Port Number Lookup
58 TCP and UDP ports you will actually meet in ACLs, NAT rules, and packet captures — each with the caveat that matters when you write the rule, not just the service name.
58 of 58 ports
- 53TCP/UDPDNSName & address
Domain Name System — resolves names to addresses.
UDP for ordinary queries; TCP when a response exceeds 512 bytes or for zone transfers. Blocking TCP/53 breaks DNSSEC and large responses.
- 67UDPDHCP serverName & address
Server side of DHCP — receives DISCOVER and REQUEST.
Pairs with UDP/68. Because DISCOVER is a broadcast, a server on another subnet needs an ip helper-address relay.
- 68UDPDHCP clientName & address
Client side of DHCP — receives OFFER and ACK.
- 123UDPNTPName & address
Network Time Protocol — clock synchronization.
Accurate time matters more than it looks: certificate validation, log correlation, and Kerberos all fail when clocks drift.
- 546UDPDHCPv6 clientName & address
DHCPv6 client port.
- 547UDPDHCPv6 serverName & address
DHCPv6 server port.
- 80TCPHTTPWeb
Unencrypted web traffic.
Usually kept open only to redirect to HTTPS.
- 443TCPHTTPSWeb
TLS-encrypted web traffic.
Also carries HTTP/3 over QUIC on UDP/443 — a firewall rule that only permits TCP/443 silently forces clients back to HTTP/2.
- 8080TCPHTTP alternateWeb
Common alternate web port for proxies and app servers.
- 8443TCPHTTPS alternateWeb
Common alternate TLS port for management interfaces.
- 25TCPSMTPMail
Mail transfer between servers.
Widely blocked outbound by ISPs and clouds to limit spam; submission uses 587.
- 110TCPPOP3Mail
Mail retrieval, download-and-delete model.
- 143TCPIMAPMail
Mail retrieval, server-side mailbox model.
- 465TCPSMTPSMail
SMTP with implicit TLS.
- 587TCPSMTP submissionMail
Client-to-server mail submission with STARTTLS.
The correct port for an application sending mail — not 25.
- 993TCPIMAPSMail
IMAP over TLS.
- 995TCPPOP3SMail
POP3 over TLS.
- 20TCPFTP dataFile transfer
FTP data channel (active mode).
The reason FTP is awkward through NAT and firewalls: the data connection is negotiated separately from the control channel.
- 21TCPFTP controlFile transfer
FTP command channel.
Credentials and commands travel in cleartext. Prefer SFTP (22) or FTPS.
- 69UDPTFTPFile transfer
Trivial FTP — no authentication.
Standard for network device image and config transfers; never expose it beyond a management network.
- 445TCPSMBFile transfer
Windows file and printer sharing.
Should never cross an internet boundary — a recurring worm and ransomware vector.
- 873TCPrsyncFile transfer
rsync daemon for file synchronization.
- 22TCPSSH / SFTP / SCPRemote access
Encrypted remote shell and file transfer.
The correct replacement for Telnet, FTP, and rsh all at once.
- 23TCPTelnetRemote access
Unencrypted remote shell.
Sends credentials in cleartext. Still common on lab gear and console servers; disable it on anything reachable.
- 3389TCPRDPRemote access
Windows Remote Desktop.
One of the most-scanned ports on the internet. Put it behind a VPN.
- 5900TCPVNCRemote access
Remote framebuffer / screen sharing.
- 161UDPSNMPNetwork management
Polling device metrics and status.
v1 and v2c authenticate with a plaintext community string — treat them as read-only and management-network-only. v3 adds real auth and encryption.
- 162UDPSNMP trapNetwork management
Unsolicited alerts pushed from device to manager.
- 514UDPSyslogNetwork management
Remote log collection.
Classic syslog is UDP and unencrypted — lossy by design. TCP/6514 carries syslog over TLS.
- 179TCPBGPNetwork management
Border Gateway Protocol peering session.
The only routing protocol here that runs over TCP; OSPF and EIGRP ride directly on IP as protocols 89 and 88.
- 1812UDPRADIUS authNetwork management
Network access authentication.
Used by 802.1X port-based authentication and VPN concentrators.
- 1813UDPRADIUS accountingNetwork management
Session accounting records.
- 49TCPTACACS+Network management
Device administration AAA.
Encrypts the whole payload and separates authorization from authentication, which is why it is preferred over RADIUS for router and switch login.
- 500UDPIKE / ISAKMPNetwork management
IPsec tunnel negotiation.
Pairs with UDP/4500 for NAT traversal — permit both or tunnels fail behind NAT.
- 4500UDPIPsec NAT-TNetwork management
IPsec encapsulated in UDP to cross NAT.
- 1701UDPL2TPNetwork management
Layer 2 Tunneling Protocol, typically wrapped in IPsec.
- 1194TCP/UDPOpenVPNNetwork management
OpenVPN default port.
- 51820UDPWireGuardNetwork management
WireGuard default port.
- 88TCP/UDPKerberosDirectory & auth
Ticket-based authentication.
Highly clock-sensitive — a few minutes of drift breaks logins outright.
- 389TCPLDAPDirectory & auth
Directory queries, unencrypted.
- 636TCPLDAPSDirectory & auth
LDAP over TLS.
- 3268TCPGlobal CatalogDirectory & auth
Active Directory global catalog queries.
- 1433TCPMicrosoft SQL ServerDatabase
SQL Server default instance.
- 1521TCPOracleDatabase
Oracle database listener.
- 3306TCPMySQL / MariaDBDatabase
MySQL and MariaDB default port.
- 5432TCPPostgreSQLDatabase
PostgreSQL default port.
- 6379TCPRedisDatabase
Redis default port.
Historically shipped with no authentication — a frequent accidental internet exposure.
- 27017TCPMongoDBDatabase
MongoDB default port.
- 7TCP/UDPEchoOther
Echoes back whatever it receives.
Largely historical; disabled on modern systems as an amplification risk.
- 119TCPNNTPOther
Usenet news transfer.
- 194TCPIRCOther
Internet Relay Chat.
- 5060TCP/UDPSIPOther
VoIP call signalling, unencrypted.
Media itself travels over RTP on a separately negotiated high UDP port range — which is why VoIP and NAT need help from each other.
- 5061TCPSIP over TLSOther
Encrypted VoIP signalling.
- 1900UDPSSDP / UPnPOther
Device discovery on local networks.
A well-known reflection and amplification vector — never permit it inbound from the internet.
- 5353UDPmDNSOther
Multicast DNS — Bonjour and service discovery.
- 137UDPNetBIOS nameOther
Legacy Windows name service.
- 138UDPNetBIOS datagramOther
Legacy Windows datagram service.
- 139TCPNetBIOS sessionOther
Legacy Windows session service.
Knowing the port number is half of it. In the lab you can write an extended access-list that permits 443 and denies 80, then watch the animation stop dead at the interface that denied it.
Open the labWhy ports exist at all
An IP address gets a packet to the right host. A port gets it to the right process on that host. Without them a server could run exactly one network service, because the operating system would have no way to decide which program a newly arrived segment belonged to.
A conversation is therefore identified by four values, not two: source address, source port, destination address, destination port. Your browser opens a connection from a random high port to the server's 443; the server replies from 443 back to that random port. This is exactly how NAT survives — the router rewrites the source port so many inside hosts can share one public address, and remembers the mapping to send replies back to the right one.
It is also why firewall rules are asymmetric in practice. You permit inbound traffic to a small set of known destination ports, and a stateful firewall handles the return traffic to ephemeral ports automatically because it remembers the connection it already allowed.
Port number FAQ
What is the difference between TCP and UDP ports?
They are separate 16-bit number spaces. TCP/53 and UDP/53 are different endpoints that happen to share a number, which is why a firewall rule permitting one does not permit the other. DNS is the classic trap: it uses UDP for ordinary queries and TCP for large responses and zone transfers, so permitting only UDP breaks it intermittently.
What are well-known, registered, and ephemeral ports?
0–1023 are well-known and on most systems require privilege to bind. 1024–49151 are registered to specific applications. 49152–65535 are ephemeral: the operating system picks one as the source port for each outbound connection. That is why a stateful firewall must allow return traffic to high ports it never explicitly permitted.
Which ports should never be open to the internet?
SMB (445), RDP (3389), Telnet (23), and unauthenticated database ports like Redis (6379) and MongoDB (27017) top the list — all are heavily scanned and have caused large-scale compromises. Management protocols such as SNMP (161), TFTP (69), and syslog (514) belong on a management network only.
Do OSPF and EIGRP use port numbers?
No. They run directly on IP as protocol numbers 89 and 88, without TCP or UDP, so there is no port to permit — an ACL must match the protocol instead. BGP is the exception among routing protocols: it rides on TCP port 179.
How do I check which ports are open on a host?
Locally, use ss -tulpn on Linux or netstat -ano on Windows to see what is listening. From another machine, a port scanner shows what is reachable — which is the number that actually matters, since a listening service behind a firewall is not exposed.
More free tools: MAC Address Lookup · MTU & MSS Calculator · DNS Record Types · All tools