Common Ports Cheat Sheet: What Runs on Each Number

A port number is the last step in delivering data. An IP address gets a packet to the right machine; the port number tells that machine which listening program the packet belongs to. Which is why a bare number in a firewall log or a scan result is often the most informative thing on the line: 3306 says database, 5900 says someone left a remote desktop open, 25 says mail server.

There are 65,535 usable port numbers on TCP and the same again on UDP. The ones you meet in practice number in the dozens, and this is the table for those. Underneath it are the parts a table cannot tell you on its own: why the same number appears on two transports, where the official registry stops matching the real internet, and which numbers deserve a second look when they turn up on a public host.

The three ranges#

IANA splits the whole space into three bands, defined in RFC 6335. Each band has two names, because the older ones never quite went away.

• System Ports, 0 to 1023, still widely called well-known ports. Assignments here go through IETF review or IESG approval, and on Unix-like systems binding one has traditionally required root privileges.
• User Ports, 1024 to 49151, also called registered ports. Anyone can apply for one. Most database and application defaults live in this band.
• Dynamic Ports, 49152 to 65535, also called private or ephemeral ports. IANA assigns nothing here, deliberately, because this is the pool your own machine draws from.

The bands describe who controls a number, not how much traffic it carries. Plenty of heavily used services sit in the User range, and a fair number of System ports have been dormant for twenty years.

The cheat sheet#

Grouped by band, with the transport each service actually runs on and the IANA service name where one is registered:

Transport column shows what the service is used on in practice, not every transport the number is registered for.

Why one number can mean two things#

TCP and UDP keep separate port spaces. Port 443 on TCP and port 443 on UDP are two different endpoints, and a host can listen on one, the other, or both. That is not a quirk of this table; it is how the registry is structured.

It used to be less clean. For most of the registry's history, a request for a TCP port got the matching UDP port assigned alongside it automatically. That is why dozens of numbers carry a formal UDP assignment for a service that has never spoken UDP in its life. Port 22 has a UDP registration; SSH has never used it. RFC 6335 ended the practice, and IANA now assigns only the transports an applicant explicitly asks for, leaving the others marked as reserved.

The consequence matters when you are reading a scan. A UDP listener on a number you associate with TCP is not automatically "the same service, on UDP". Sometimes it genuinely is, as with DNS on port 53 or SIP on 5060. Sometimes it is a completely different protocol: 514 over TCP is the old rsh remote shell, while 514 over UDP is syslog. Our port lookup gives one page per number with a row per registered service and its transport, so both sides are visible together. TCP vs UDP covers why the two transports behave so differently in the first place.

Where the registry and reality part ways#

Three kinds of mismatch turn up constantly, and each one will eventually confuse you.

Squatting that won. Port 1521 is the Oracle listener to every database administrator alive. In the registry it is ncube-lm, the nCube License Manager, assigned to a company that no longer exists. Oracle's own registered port is 2483, listed as ttc and described plainly as "Oracle TTC", and almost nobody uses it. IANA notes unauthorised use against 1521 and leaves it there.

Names that outlived their software. Elasticsearch answers on 9200, registered as wap-wsp for a Wireless Application Protocol service. Jupyter lands on 8888, registered as ddi-tcp-1 for a 1990s news product. Prometheus and Cockpit both take 9090, registered as websm for an IBM management console.

Pure convention. Nothing in the registry explains how 3000 became the default for Node and Rails development servers, or 8080 for an application server behind a proxy. Those are habits that hardened into defaults.

None of this makes the registry useless. It is the reason a number means anything stable at all. It just means the registered name answers "who asked for this number", not "what is listening on it right now".

The mail ports, in order#

Mail has more ports on this list than anything else, and the standard advice about them has changed. Worth getting straight:

• Port 25 is for relay between mail servers, and only that. Most consumer networks block outbound 25 entirely to slow down spam.
• Port 587 is submission: your mail client handing a message to your own provider. The connection starts in cleartext and upgrades with STARTTLS.
• Port 465 does the same submission job over implicit TLS, encrypted from the first byte.

The history behind 465 explains why it confuses people. It was briefly registered as smtps, a name RFC 8314 says made no sense, since relay always happens on 25. That registration was revoked and the number reassigned to something else. Mail software had already read smtps as "submission with TLS" and deployed 465 for it everywhere, so RFC 8314 re-registered the port as submissions to match what was actually running. The same document recommends supporting both 587 and 465 through a transition period, and prefers implicit TLS going forward on the grounds that it is simpler to implement, debug, and deploy than negotiating an upgrade mid-connection.

Retrieval is tidier: 143 and 993 are IMAP in cleartext and implicit TLS, 110 and 995 the same split for POP3. If you are checking whether a domain's mail setup hangs together rather than which port to use, SPF, DKIM, and DMARC explained covers the authentication half, and the domain health report runs the record checks in one pass.

Numbers worth a second look on a public host#

Some ports are unremarkable inside a network and alarming on a public IP. The pattern is nearly always a service designed to sit behind a firewall, which assumes anything that can reach it is already trusted.

• 445 and 139. Windows file sharing reachable from the internet. This is the surface WannaCry and its relatives travelled across.
• 3389. Remote Desktop exposed directly, rather than behind a VPN or gateway, is a standing target for credential stuffing.
• 6379 and 11211. Redis and Memcached both shipped historically with no authentication and a broad bind address. Memcached's UDP side drove the record reflection attacks of 2018; version 1.5.6 disabled UDP by default in response, and anyone upgrading past it has to turn it back on explicitly with -U 11211.
• 5900. VNC, frequently found with a weak password or none at all.
• 1433, 3306, 5432. SQL Server, MySQL, PostgreSQL. A database should not be answering the open internet.
• 23 and 161. Telnet and SNMP both carry credentials or community strings in cleartext. Telnet has no business on a modern network, and SNMP v1 and v2c are barely better.

An open port is not a vulnerability by itself. It is a listening program, and the real questions are what that program is and who can reach it. What open ports reveal about any IP works through that distinction, and IOC enrichment is the faster route when you want the operator and hosting context behind an address at the same time.

Where the high numbers come from#

If you have watched a connection table, you have seen source ports in the 40,000s and 50,000s and possibly wondered who assigned them. Nobody did. When your machine opens an outbound connection it needs a local port to receive the replies on, so it picks one from the dynamic range. That is an ephemeral port: temporary, arbitrary, and released when the connection closes.

The exact window an operating system draws from varies by platform and is usually tunable, which is why the numbers differ between a Linux box and a Windows one. The practical takeaway is that in a packet capture the informative number is the destination port on the way out and the source port on the way back. The high random one is bookkeeping, and looking it up will tell you nothing.

Looking up an unfamiliar number#

A table this size covers the numbers you meet often, which is a different set from the numbers you will one day need to identify. For anything not listed here, our port lookup takes a number and returns the registered service name, the transports it is assigned on, how often scanners find it open, the related ports worth checking next, and the security context where there is one worth giving. Entries are researched individually rather than dumped from the registry file, so the notes describe what a port is used for now rather than what someone registered for it in 1994.

For the pair you will meet more than any other, port 80 vs port 443 goes further into the HTTP and HTTPS split, including why an unencrypted listener on 80 is still normal on sites that redirect everything to 443.