Port Reference
A searchable table of well-known ports — filter by number, service, or purpose.
Filter by port number, service name, or anything in the notes.
| port | proto | service | category | notes |
|---|
ports 101
What a port is
An IP address gets traffic to a machine; a port number (0-65535, separate spaces for TCP and UDP) gets it to the right program on that machine. A connection is fully named by the five-tuple: protocol, source IP and port, destination IP and port.
The three ranges
| range | name | meaning |
|---|---|---|
| 0–1023 | well-known | classic services; binding one requires root/Administrator |
| 1024–49151 | registered | vendor defaults live here (3306, 5432, 8080…) — registration is convention, not enforcement |
| 49152–65535 | ephemeral | what your OS grabs for the source side of outgoing connections |
Nothing stops anyone running SSH on 8080 or a web server on 22 — ports are convention. That cuts both ways: scanners assume the convention, and so does this table.
TCP vs UDP
TCP is a connection: ordered, acknowledged, retransmitted — web, mail, shells, databases. UDP is fire-and-forget datagrams — DNS queries, NTP, VoIP media, WireGuard — where a lost packet is better handled by the application (or ignored) than retransmitted late. Some services listen on both, and the same number means unrelated things in each space more often than you'd hope.
Seeing what's listening
| platform | command |
|---|---|
| Linux | ss -tulpn (or legacy netstat -tulpn) |
| Windows | netstat -abno or Get-NetTCPConnection -State Listen |
| macOS | lsof -i -P | grep LISTEN |
| anywhere | curl -v host:port / Test-NetConnection host -Port 443 to poke one |
Rules of thumb
- "Open" just means something answered. Whether it's patched, authenticated, and supposed to be reachable is the actual question.
- The legacy badge means it. Telnet (23), FTP (21), POP3 (110), and PPTP (1723) transmit credentials or use broken crypto — their TLS successors are in the table too.
- Databases and RDP don't belong on the internet. 3389, 5432, 3306, 6379, 27017, and 9200 exposed publicly are how breach write-ups begin.
- Check both protocols. A firewall rule for TCP 53 does nothing for the UDP 53 queries that carry almost all real DNS traffic.