Common Port Numbers Reference
A searchable list of the port numbers you meet most often in networking, system administration and security work. Search by number, service name or keyword, and filter by TCP or UDP. Each entry notes what the port is for and, where relevant, a security tip. Entries are IANA-registered ports or well-documented vendor defaults.
Common Port Numbers Reference
Showing all 80 ports.
| Port | Protocol | Service | Notes |
|---|---|---|---|
| 20 | TCP | FTP data | Data channel for FTP in active mode. |
| 21 | TCP | FTP control | FTP commands. Sends credentials in plain text; prefer SFTP or FTPS. |
| 22 | TCP | SSH | Secure Shell remote login; also used by SFTP and SCP. |
| 23 | TCP | Telnet | Unencrypted remote terminal. Replace with SSH. |
| 25 | TCP | SMTP | Mail transfer between servers. Often blocked for home and cloud users. |
| 53 | TCP/UDP | DNS | Name resolution. UDP for most queries, TCP for large responses and zone transfers. |
| 67 | UDP | DHCP server | DHCP/BOOTP server side; clients send requests here. |
| 68 | UDP | DHCP client | DHCP/BOOTP client side; receives offers and acknowledgements. |
| 69 | UDP | TFTP | Trivial File Transfer; no authentication. Used for network boot and device configs. |
| 80 | TCP | HTTP | Unencrypted web traffic. Sites normally redirect it to HTTPS on 443. |
| 88 | TCP/UDP | Kerberos | Authentication, e.g. in Active Directory. |
| 110 | TCP | POP3 | Downloading email. Use 995 (POP3 over TLS) instead. |
| 123 | UDP | NTP | Network Time Protocol for clock synchronisation. |
| 135 | TCP/UDP | Microsoft RPC (EPMAP) | RPC endpoint mapper on Windows. Should never be exposed to the internet. |
| 137 | TCP/UDP | NetBIOS Name Service | Legacy Windows name resolution on local networks. |
| 138 | UDP | NetBIOS Datagram | Legacy Windows datagram service. |
| 139 | TCP | NetBIOS Session | Legacy SMB over NetBIOS. Modern SMB uses 445. |
| 143 | TCP | IMAP | Email access on the server. Use 993 (IMAP over TLS) instead. |
| 161 | UDP | SNMP | Polling network devices. Prefer SNMPv3 with authentication and encryption. |
| 162 | UDP | SNMP trap | Alerts sent from devices to the management station. |
| 179 | TCP | BGP | Border Gateway Protocol sessions between routers. |
| 389 | TCP/UDP | LDAP | Directory lookups, e.g. Active Directory. Use LDAPS or StartTLS for credentials. |
| 443 | TCP/UDP | HTTPS | Encrypted web traffic. UDP 443 carries HTTP/3 over QUIC. |
| 445 | TCP | SMB | Windows file and printer sharing. Never expose to the internet. |
| 464 | TCP/UDP | Kerberos password change | kpasswd service used to change Kerberos passwords. |
| 465 | TCP | SMTP submission over TLS | Mail submission with implicit TLS (RFC 8314). |
| 500 | UDP | IKE (IPsec) | Key exchange for IPsec VPNs. |
| 514 | UDP | Syslog | Plain-text log forwarding. 6514 is syslog over TLS. |
| 520 | UDP | RIP | Routing Information Protocol (RIPv1/v2). |
| 546 | UDP | DHCPv6 client | DHCP for IPv6, client side. |
| 547 | UDP | DHCPv6 server | DHCP for IPv6, server and relay side. |
| 554 | TCP/UDP | RTSP | Real Time Streaming Protocol, common on IP cameras. |
| 587 | TCP | SMTP submission | Email clients sending mail, usually with STARTTLS and authentication. |
| 631 | TCP/UDP | IPP | Internet Printing Protocol (used by CUPS). |
| 636 | TCP | LDAPS | LDAP over TLS. |
| 853 | TCP/UDP | DNS over TLS / QUIC | Encrypted DNS: DoT on TCP, DoQ on UDP. |
| 873 | TCP | rsync | rsync daemon. rsync over SSH uses port 22 instead. |
| 989 | TCP | FTPS data | FTP over TLS (implicit), data channel. |
| 990 | TCP | FTPS control | FTP over TLS (implicit), control channel. |
| 993 | TCP | IMAPS | IMAP over TLS. |
| 995 | TCP | POP3S | POP3 over TLS. |
| 1080 | TCP | SOCKS proxy | Default port for SOCKS proxies. |
| 1194 | TCP/UDP | OpenVPN | OpenVPN default; UDP is the usual choice. |
| 1433 | TCP | Microsoft SQL Server | Default SQL Server database engine instance. |
| 1521 | TCP | Oracle Database listener | Default Oracle Net listener. |
| 1701 | UDP | L2TP | Layer 2 Tunnelling Protocol, usually paired with IPsec. |
| 1723 | TCP | PPTP | Legacy VPN protocol with known weaknesses. Avoid. |
| 1812 | UDP | RADIUS authentication | Network access authentication, e.g. Wi-Fi (802.1X) and VPNs. |
| 1813 | UDP | RADIUS accounting | Session accounting records. |
| 1883 | TCP | MQTT | IoT messaging without TLS. 8883 is MQTT over TLS. |
| 1900 | UDP | SSDP (UPnP) | Device discovery on local networks. |
| 2049 | TCP/UDP | NFS | Network File System. |
| 2375 | TCP | Docker API (no TLS) | Unencrypted Docker daemon API. Exposing it gives full control of the host. |
| 2376 | TCP | Docker API (TLS) | Docker daemon API secured with TLS. |
| 3268 | TCP | AD Global Catalog | LDAP queries against the Active Directory Global Catalog (3269 with TLS). |
| 3306 | TCP | MySQL / MariaDB | Default database port. Keep it off the public internet. |
| 3389 | TCP/UDP | RDP | Windows Remote Desktop. Put it behind a VPN or gateway. |
| 3478 | TCP/UDP | STUN / TURN | NAT traversal for WebRTC and VoIP. |
| 4500 | UDP | IPsec NAT traversal | IKE and ESP when a NAT device sits in the path. |
| 5060 | TCP/UDP | SIP | VoIP call signalling. |
| 5061 | TCP | SIP over TLS | Encrypted VoIP signalling. |
| 5222 | TCP | XMPP client | Chat clients connecting to an XMPP server. |
| 5353 | UDP | mDNS | Multicast DNS (Bonjour, Avahi) for .local names. |
| 5432 | TCP | PostgreSQL | Default PostgreSQL server port. |
| 5672 | TCP | AMQP | Message queue traffic, e.g. RabbitMQ. |
| 5900 | TCP | VNC | Remote desktop (RFB protocol); display :0. Tunnel it over SSH or a VPN. |
| 5985 | TCP | WinRM (HTTP) | Windows Remote Management / PowerShell remoting. |
| 5986 | TCP | WinRM (HTTPS) | Windows Remote Management over TLS. |
| 6379 | TCP | Redis | Default Redis port. Never expose without authentication. |
| 6443 | TCP | Kubernetes API server | Default secure port of the Kubernetes control plane API. |
| 8080 | TCP | HTTP alternate | Common for proxies, app servers and development. |
| 8443 | TCP | HTTPS alternate | Common for admin panels and app servers. |
| 8883 | TCP | MQTT over TLS | Encrypted IoT messaging. |
| 9090 | TCP | Prometheus | Default Prometheus server web UI and API. |
| 9092 | TCP | Apache Kafka | Default Kafka broker listener. |
| 9100 | TCP | Raw printing (JetDirect) | Direct printing to network printers. Also the Prometheus node exporter default. |
| 9200 | TCP | Elasticsearch | REST API. Must not be open to the internet without security enabled. |
| 11211 | TCP/UDP | Memcached | Cache server. UDP is disabled by default in recent versions after amplification attacks. |
| 27017 | TCP | MongoDB | Default MongoDB port. Enable authentication and bind to private interfaces. |
| 51820 | UDP | WireGuard | Common default listen port for WireGuard VPNs (configurable). |
No ports match. Try a shorter search or another protocol.
Defaults only: any service can be configured to listen on a different port, so an open port does not prove which software is behind it.
Runs in your browser. Nothing you enter is uploaded or saved.
How to use this tool
- Search. Type a port number, a service such as SSH, or a keyword such as database.
- Filter by protocol. Choose TCP or UDP to narrow the list. Ports used on both stay visible.
- Read the notes. Check the notes for typical use and whether the port should be exposed to the internet.
Port ranges
IANA divides ports into well-known (0–1023), registered (1024–49151) and dynamic or private (49152–65535). Clients usually connect from a temporary port in the dynamic range.
TCP versus UDP
TCP sets up a connection and guarantees ordered delivery, so it suits web, email and file transfer. UDP sends datagrams without a connection, which suits DNS queries, voice, video and games. Some services, such as DNS and HTTPS with HTTP/3, use both.
Ports and security
Every open port is a possible way in. Expose only what you need, put admin services such as SSH, RDP and databases behind a VPN or firewall rules, and remember that a service can run on any port, so a scan shows what is listening, not what it is.
Frequently asked questions
Which ports should be open on a web server?
Usually just 80 and 443 to the public, with SSH or other admin access limited to trusted addresses or a VPN.
How do I see which ports are open on my machine?
On Linux, run ss -tulpn; on Windows, run netstat -ano. Both list listening ports and the process using them.
What is the difference between 465 and 587 for email?
Both are for sending mail from a client. Port 465 uses TLS from the start; 587 starts in plain text and upgrades with STARTTLS. Both are acceptable today.
More free tools
Networking · Networking
IPv4 Subnet Calculator
Work out network and broadcast addresses, usable host range, masks and binary for any IPv4 address and prefix, and split subnets.
Open tool
Networking · Networking
Binary, Decimal and Hex Converter
Convert numbers between binary, decimal, hexadecimal and octal, and IPv4 addresses between dotted decimal and binary octets.
Open tool
SEO · SEO
Meta Title and Description Checker
Check title tag and meta description length in characters and pixels, with a live preview of how the result may look in Google.
Open tool