Common Ports Reference
What runs on port 3389, 445 or 5985: common TCP and UDP ports for web, mail, Windows, AD, databases and VPNs, with security notes.
The ports that come up when opening a firewall, reading a scan or troubleshooting a connection: what runs on each, TCP or UDP, and what to watch out for. Search by number or name. Port numbers and service names were checked against IANA's port number registry; ports that are widely used but assigned by IANA to something else are marked unofficial.
96 ports
| Port | Protocol | Service | What it's for | IANA name |
|---|---|---|---|---|
| 80 | TCP | HTTP | Unencrypted web traffic. Today mostly used to redirect to HTTPS and for ACME (Let's Encrypt) HTTP-01 validation. | http |
| 443 | TCP, UDP | HTTPS | Web over TLS. UDP 443 carries HTTP/3 (QUIC); if a firewall blocks it, browsers quietly fall back to TCP. | https |
| 8080 | TCP | HTTP alternate | The usual second HTTP port: proxies, Tomcat and other app servers, admin consoles. | http-alt |
| 8443 | TCP | HTTPS alternate | A common second HTTPS port for admin consoles and app servers (IANA formally assigns it to something else). | unofficial |
| 8000 | TCP | Development web servers | Python's http.server, Django and many dev servers default here. Unofficial. | unofficial |
| 3000 | TCP | Development web servers, Grafana | Node.js frameworks and Grafana default to 3000. Unofficial. | unofficial |
| 3128 | TCP | Squid proxy | Squid's default proxy port. Unofficial. | unofficial |
| 1080 | TCP | SOCKS proxy | SOCKS4/5 proxies, including ssh -D tunnels. | socks |
| Port | Protocol | Service | What it's for | IANA name |
|---|---|---|---|---|
| 25 | TCP | SMTP | Mail between servers. Most home and cloud networks block outbound 25 to stop spam; clients should submit on 587 or 465. | smtp |
Careful: An SMTP server open to the internet must not relay for strangers (an open relay). | ||||
| 587 | TCP | SMTP submission | Mail clients sending through their server, with a login, upgraded to TLS by STARTTLS. | submission |
| 465 | TCP | SMTP submission over TLS | Submission with TLS from the first byte. RFC 8314 prefers it to STARTTLS on 587. | submissions |
| 2525 | TCP | SMTP alternate | Offered by some mail services when 25 and 587 are blocked. Unofficial. | unofficial |
| 110 | TCP | POP3 | Downloads mail from a mailbox, unencrypted unless STARTTLS is used. Prefer 995. | pop3 |
| 995 | TCP | POP3 over TLS | POP3 encrypted from the start. | pop3s |
| 143 | TCP | IMAP | Mailbox access that keeps mail on the server, unencrypted unless STARTTLS is used. Prefer 993. | imap |
| 993 | TCP | IMAP over TLS | IMAP encrypted from the start. | imaps |
| Port | Protocol | Service | What it's for | IANA name |
|---|---|---|---|---|
| 21 | TCP | FTP (control) | Commands for FTP. Passive mode also needs a range of high data ports open. | ftp |
Careful: Sends passwords in clear text. Use SFTP (port 22) or FTPS instead. | ||||
| 20 | TCP | FTP (active data) | Data connections for active-mode FTP, opened from the server back to the client. | ftp-data |
| 990 | TCP | FTPS (implicit TLS) | FTP encrypted from the start. Explicit FTPS uses 21 with AUTH TLS instead. | ftps |
| 69 | UDP | TFTP | Trivial file transfer with no login: network boot (PXE) and switch or phone firmware. | tftp |
Careful: No authentication at all; keep it on the provisioning network. | ||||
| 445 | TCP | SMB (file sharing) | Windows file and printer sharing, also used by Samba, NAS boxes and many admin tools. | microsoft-ds |
Careful: Never open this to the internet; reach it over a VPN or from trusted networks only. Worms such as WannaCry spread through exposed SMB. | ||||
| 137 | UDP | NetBIOS name service | Legacy Windows name lookup on the local network. | netbios-ns |
| 138 | UDP | NetBIOS datagram | Legacy Windows browsing announcements. | netbios-dgm |
| 139 | TCP | NetBIOS session (SMB over NetBIOS) | SMB the old way; modern Windows uses 445 directly. | netbios-ssn |
Careful: Never open this to the internet; reach it over a VPN or from trusted networks only. | ||||
| 2049 | TCP, UDP | NFS | Unix and Linux network file systems. NFSv4 needs only 2049; v3 also uses rpcbind (111) and extra ports. | nfs |
| 111 | TCP, UDP | rpcbind / portmapper | Tells clients which port an RPC service (such as NFSv3) is on. | sunrpc |
Careful: Never open this to the internet; reach it over a VPN or from trusted networks only. | ||||
| 873 | TCP | rsync daemon | rsync's own server mode (rsync over SSH uses 22 instead). | rsync |
| 548 | TCP | AFP | Apple Filing Protocol, the old Mac file sharing; macOS now prefers SMB. | afpovertcp |
| Port | Protocol | Service | What it's for | IANA name |
|---|---|---|---|---|
| 22 | TCP | SSH, SFTP, SCP | Encrypted remote shell, file transfer and tunnelling. | ssh |
Careful: Exposed SSH sees constant password guessing: use keys and turn off password logins. | ||||
| 23 | TCP | Telnet | Unencrypted remote terminal, still found on old network gear. | telnet |
Careful: Everything, passwords included, crosses the network in clear text. Use SSH. | ||||
| 3389 | TCP, UDP | Remote Desktop (RDP) | Windows Remote Desktop; UDP 3389 improves performance over poor links. | ms-wbt-server |
Careful: Never open this to the internet; reach it over a VPN or from trusted networks only. Exposed RDP is one of the most common ways ransomware gets in; use a VPN or a Remote Desktop Gateway on 443. | ||||
| 5900 | TCP | VNC | Remote screen sharing (RFB protocol); further displays use 5901, 5902 and up. | rfb |
Careful: Never open this to the internet; reach it over a VPN or from trusted networks only. Many VNC servers have weak or no passwords. | ||||
| 5985 | TCP | WinRM over HTTP | PowerShell remoting and other WS-Management. The HTTP port still encrypts the session with Kerberos or NTLM. | wsman |
| 5986 | TCP | WinRM over HTTPS | PowerShell remoting over TLS, needed outside a domain or across untrusted networks. | wsmans |
| Port | Protocol | Service | What it's for | IANA name |
|---|---|---|---|---|
| 88 | TCP, UDP | Kerberos | Logon tickets in Active Directory and other Kerberos realms. | kerberos |
| 389 | TCP, UDP | LDAP | Directory queries (Active Directory, OpenLDAP). Simple binds on 389 send passwords in clear text unless signing or StartTLS is used. | ldap |
| 636 | TCP | LDAP over TLS (LDAPS) | LDAP encrypted from the start; needs a certificate on the server. | ldaps |
| 3268 | TCP | Global Catalog | Forest-wide Active Directory searches. | msft-gc |
| 3269 | TCP | Global Catalog over TLS | Global Catalog encrypted from the start. | msft-gc-ssl |
| 464 | TCP, UDP | Kerberos password change | Password changes and resets through Kerberos. | kpasswd |
| 1812 | UDP | RADIUS authentication | Wi-Fi (802.1X), VPN and network device logins checked against a RADIUS server such as Windows NPS. | radius |
| 1813 | UDP | RADIUS accounting | Session start and stop records for RADIUS clients. | radius-acct |
| 49 | TCP | TACACS+ | Network device administrator logins (Cisco and others). | tacacs |
What a domain controller and Windows servers listen on.
| Port | Protocol | Service | What it's for | IANA name |
|---|---|---|---|---|
| 135 | TCP | RPC endpoint mapper | Tells clients which dynamic port a Windows RPC service is on (WMI, DCOM, AD replication, many admin tools). | epmap |
Careful: Never open this to the internet; reach it over a VPN or from trusted networks only. | ||||
| 49152-65535 | TCP | Windows dynamic RPC ports | The range Windows hands out to RPC services after 135. Firewalls between clients and domain controllers need it open (or RPC restricted to fixed ports). | unofficial |
| 9389 | TCP | Active Directory Web Services | Used by the ActiveDirectory PowerShell module and Admin Center. | adws |
| 1433 | TCP | SQL Server | The default instance. Named instances use dynamic ports, found through 1434. | ms-sql-s |
Careful: Never open this to the internet; reach it over a VPN or from trusted networks only. | ||||
| 1434 | UDP | SQL Server Browser | Tells clients which port a named SQL Server instance is on. | ms-sql-m |
| 8530 | TCP | WSUS (HTTP) | Windows Server Update Services' default since Server 2012. Unofficial. | unofficial |
| 8531 | TCP | WSUS (HTTPS) | WSUS with TLS. Unofficial. | unofficial |
| 1688 | TCP | KMS activation | Key Management Service for volume activation of Windows and Office. Unofficial. | unofficial |
DNS, DHCP, time, SNMP, logging and VPNs.
| Port | Protocol | Service | What it's for | IANA name |
|---|---|---|---|---|
| 53 | TCP, UDP | DNS | Name lookups. Answers too big for UDP (DNSSEC, large TXT records) retry over TCP 53, so open both. | domain |
| 853 | TCP | DNS over TLS | Encrypted DNS (DoT), used by Android Private DNS and many resolvers. DNS over HTTPS uses 443. | domain-s |
| 67 | UDP | DHCP server | Where clients send DHCP requests (servers and relays listen here). | bootps |
| 68 | UDP | DHCP client | Where DHCP answers go. | bootpc |
| 546 | UDP | DHCPv6 client | Where DHCPv6 answers go. | dhcpv6-client |
| 547 | UDP | DHCPv6 server | Where DHCPv6 requests go. | dhcpv6-server |
| 123 | UDP | NTP | Time synchronisation. Kerberos fails when clocks drift more than five minutes, so domain members need it. | ntp |
| 161 | UDP | SNMP | Monitoring and managing network devices. | snmp |
Careful: SNMP v1 and v2c send the community string in clear text and are often left as "public"; use v3. | ||||
| 162 | UDP | SNMP traps | Alerts sent by devices to a monitoring server. | snmptrap |
| 514 | UDP | Syslog | Log messages from devices and Linux hosts, unencrypted. | syslog |
| 6514 | TCP | Syslog over TLS | Syslog encrypted (RFC 5425). | syslog-tls |
| 500 | UDP | IKE (IPsec VPN) | Sets up IPsec VPN tunnels. | isakmp |
| 4500 | UDP | IPsec NAT traversal | IPsec through NAT routers, needed by most VPN clients. | ipsec-nat-t |
| 1194 | UDP, TCP | OpenVPN | OpenVPN's default (UDP normally, TCP when UDP is blocked). | openvpn |
| 51820 | UDP | WireGuard | WireGuard's usual default; any port can be configured. Unofficial. | unofficial |
| 1701 | UDP | L2TP | L2TP VPNs, normally inside IPsec (with 500 and 4500). | l2f |
| 1723 | TCP | PPTP | Old Microsoft VPN protocol. | pptp |
Careful: PPTP's encryption is broken; replace it with IKEv2, SSTP, OpenVPN or WireGuard. | ||||
| 179 | TCP | BGP | Routing between networks (ISPs, data centres, cloud interconnects). | bgp |
| Port | Protocol | Service | What it's for | IANA name |
|---|---|---|---|---|
| 3306 | TCP | MySQL, MariaDB | Default database port. | mysql |
Careful: Never open this to the internet; reach it over a VPN or from trusted networks only. | ||||
| 5432 | TCP | PostgreSQL | Default database port. | postgresql |
Careful: Never open this to the internet; reach it over a VPN or from trusted networks only. | ||||
| 1521 | TCP | Oracle Database listener | Oracle's default listener port (IANA assigns 1521 to something else). | unofficial |
Careful: Never open this to the internet; reach it over a VPN or from trusted networks only. | ||||
| 27017 | TCP | MongoDB | Default database port. | mongodb |
Careful: Never open this to the internet; reach it over a VPN or from trusted networks only. Thousands of unprotected MongoDB servers have been wiped or held for ransom. | ||||
| 6379 | TCP | Redis | In-memory database and cache. | redis |
Careful: Never open this to the internet; reach it over a VPN or from trusted networks only. Redis trusts whoever can reach it unless a password and protected mode are set. | ||||
| 11211 | TCP, UDP | Memcached | Cache server. | memcache |
Careful: Never open this to the internet; reach it over a VPN or from trusted networks only. Exposed memcached over UDP has been used for huge reflection DDoS attacks. | ||||
| 9200 | TCP | Elasticsearch, OpenSearch | REST API; 9300 is node-to-node traffic. Unofficial. | unofficial |
Careful: Never open this to the internet; reach it over a VPN or from trusted networks only. | ||||
| 5984 | TCP | CouchDB | HTTP API. | couchdb |
Careful: Never open this to the internet; reach it over a VPN or from trusted networks only. | ||||
| Port | Protocol | Service | What it's for | IANA name |
|---|---|---|---|---|
| 5060 | UDP, TCP | SIP | VoIP call signalling; the audio itself (RTP) uses a range of high UDP ports. | sip |
Careful: Exposed SIP is scanned constantly for weak extensions to run up toll-fraud calls. | ||||
| 5061 | TCP | SIP over TLS | Encrypted SIP signalling. | sips |
| 1883 | TCP | MQTT | Lightweight messaging for IoT devices, unencrypted. | mqtt |
| 8883 | TCP | MQTT over TLS | MQTT encrypted. | secure-mqtt |
| 5672 | TCP | AMQP (RabbitMQ) | Message queues; RabbitMQ's management web UI uses 15672. | amqp |
| 9092 | TCP | Kafka | Kafka brokers. Unofficial. | unofficial |
| 5222 | TCP | XMPP client | Jabber/XMPP chat clients. | xmpp-client |
| Port | Protocol | Service | What it's for | IANA name |
|---|---|---|---|---|
| 631 | TCP | IPP (printing) | Internet Printing Protocol, used by CUPS, AirPrint and modern Windows printing. | ipp |
| 9100 | TCP | Raw printing (JetDirect) | Sends print jobs straight to a printer (HP's PDL data stream). Prometheus node_exporter also defaults to 9100, unofficially. | hp-pdl-datastr |
| 515 | TCP | LPD (printing) | Old Unix line-printer protocol. | printer |
| 9090 | TCP | Prometheus, Cockpit | Prometheus and Cockpit (Linux web console) default here. Unofficial. | unofficial |
| 10050 | TCP | Zabbix agent | Zabbix server polling its agents. | zabbix-agent |
| 10051 | TCP | Zabbix trapper | Agents and proxies sending data to the Zabbix server. | zabbix-trapper |
| 2375 | TCP | Docker API (no TLS) | The Docker daemon's unencrypted remote API. | docker |
Careful: Anyone who can reach it controls the host as root. Don't expose it; use 2376 with TLS client certificates or SSH. | ||||
| 2376 | TCP | Docker API (TLS) | The Docker daemon's remote API with TLS. | docker-s |
| 6443 | TCP | Kubernetes API server | kubectl and cluster components talk to the control plane here. Unofficial. | unofficial |
| 10250 | TCP | Kubernetes kubelet | The node agent's API. Unofficial. | unofficial |
Careful: An unauthenticated kubelet API lets anyone run commands in pods; keep it locked down. | ||||
| 8006 | TCP | Proxmox VE web interface | Proxmox's management console. Unofficial. | unofficial |
| 902 | TCP | VMware ESXi (remote console) | vSphere clients and the VM console connect to hosts here; IANA lists the number under another name. | ideafarm-door |