Ports &
Port Numbers
A quick reference guide for network ports, protocols, and services — including well-known, registered, and dynamic port ranges with quiz and slideshow modes.
What are Ports?
A network port is a virtual communication endpoint that allows a computer to differentiate between different types of network traffic. While an IP address identifies a device on a network, the port number identifies a specific service or application on that device.
Ports are 16-bit unsigned integers ranging from 0 to 65535 and are used by transport-layer protocols TCP and UDP to route traffic to the correct process.
Why it matters: Firewalls use port numbers to allow or block specific traffic. Understanding ports is essential for network administration, security auditing, and penetration testing.
1. Well-Known Ports (0–1023)
Assigned by IANA and used by core system services. Require root/admin privileges to bind.
| Port | Protocol | Service | Description |
|---|---|---|---|
| 20 | TCP | FTP-Data | File Transfer Protocol — data transfer channel |
| 21 | TCP | FTP | File Transfer Protocol — control/command channel |
| 22 | TCP | SSH | Secure Shell — encrypted remote login and command execution |
| 23 | TCP | Telnet | Unencrypted remote terminal access (deprecated/insecure) |
| 25 | TCP | SMTP | Simple Mail Transfer Protocol — sending email |
| 53 | TCP/UDP | DNS | Domain Name System — resolves hostnames to IPs |
| 67 | UDP | DHCP Server | Dynamic Host Configuration Protocol — assigns IP addresses |
| 68 | UDP | DHCP Client | DHCP client receives configuration from server |
| 69 | UDP | TFTP | Trivial File Transfer Protocol — simple file transfers |
| 80 | TCP | HTTP | HyperText Transfer Protocol — unencrypted web traffic |
| 110 | TCP | POP3 | Post Office Protocol v3 — receive email from server |
| 119 | TCP | NNTP | Network News Transfer Protocol — Usenet newsgroups |
| 123 | UDP | NTP | Network Time Protocol — clock synchronisation |
| 135 | TCP | RPC | Microsoft Remote Procedure Call endpoint mapper |
| 137–139 | TCP/UDP | NetBIOS | NetBIOS Name / Datagram / Session services |
| 143 | TCP | IMAP | Internet Message Access Protocol — email access |
| 161 | UDP | SNMP | Simple Network Management Protocol — device monitoring |
| 162 | UDP | SNMP Trap | SNMP notifications sent from agent to manager |
| 179 | TCP | BGP | Border Gateway Protocol — inter-domain routing |
| 194 | TCP | IRC | Internet Relay Chat |
| 389 | TCP/UDP | LDAP | Lightweight Directory Access Protocol — directory services |
| 443 | TCP | HTTPS | HTTP over TLS/SSL — encrypted web traffic |
| 445 | TCP | SMB | Server Message Block — Windows file/printer sharing |
| 465 | TCP | SMTPS | SMTP over SSL — secure email submission |
| 514 | UDP | Syslog | System Logging Protocol — log collection |
| 587 | TCP | SMTP (TLS) | SMTP submission with STARTTLS — modern email sending |
| 636 | TCP | LDAPS | LDAP over SSL — secure directory queries |
| 993 | TCP | IMAPS | IMAP over TLS — secure email access |
| 995 | TCP | POP3S | POP3 over TLS — secure email retrieval |
2. Registered Ports (1024–49151)
Registered with IANA for specific services. Can be used by user processes without root privileges.
| Port | Protocol | Service | Description |
|---|---|---|---|
| 1080 | TCP | SOCKS | SOCKS proxy protocol — circuit-level gateway |
| 1194 | UDP | OpenVPN | OpenVPN tunnelling protocol |
| 1433 | TCP | MS SQL | Microsoft SQL Server database |
| 1521 | TCP | Oracle DB | Oracle Database listener |
| 1723 | TCP | PPTP | Point-to-Point Tunneling Protocol — legacy VPN |
| 3306 | TCP | MySQL | MySQL / MariaDB database server |
| 3389 | TCP/UDP | RDP | Remote Desktop Protocol — Windows remote access |
| 4444 | TCP | Metasploit | Default Metasploit reverse shell / meterpreter listener |
| 5432 | TCP | PostgreSQL | PostgreSQL database server |
| 5900 | TCP | VNC | Virtual Network Computing — remote desktop |
| 6379 | TCP | Redis | Redis in-memory data structure store |
| 8080 | TCP | HTTP-Alt | Alternative HTTP port — commonly used by web proxies |
| 8443 | TCP | HTTPS-Alt | Alternative HTTPS port — common in dev/test environments |
| 9200 | TCP | Elasticsearch | Elasticsearch REST API |
| 27017 | TCP | MongoDB | MongoDB NoSQL database default port |
3. Dynamic / Private Ports (49152–65535)
Assigned dynamically by the OS for ephemeral client-side connections. Not registered with IANA — used as source ports for outbound connections.
About Ephemeral Ports
When your browser connects to a website on port 443, your OS assigns a random ephemeral port (e.g. 54321) as the source port. The server responds to that ephemeral port. This is why you can have many simultaneous connections.
Linux default range: 32768–60999 | Windows default: 49152–65535
4. Security-Relevant Ports
Ports frequently targeted by attackers or commonly found in CTF challenges and penetration tests.
| Port | Service | Risk / Notes |
|---|---|---|
| 21 | FTP | Anonymous login, cleartext credentials — common target |
| 22 | SSH | Brute-force attacks; older versions have known vulns |
| 23 | Telnet | Cleartext protocol — should never be used; always insecure |
| 25 | SMTP | Open relay exploitation, phishing, spam distribution |
| 53 | DNS | DNS poisoning, zone transfer (AXFR), DNS tunnelling |
| 80/443 | HTTP/HTTPS | Web attacks: XSS, SQLi, IDOR, SSRF, XXE |
| 135 | RPC | MS03-026 (Blaster worm), used in DCOM attacks |
| 139/445 | SMB | EternalBlue (MS17-010), WannaCry, NotPetya |
| 3389 | RDP | BlueKeep (CVE-2019-0708), brute-force, ransomware delivery |
| 4444 | Metasploit | Common reverse shell listener — suspicious if open |
| 5900 | VNC | Weak/no auth — frequently exposed on the internet |
| 6667 | IRC | Botnet C2 communication historically used IRC |
5. Port Scanning Quick Reference
# Nmap — scan common ports nmap -sV 192.168.1.1 # version detection nmap -p 80,443,22 192.168.1.1 # specific ports nmap -p- 192.168.1.1 # all 65535 ports nmap --top-ports 1000 target # top 1000 common ports # Linux — view listening ports ss -tlnp # TCP listening ports netstat -tlnp # older alternative lsof -i :443 # process on port 443 # Windows — view listening ports netstat -ano # all connections with PID netstat -ano | findstr :443 # filter port 443