A port number says which service on a machine a connection is meant for. Together with an IP address it identifies one endpoint, such as 203.0.113.5:443. Below are the ports you will meet most often. To look up any port, use the Port Number Lookup.
Port ranges
| Range | Name | Notes |
|---|---|---|
0-1023 |
Well-known (system) ports | Assigned by IANA to core services; servers usually need elevated rights to listen here |
1024-49151 |
Registered ports | Assigned to specific applications on request |
49152-65535 |
Dynamic (ephemeral) ports | Picked at random by your computer for the client side of a connection |
Common ports
| Port | Protocol | Service | Used for |
|---|---|---|---|
20, 21 |
TCP | FTP | File transfer (20 data, 21 control); unencrypted |
22 |
TCP | SSH / SFTP | Secure remote shell and file transfer |
23 |
TCP | Telnet | Remote shell with no encryption: avoid |
25 |
TCP | SMTP | Mail delivery between servers |
53 |
TCP/UDP | DNS | Domain name lookups (UDP normally, TCP for big answers) |
67, 68 |
UDP | DHCP | Automatic IP address assignment (67 server, 68 client) |
80 |
TCP | HTTP | Web traffic without encryption |
110 |
TCP | POP3 | Download mail (unencrypted) |
123 |
UDP | NTP | Network time synchronisation |
143 |
TCP | IMAP | Read mail on the server (unencrypted or STARTTLS) |
161, 162 |
UDP | SNMP | Network device monitoring (162 for traps) |
389 |
TCP/UDP | LDAP | Directory services such as Active Directory |
443 |
TCP/UDP | HTTPS | Encrypted web traffic (UDP for HTTP/3) |
445 |
TCP | SMB | Windows file sharing; never expose to the internet |
465 |
TCP | SMTPS | Mail submission over implicit TLS |
514 |
UDP | Syslog | Log messages from devices and servers |
587 |
TCP | SMTP submission | Mail clients sending mail (STARTTLS); the usual choice |
636 |
TCP | LDAPS | LDAP over TLS |
993 |
TCP | IMAPS | IMAP over TLS |
995 |
TCP | POP3S | POP3 over TLS |
1194 |
UDP | OpenVPN | Default OpenVPN port |
1433 |
TCP | SQL Server | Microsoft SQL Server database |
1521 |
TCP | Oracle DB | Oracle database listener |
3306 |
TCP | MySQL / MariaDB | MySQL and MariaDB databases |
3389 |
TCP/UDP | RDP | Windows Remote Desktop; a common attack target |
5432 |
TCP | PostgreSQL | PostgreSQL database |
5900 |
TCP | VNC | Remote desktop (VNC) |
6379 |
TCP | Redis | Redis key-value store |
8080 |
TCP | HTTP alternate | Common for proxies and development servers |
8443 |
TCP | HTTPS alternate | Alternate HTTPS, often admin consoles |
9200 |
TCP | Elasticsearch | Elasticsearch HTTP API |
27017 |
TCP | MongoDB | MongoDB database |
51820 |
UDP | WireGuard | Default WireGuard VPN port |
Reading the table
- TCP vs UDP. TCP is reliable and ordered (web pages, mail, databases); UDP is faster and lossy (DNS lookups, time sync, VPNs, streaming). Some services use both.
- Encrypted twins. Many protocols come in a plain and a TLS flavour on different ports: HTTP
80and HTTPS443, IMAP143and IMAPS993, LDAP389and LDAPS636. - A port is only a convention. Nothing stops a service listening somewhere else, and an open port does not prove which program is behind it.
Security notes
Expose only the ports a service actually needs. Management and database ports such as 22, 445, 1433, 3306, 3389, 5432, 6379 and 27017 should sit behind a Firewall or VPN, not face the public internet. To see which of your ports answer, use a scanner you are authorised to run; the TCP/UDP Port Range Generator helps write the ranges for firewall rules.