to listen on any free port, and moving SSH off 22 is a common and reasonable thing to do. This answers what a number usually means, which is the question you have when reading a firewall rule or a configuration file. Finding out what is actually listening on a machine means asking that machine, with something like ss or netstat locally.
Why do some ports need root to bind?
Everything below 1024 is a privileged port on Unix-like systems, and binding one requires root or the CAP_NET_BIND_SERVICE capability. The rule dates from a time when a machine's users were not all trusted, and the idea was that a service answering on a well-known port must have been started by the administrator. It is why web servers historically start as root and immediately drop privileges, and why development servers default to 3000 or 8080 instead.
What is the ephemeral port range for?
Every outbound connection needs a local port at the client end too, and the operating system allocates it from a high range that is never assigned to any service. The standard reserves 49152 to 65535 for this, though Linux actually defaults to 32768 to 60999. It matters when a machine makes very many simultaneous outbound connections — a busy proxy or load balancer can exhaust the pool, and the symptom is connection failures under load with nothing wrong at the far end.
Which ports should never face the internet?
Anything that authenticates in clear text or does not authenticate at all: Telnet, FTP, SMB on 445, and every database default — MySQL, PostgreSQL, MongoDB, Redis, Elasticsearch, Memcached. The Docker daemon API on 2375 is the sharpest case, because access to it is root on the host. Several of these have produced mass compromise events precisely because they once shipped listening on every interface with no password. Bind them to localhost or a private network and reach them over a VPN.
Is this a port scanner?
No, and it deliberately cannot be. It is a static reference table that runs in your browser; it makes no network connections, contacts no host, and has no way to find out what any machine has open. If you need to check what is listening on a server you are responsible for, that is a job for a tool on the machine or an authorised scan of your own network.

Related tools