Common Network Port Numbers — Complete Reference List

Last Updated: October 2026

What Are Network Ports?

A network port is a logical endpoint for communication on a networked device, identified by a 16-bit unsigned integer ranging from 0 to 65,535. While an IP address tells the network which computer should receive data, the port number tells the computer which application or service the data is intended for. Without ports, a computer running a web server, email server, and SSH daemon simultaneously would have no way to distinguish which incoming packets belong to which service.

Every network connection is defined by a five-tuple: source IP, source port, destination IP, destination port, and protocol (TCP or UDP). This combination uniquely identifies each connection, allowing thousands of simultaneous sessions on a single machine. When your browser connects to a website on port 443, your operating system assigns a random ephemeral port (say, 52847) as the source port, creating a unique connection path.

How Ports Work: TCP and UDP

Ports operate at the transport layer (Layer 4) of the OSI model and are used by two primary protocols:

TCP (Transmission Control Protocol)

TCP is connection-oriented. Before any data is exchanged, the client and server perform a three-way handshake: the client sends a SYN packet, the server responds with SYN-ACK, and the client confirms with ACK. This establishes a reliable session where every packet is acknowledged, ordered, and retransmitted if lost. TCP is used whenever data integrity is critical — web pages (HTTP/HTTPS), email (SMTP, IMAP, POP3), file transfer (FTP, SFTP), remote shell access (SSH), and database connections (MySQL, PostgreSQL) all run over TCP.

UDP (User Datagram Protocol)

UDP is connectionless. Data is sent in individual datagrams without establishing a session, and there are no acknowledgments or retransmissions. This makes UDP significantly faster and lower-overhead than TCP, but packets can arrive out of order, be duplicated, or be lost without notification. UDP is ideal for time-sensitive applications where a lost packet is preferable to a delayed one: DNS queries (port 53), video and audio streaming, online gaming, Voice over IP (VoIP on port 5060), DHCP (ports 67/68), SNMP (port 161), and TFTP (port 69).

A TCP port and a UDP port with the same number are separate endpoints. For example, DNS uses both port 53/TCP (for zone transfers and large responses) and port 53/UDP (for standard queries) simultaneously, and they operate independently.

Port Number Ranges

The Internet Assigned Numbers Authority (IANA) divides the 65,536 available port numbers into three official ranges, each with distinct purposes and administrative rules.

Well-Known Ports (0–1023)

These ports are reserved for the most fundamental and widely-used internet protocols. IANA assigns them to services that form the backbone of the internet. On Unix-like operating systems (Linux, macOS, BSD), binding a service to any port below 1024 requires root (superuser) privileges, which adds a layer of security — unprivileged users and rogue software cannot impersonate core services by listening on their well-known ports.

When you type a URL into your browser without specifying a port, the browser automatically connects to port 80 (HTTP) or port 443 (HTTPS). When you send an email, your mail client connects to port 587 (submission) or 465 (SMTPS). These default assignments are what make the internet seamless — you don't need to remember port numbers for everyday use because well-known port assignments handle it automatically.

Registered Ports (1024–49151)

These ports are assigned by IANA to specific applications and services upon request, but they do not require elevated operating system privileges to use. Software vendors register ports for their products so clients know which port to connect to by default. Common examples include MySQL (3306), PostgreSQL (5432), Microsoft SQL Server (1433), RDP (3389), and MongoDB (27017). While these assignments are documented in the IANA Service Name and Transport Protocol Port Number Registry, they are conventions rather than strict requirements — any application can listen on any registered port if it's not already in use.

Dynamic / Ephemeral Ports (49152–65535)

These ports are never assigned to specific services. They are used temporarily by client applications as source ports for outgoing connections. When your browser opens a connection to a web server on port 443, the operating system kernel assigns a random ephemeral port (e.g., 54321) as the local source port. Once the connection closes, the port is returned to the pool. Different operating systems use slightly different ephemeral ranges: Linux uses 32768–60999 by default, Windows uses 49152–65535, and BSD/macOS uses 49152–65535.

Comprehensive Port Number Reference

Below is a detailed reference table of the most important and commonly encountered network ports. For each port, we list the protocol (TCP, UDP, or both), the service it is assigned to, and practical notes about its usage and security implications.

Core Internet Ports

• Port 20/TCP — FTP Data Transfer: Carries the actual file data during an FTP session in active mode. The FTP client connects from a random port, and the server pushes data back from port 20. In passive mode, a random high port is used instead.
• Port 21/TCP — FTP Control: Handles FTP command and control messages (login, directory listing, file operations). Credentials are sent in plain text, making FTP insecure for anything sensitive. Use SFTP (port 22) or FTPS (port 990) instead.
• Port 22/TCP — SSH (Secure Shell): Provides encrypted remote terminal access, secure file transfer (SCP and SFTP), and port tunneling. SSH replaced Telnet as the standard for remote server administration. Always use key-based authentication and disable password login for production servers.
• Port 23/TCP — Telnet: Unencrypted remote access protocol. All data, including usernames and passwords, is transmitted in plain text. Telnet should never be used on untrusted networks — it exists today primarily for legacy device management and network equipment consoles.
• Port 25/TCP — SMTP (Simple Mail Transfer Protocol): The original port for email transmission between mail servers. Many ISPs block outbound port 25 to prevent spam. Modern email clients use port 587 (submission with STARTTLS) or port 465 (implicit TLS) instead.
• Port 53/TCP & UDP — DNS (Domain Name System): Resolves human-readable domain names (like example.com) into IP addresses. Standard queries use UDP for speed; zone transfers between DNS servers and responses larger than 512 bytes use TCP. DNS is a critical infrastructure service — if port 53 is blocked, virtually nothing on the internet works.
• Port 67/UDP — DHCP Server: Used by DHCP servers to send configuration data (IP address, subnet mask, gateway, DNS servers) to clients. The server listens on port 67 and responds to client requests on port 68.
• Port 68/UDP — DHCP Client: Used by DHCP clients to receive configuration data from the DHCP server. The client sends a broadcast DHCPDISCOVER from port 68, and the server responds on port 67.
• Port 69/UDP — TFTP (Trivial File Transfer Protocol): A simplified, unauthenticated file transfer protocol used primarily for network booting (PXE), firmware updates on network equipment, and VoIP phone provisioning. TFTP offers no encryption or authentication and should only be used on trusted, isolated networks.
• Port 80/TCP — HTTP (Hypertext Transfer Protocol): The standard port for unencrypted web traffic. Although most websites now redirect HTTP to HTTPS, port 80 remains essential for the initial redirect and for legacy applications. It carries a huge share of global internet traffic.
• Port 110/TCP — POP3 (Post Office Protocol v3): Used by email clients to download mail from a server. POP3 typically downloads and deletes messages from the server. The encrypted version, POP3S, uses port 995.
• Port 143/TCP — IMAP (Internet Message Access Protocol): A more advanced email retrieval protocol that synchronizes mail between the server and multiple clients. Unlike POP3, IMAP keeps messages on the server. The encrypted version, IMAPS, uses port 993.
• Port 443/TCP — HTTPS (HTTP over TLS): The standard port for encrypted web traffic. HTTPS uses TLS (Transport Layer Security) to encrypt data in transit, protecting against eavesdropping and tampering. Port 443 is now the most important port on the modern internet — virtually all web traffic should use it.

Email Ports

• Port 465/TCP — SMTPS (SMTP over Implicit TLS): Originally deprecated in favor of port 587, IANA re-assigned port 465 for email submission with implicit TLS encryption in 2018. Some email providers still use it as an alternative to port 587.
• Port 587/TCP — SMTP Submission: The modern standard port for email clients to submit outgoing mail to their mail server. Requires authentication and supports STARTTLS for encryption. This is the port you should configure in your email client for outgoing mail.
• Port 993/TCP — IMAPS: IMAP over implicit TLS. This is the secure version of IMAP and the recommended port for email clients retrieving mail via IMAP.
• Port 995/TCP — POP3S: POP3 over implicit TLS. The secure version of POP3 for clients that prefer downloading mail rather than syncing via IMAP.

Network Infrastructure Ports

• Port 123/UDP — NTP (Network Time Protocol): Synchronizes clocks across networked devices. Accurate time is critical for security (certificate validation, log correlation, Kerberos authentication). NTP has been exploited in amplification DDoS attacks.
• Port 161/UDP — SNMP (Simple Network Management Protocol): Used for monitoring and managing network devices (routers, switches, servers, printers). SNMP v1 and v2c transmit community strings (essentially passwords) in plain text. Always use SNMP v3, which supports authentication and encryption.
• Port 162/UDP — SNMP Trap: Used by network devices to send unsolicited alerts (traps) to a management station. Traps notify administrators of events like interface failures, high CPU usage, or environmental alarms.
• Port 389/TCP & UDP — LDAP (Lightweight Directory Access Protocol): Used to access and manage directory services like Microsoft Active Directory and OpenLDAP. LDAP carries authentication data and should always be secured with TLS (LDAPS on port 636) in production environments.
• Port 636/TCP — LDAPS (LDAP over TLS): The encrypted version of LDAP, providing secure directory access. Required in any environment where LDAP authentication data traverses untrusted networks.
• Port 514/UDP — Syslog: The traditional port for centralized log collection. Network devices, servers, and applications send log messages to a syslog server on this port. Modern deployments use syslog over TLS (port 6514) for encrypted log transport.

File Sharing and Remote Access Ports

• Port 137–139/TCP & UDP — NetBIOS: Used by older Windows networking for name resolution, datagram services, and session services. These ports should be blocked at the firewall on any internet-facing system as they are frequent targets for attacks.
• Port 445/TCP — SMB/CIFS (Server Message Block): Windows file and printer sharing. SMB runs directly over TCP on port 445 in modern Windows. This port has been the vector for major attacks including WannaCry and NotPetya ransomware. Never expose port 445 to the internet.
• Port 873/TCP — rsync: A fast, versatile file synchronization tool commonly used for backups and mirroring on Linux/Unix. The rsync daemon listens on port 873 for incoming sync requests.
• Port 3389/TCP — RDP (Remote Desktop Protocol): Microsoft's protocol for remote graphical desktop access to Windows machines. RDP is one of the most frequently attacked ports on the internet. Always protect RDP with a VPN, Network Level Authentication (NLA), strong passwords, and account lockout policies. Consider changing the default port or using an RDP gateway.
• Port 5900/TCP — VNC (Virtual Network Computing): A platform-independent remote desktop protocol. VNC has historically had weak encryption. Use SSH tunneling or a VPN to secure VNC connections.

Database Ports

• Port 1433/TCP — Microsoft SQL Server: The default port for SQL Server instances. The SQL Server Browser service on UDP port 1434 helps clients find named instances. Never expose SQL Server directly to the internet — use firewalls and VPNs.
• Port 1521/TCP — Oracle Database: The default listener port for Oracle Database instances. Like all database ports, it should be firewalled and accessible only from application servers that need it.
• Port 3306/TCP — MySQL / MariaDB: The default port for MySQL and its fork, MariaDB. By default, MySQL listens on all interfaces, which is a security risk. Configure bind-address to restrict access to localhost or specific IPs.
• Port 5432/TCP — PostgreSQL: The default port for PostgreSQL. Configure pg_hba.conf to restrict client connections by IP address and require SSL for remote connections.
• Port 6379/TCP — Redis: An in-memory data structure store used as a database, cache, and message broker. Redis has no authentication by default in many configurations — always set a strong password with requirepass and bind to localhost unless remote access is required.
• Port 27017/TCP — MongoDB: The default port for MongoDB. Historically, many MongoDB instances were exposed to the internet without authentication, leading to massive data breaches. Always enable authentication and bind to specific interfaces.

Web Development and Proxy Ports

• Port 8080/TCP — HTTP Alternate: Commonly used for development web servers, HTTP proxies (like Squid), and as an alternative when port 80 is already in use or when running without root privileges. Many web frameworks default to port 8080 during development.
• Port 8443/TCP — HTTPS Alternate: The TLS equivalent of port 8080. Used by development servers, application servers (like Apache Tomcat), and management interfaces that need HTTPS on a non-standard port.
• Port 3000/TCP — Development Servers: The default port for many web development frameworks including Node.js/Express, Ruby on Rails, React development server, and Grafana. Not an IANA-registered assignment — it's a community convention.
• Port 8888/TCP — HTTP Alternate / Jupyter: Used by Jupyter Notebook, alternative HTTP servers, and various development tools. Like port 3000, this is a common development convention rather than a formal assignment.

VoIP and Multimedia Ports

• Port 5060/TCP & UDP — SIP (Session Initiation Protocol): Used for setting up, maintaining, and tearing down voice and video calls in VoIP systems. The encrypted version (SIPS) uses port 5061.
• Port 5061/TCP — SIPS (SIP over TLS): The encrypted version of SIP, providing secure signaling for VoIP communications.
• Ports 16384–32767/UDP — RTP (Real-time Transport Protocol): Carries the actual audio and video media streams in VoIP and video conferencing. The exact port range varies by vendor and configuration.

Other Important Ports

• Port 179/TCP — BGP (Border Gateway Protocol): The protocol that exchanges routing information between autonomous systems on the internet. BGP is the backbone of internet routing — a BGP hijack can redirect traffic globally.
• Port 443/UDP — QUIC / HTTP/3: Google's QUIC protocol and the new HTTP/3 standard run over UDP port 443. QUIC provides multiplexed, encrypted connections with lower latency than TCP+TLS, and is already used by Chrome for many Google services.
• Port 500/UDP — IKE (Internet Key Exchange): Used to establish IPsec VPN tunnels. IKE negotiates the security associations and encryption keys used by IPsec. Often used alongside UDP port 4500 for NAT traversal.
• Port 1194/UDP — OpenVPN: The default port for the OpenVPN software. Many VPN providers use this port, though it can be configured to use any port and either TCP or UDP.
• Port 51820/UDP — WireGuard: The default port for WireGuard, a modern VPN protocol known for its simplicity and performance. WireGuard is now built into the Linux kernel and is gaining rapid adoption.

Security Implications of Open Ports

Every open port on a system is a potential entry point for attackers. Understanding the security implications of common ports is essential for anyone managing servers or networks.

Commonly Attacked Ports

Automated bots continuously scan the entire IPv4 address space looking for open instances of commonly exploited ports. The most targeted ports and their associated risks include:

• SSH (22): Brute-force password attacks are relentless. Mitigate with key-based authentication, fail2ban, and moving SSH to a non-standard port (does not add real security, but reduces automated noise).
• Telnet (23): Should never be exposed to the internet. All data is unencrypted. Many IoT devices still ship with Telnet enabled — the Mirai botnet exploited this vulnerability at massive scale.
• SMTP (25): Open SMTP relays are exploited to send spam. Ensure your mail server requires authentication and is not an open relay.
• DNS (53): Open DNS resolvers can be exploited for DNS amplification DDoS attacks and cache poisoning. Configure your resolver to only answer queries from authorized clients.
• SMB (445): The attack vector for WannaCry, NotPetya, and EternalBlue exploits. Block port 445 at your perimeter firewall without exception.
• RDP (3389): Brute-force and credential-stuffing attacks are constant. The BlueKeep vulnerability (CVE-2019-0708) allowed remote code execution on unpatched systems. Always protect RDP behind a VPN or gateway.
• MySQL (3306) and other database ports: Exposing database ports to the internet is one of the most dangerous misconfigurations. Databases should only be accessible from application servers on a private network.

Best Practices for Port Security

Securing your ports is a foundational element of network security. Follow these best practices to minimize your attack surface:

• Principle of least privilege: Only open ports that are actively needed. Block everything else with a default-deny firewall policy. If a service is only needed internally, bind it to 127.0.0.1 or a private interface.
• Regular port audits: Run nmap or ss against your systems periodically to identify unexpected open ports. Many compliance frameworks (PCI DSS, SOC 2, ISO 27001) mandate regular port scanning.
• Use encrypted alternatives: Replace Telnet with SSH, HTTP with HTTPS, FTP with SFTP, LDAP with LDAPS, SNMP v1/v2c with v3, and syslog with syslog over TLS.
• Keep software updated: Vulnerabilities in services listening on open ports are regularly discovered. Patch promptly to prevent exploitation.
• Network segmentation: Place databases, management interfaces, and internal services on separate VLANs that are not accessible from the internet. Use a DMZ for public-facing services.
• Monitoring and alerting: Log all connection attempts to critical ports and set up alerts for unusual patterns (e.g., a spike in SSH login failures or connections to unexpected ports).

How to Check If a Port Is Open

There are several ways to check whether a specific port is open and accepting connections, depending on whether you are checking your own machine or a remote host.

Checking Local Ports

• Windows: Open PowerShell and run netstat -ano | findstr LISTENING to see all listening ports and their process IDs. Use Get-Process -Id PID to identify the process.
• Linux: Run ss -tlnp to list all TCP listening ports with process names, or ss -ulnp for UDP. The lsof -i -P -n | grep LISTEN command provides similar output.
• macOS: Use lsof -i -P -n | grep LISTEN or netstat -an | grep LISTEN to view all listening ports.

Checking Remote Ports

• PowerShell: Test-NetConnection -ComputerName example.com -Port 443 tests a specific TCP port on a remote host and reports whether the connection succeeded.
• Netcat (nc): nc -zv example.com 443 tests a remote port with verbose output showing whether the connection was accepted or refused.
• nmap: nmap -p 80,443,22 example.com scans specific ports and reports their state (open, closed, or filtered).
• Online tools: Our Port Checker lets you test ports from an external perspective without installing anything, which is useful for verifying firewall rules and confirming that your services are reachable from the internet.

For a comprehensive walkthrough of port scanning techniques and tools, see our guide on how to check open ports.

Frequently Asked Questions

What is a network port number?

A network port number is a 16-bit integer (0–65535) that identifies a specific process or service on a networked device. While an IP address identifies a computer on the network, the port number identifies which application or service should receive the incoming data. Together, an IP address and port form a socket — the complete address for network communication.

What is the difference between TCP and UDP ports?

TCP ports are connection-oriented — they establish a reliable session using a three-way handshake and guarantee packet delivery and ordering. UDP ports are connectionless — they send data without a session and do not guarantee delivery. TCP is used for web browsing, email, and file transfer. UDP is used for DNS queries, streaming, gaming, and VoIP where speed matters more than guaranteed delivery.

How many port numbers are there?

There are 65,536 port numbers in total, ranging from 0 to 65,535. They are divided into three ranges: well-known ports (0–1023) assigned to common protocols by IANA, registered ports (1024–49151) assignable to specific applications, and dynamic or ephemeral ports (49152–65535) used temporarily by client applications for outbound connections.

What are the most commonly used port numbers?

The most commonly used ports include HTTP (80), HTTPS (443), FTP (21), SSH (22), Telnet (23), SMTP (25/587), DNS (53), DHCP (67/68), POP3 (110), IMAP (143), SNMP (161), LDAP (389), RDP (3389), MySQL (3306), and PostgreSQL (5432). Ports 80 and 443 carry the vast majority of internet traffic.

Which ports are most commonly attacked by hackers?

The most commonly attacked ports include SSH (22), FTP (21), Telnet (23), SMTP (25), DNS (53), HTTP (80), HTTPS (443), SMB/CIFS (445), RDP (3389), and MySQL (3306). These are targeted because they run widely deployed services that may have unpatched vulnerabilities or weak credentials.

How do I check if a specific port is open?

On Windows, use Test-NetConnection -ComputerName hostname -Port 80 in PowerShell. On Linux/macOS, use ss -tlnp to list listening TCP ports or nc -zv hostname 80 to test a specific remote port. You can also use our online Port Checker tool.

What is the difference between well-known and registered ports?

Well-known ports (0–1023) are assigned by IANA to fundamental internet protocols like HTTP, HTTPS, SSH, and DNS. On Unix-like systems, binding to these ports requires root privileges. Registered ports (1024–49151) are assigned upon request for specific applications like MySQL (3306) and RDP (3389) but do not require elevated privileges.

Should I close unused open ports?

Yes. Every open port is a potential attack surface. Close or firewall any port that does not need to be open. Use the principle of least privilege — only open the ports you actively need and block everything else. Regularly audit your open ports with tools like nmap or netstat and close any that are no longer required.