🔌 TCP / UDP Port Database Reference

Search common TCP/UDP network ports (22, 80, 443, 3306, 5432, 8080) with protocol definitions, standard service names, and security recommendations.

Free No Signup Required Browser-Based

69 of 69 ports

20TCPFTP dataNever expose publicly
Active-mode FTP data channel.
Unencrypted. Use SFTP over port 22.
21TCPFTP controlNever expose publicly
File Transfer Protocol command channel.
Credentials cross the wire in plain text.
22TCPSSH / SFTPExpose with care
Encrypted remote shell and file transfer.
Key-only authentication; disable password login.
23TCPTelnetNever expose publicly
Legacy remote terminal.
Entirely unencrypted. Should not be running at all.
25TCPSMTPExpose with care
Mail transfer between servers.
Blocked outbound by most residential ISPs.
53TCP/UDPDNSExpose with care
Domain name resolution.
An open resolver will be abused for amplification attacks.
67UDPDHCP serverNever expose publicly
Hands out IP addresses on a local network.
68UDPDHCP clientNever expose publicly
Client side of address assignment.
69UDPTFTPNever expose publicly
Trivial FTP, used for network boot and device firmware.
No authentication of any kind.
80TCPHTTPDesigned to be public
Unencrypted web traffic.
Keep it open only to redirect to 443.
88TCP/UDPKerberosNever expose publicly
Network authentication, central to Active Directory.
110TCPPOP3Never expose publicly
Mail retrieval, download and delete.
Use 995 for TLS.
111TCP/UDPrpcbind / portmapperNever expose publicly
Maps RPC services to ports.
Frequently abused for amplification.
119TCPNNTPExpose with care
Usenet news transfer.
123UDPNTPExpose with care
Network time synchronization.
Old versions with monlist enabled are amplification vectors.
135TCPMS RPC endpoint mapperNever expose publicly
Windows RPC service location.
137UDPNetBIOS nameNever expose publicly
Legacy Windows name service.
138UDPNetBIOS datagramNever expose publicly
Legacy Windows datagram service.
139TCPNetBIOS sessionNever expose publicly
Legacy Windows file sharing.
143TCPIMAPNever expose publicly
Mail access, keeping messages on the server.
Use 993 for TLS.
161UDPSNMPNever expose publicly
Network device monitoring and management.
v1 and v2c send the community string in clear text.
162UDPSNMP trapNever expose publicly
Unsolicited alerts from devices.
179TCPBGPNever expose publicly
Border Gateway Protocol, internet route exchange.
194TCPIRCExpose with care
Internet Relay Chat.
389TCP/UDPLDAPNever expose publicly
Directory services, including Active Directory.
Use 636 for LDAPS.
443TCPHTTPSDesigned to be public
Web traffic over TLS.
The default for everything on the modern web.
445TCPSMBNever expose publicly
Windows file and printer sharing.
The port WannaCry and NotPetya spread over. Never expose it.
465TCPSMTPSExpose with care
Mail submission over implicit TLS.
500UDPIKE / IPsecExpose with care
VPN key exchange.
514UDPsyslogNever expose publicly
Remote system logging.
Unauthenticated and unencrypted by default.
587TCPSMTP submissionExpose with care
Mail submission from clients, with STARTTLS.
The correct port for an application sending mail.
631TCP/UDPIPP / CUPSNever expose publicly
Internet Printing Protocol.
636TCPLDAPSExpose with care
LDAP over TLS.
993TCPIMAPSExpose with care
IMAP over TLS.
995TCPPOP3SExpose with care
POP3 over TLS.
1080TCPSOCKS proxyNever expose publicly
Generic proxy protocol.
An open SOCKS proxy will be found and abused within hours.
1194UDPOpenVPNExpose with care
OpenVPN default.
1433TCPMicrosoft SQL ServerNever expose publicly
MSSQL database.
1521TCPOracle DBNever expose publicly
Oracle database listener.
1723TCPPPTPNever expose publicly
Legacy VPN protocol.
Cryptographically broken. Do not use.
1883TCPMQTTNever expose publicly
Lightweight messaging for IoT.
Unencrypted; use 8883 for TLS.
2049TCP/UDPNFSNever expose publicly
Network File System.
2375TCPDocker API (plain)Never expose publicly
Unencrypted Docker daemon socket.
Exposing this is handing over root on the host.
2376TCPDocker API (TLS)Never expose publicly
Docker daemon over TLS.
3000TCPDev server / GrafanaNever expose publicly
Node, Next.js and Rails defaults; also Grafana.
A development default, not a production one.
3306TCPMySQL / MariaDBNever expose publicly
MySQL and MariaDB.
Bind to 127.0.0.1 unless you have a specific reason not to.
3389TCPRDPNever expose publicly
Windows Remote Desktop.
Among the most brute-forced ports on the internet. Put it behind a VPN.
4444TCPMetasploit defaultNever expose publicly
Common reverse-shell listener port.
Seeing this open on a host you did not configure is worth investigating.
5000TCPFlask / UPnP / AirPlayNever expose publicly
Flask default; also macOS AirPlay receiver.
5060TCP/UDPSIPExpose with care
VoIP call signaling.
Constantly scanned for toll fraud.
5432TCPPostgreSQLNever expose publicly
PostgreSQL database.
5601TCPKibanaNever expose publicly
Elasticsearch dashboards.
5672TCPAMQP / RabbitMQNever expose publicly
Message broker.
5900TCPVNCNever expose publicly
Remote desktop for Unix and macOS.
Often deployed with no password at all.
5984TCPCouchDBNever expose publicly
CouchDB HTTP API.
6379TCPRedisNever expose publicly
In-memory data store.
Historically no authentication by default; exposed instances get cryptomined.
6443TCPKubernetes APINever expose publicly
Kubernetes control plane.
8000TCPDev / DjangoNever expose publicly
Django and Python http.server default.
8080TCPHTTP alternateExpose with care
Proxies, Tomcat, and countless dev servers.
8443TCPHTTPS alternateExpose with care
TLS on a non-privileged port.
8883TCPMQTT over TLSExpose with care
Encrypted MQTT.
9000TCPPHP-FPM / SonarQube / PortainerNever expose publicly
Several services share this default.
9200TCPElasticsearch HTTPNever expose publicly
Elasticsearch REST API.
Unsecured clusters have leaked billions of records.
9300TCPElasticsearch transportNever expose publicly
Node-to-node cluster traffic.
11211TCP/UDPMemcachedNever expose publicly
Memory caching daemon.
UDP memcached produced record-breaking amplification attacks.
15672TCPRabbitMQ managementNever expose publicly
RabbitMQ web console.
Ships with a well-known default login.
25565TCPMinecraftExpose with care
Minecraft Java Edition server.
27017TCPMongoDBNever expose publicly
MongoDB database.
Older versions bound to all interfaces with no auth; tens of thousands were ransomed.
32400TCPPlexExpose with care
Plex Media Server.

Port ranges are set by IANA: 0–1023 well-known, 1024–49151 registered, 49152–65535 dynamic. A registered assignment is a convention, not an enforcement — anything can listen on any free port, which is why a port number tells you what a service probably is rather than what it definitely is. The risk labels here are about exposure to the open internet; on a private network with proper segmentation the calculus is different.

What TCP / UDP Port Database Reference Does

A port number is a sixteen-bit label that lets one machine run many network services at once. There are 65,536 of them, and IANA divides the range into three parts: 0 to 1023 well-known, 1024 to 49151 registered, and 49152 to 65535 dynamic.

The distinction that actually matters day to day is the first boundary. On Unix-like systems, binding a port below 1024 requires root, which is why web servers historically started as root and dropped privileges, and why development servers default to 3000 or 8080 instead of 80.

An IANA assignment is a convention, not an enforcement. Anything can listen on any free port, and plenty of software ignores its registration. So a port number tells you what a service probably is, never what it definitely is — which is why a port scan is a starting point for investigation rather than an answer.

The question most people are actually asking is not "what is port 3389" but "should this be open". That is a different question with a fairly consistent answer: database ports, remote-desktop ports and management interfaces should not face the public internet, and most of the well-known breaches of the last decade involved one that did.

How to Use TCP / UDP Port Database Reference

  1. Click a quick port shortcut or type a port number/service in the search bar
  2. Review service descriptions, protocol types, and security recommendations

Formula Used by TCP / UDP Port Database Reference

The three ranges

0–1023 well-known · 1024–49151 registered · 49152–65535 dynamic and ephemeral

well-known
assigned by IANA; binding one needs root on Unix-like systems
registered
registered for a service but bindable by any user
dynamic
never assigned; the operating system picks from here for the client end of outbound connections

Worked example

A browser connecting to a website.

  1. The server listens on 443, a well-known port
  2. The operating system assigns the browser a source port from the dynamic range
  3. The connection is identified by the pair of addresses and the pair of ports

Result: That is why one machine can hold hundreds of connections to the same server — each uses a different ephemeral source port.

The ports most often found exposed by mistake

Each of these has a documented history of mass compromise when reachable from the internet.

PortServiceWhy it matters
445SMBThe path WannaCry and NotPetya spread over
3389RDPAmong the most brute-forced ports on the internet; a standard ransomware entry point
27017MongoDBOlder versions bound to all interfaces with no authentication; tens of thousands were ransomed
6379RedisHistorically no authentication by default; exposed instances get cryptomined within hours
9200ElasticsearchUnsecured clusters have leaked billions of records
11211MemcachedUDP memcached produced record-breaking amplification attacks in 2018
2375Docker APIUnauthenticated access is equivalent to root on the host
5900VNCFrequently deployed with no password at all
23TelnetEntirely unencrypted; the basis of the Mirai botnet

Encrypted and unencrypted pairs

Where a protocol has both, the unencrypted one should generally be closed.

UnencryptedEncryptedProtocol
21 FTP22 SFTPFile transfer
23 Telnet22 SSHRemote shell
80 HTTP443 HTTPSWeb
110 POP3995 POP3SMail retrieval
143 IMAP993 IMAPSMail access
389 LDAP636 LDAPSDirectory
1883 MQTT8883 MQTTSIoT messaging

How to Read Your Result

Bind to localhost rather than firewalling

For a database or cache that only local processes need, binding to 127.0.0.1 is stronger than a firewall rule, because it cannot be undone by a misconfigured rule later. Redis, MongoDB and Postgres all default this way now, precisely because of what happened when they did not.

A closed port and a filtered port are different

Closed means the machine actively refused; filtered means something dropped the packet silently. Scanners distinguish them, and the difference tells you whether a firewall exists between you and the host — which is often more informative than the port list itself.

Changing the port is not security

Moving SSH to 2222 reduces log noise from automated scans, and that is all it does. Everything is scanned across the full range; obscurity buys nothing against a targeted attempt. Key-based authentication does the actual work.

Ephemeral ports are a finite resource

A machine making very many outbound connections can exhaust its ephemeral range, which surfaces as connection failures under load with no obvious cause. It is a common and confusing failure mode in load generators and busy proxies.

Limitations & Accuracy Notes

  • A curated reference of common ports, not the complete IANA registry, which lists thousands of assignments.
  • Assignments are conventions; software can and does listen on unregistered ports.
  • Risk labels describe exposure to the open internet. On a segmented private network the assessment differs.
  • Some numbers carry several services; the entries here list the common ones rather than every claimant.
  • Nothing here scans anything. It is a lookup, not a diagnostic of your machine.

Frequently Asked Questions

What are port numbers used for in networking?
Port numbers (0 to 65,535) direct network communication traffic to specific processes or applications running on a host computer.
What are the well-known ports?
Ports 0 to 1,023 are standard well-known ports reserved for privileged system services (e.g., 22 for SSH, 80 for HTTP, 443 for HTTPS).
What are the port number ranges?
Well-known ports run 0 to 1023 and are assigned to standard services. Registered ports run 1024 to 49151. Dynamic or ephemeral ports run 49152 to 65535 and are what your machine picks for outgoing connections.
Why do well-known ports need elevated privileges?
On Unix-like systems binding below 1024 traditionally requires root, so an unprivileged process cannot impersonate a standard service such as SSH or HTTPS. It is why web servers are commonly started as root and then drop privileges.
Does a port number guarantee which service is running?
No. The assignments are conventions, not enforcement — anything can listen on any free port. Finding 22 open suggests SSH and does not prove it, which is why scanners fingerprint the service rather than trusting the number.
What is the difference between TCP and UDP on the same port?
They are separate namespaces, so TCP 53 and UDP 53 are different endpoints and can be served by different things. DNS famously uses both — UDP for ordinary queries and TCP for large responses and zone transfers.
Should I change SSH off port 22?
It reduces automated scan noise in your logs, which is a real convenience. It is not a security control — a targeted scan finds the new port in seconds. Key-based authentication and disabling password login are what actually help.
Is this a port scanner?
No. It is a reference lookup of what a port number is conventionally assigned to. A browser cannot scan ports, and scanning hosts you do not control is not something to do casually.

References & Further Reading

By OnlineToolHubs Team • September 2026