Common ports and what uses them

A port number tells a machine which program an incoming connection is for. The assignments below come from the IANA registry and from long-standing convention. Two things are worth knowing before you use the table:

• A port is a convention, not a guarantee. Any service can listen on any port. Traffic on 443 is usually HTTPS, but nothing forces it to be.
• This page does not scan anything. It is a table to look things up in. Probing ports on machines you do not administer is, in many places, an offence regardless of intent.

The ports

“Never expose” means never reachable from the whole internet. Remote access to these belongs behind a VPN, where only people who can already authenticate can reach the port at all.

The three ranges

• 0–1023, well-known. Assigned to core services. On most systems only an administrator can open one.
• 1024–49151, registered. Assigned to specific applications on request.
• 49152–65535, dynamic. Used for the local end of outgoing connections. Operating systems pick their own range here — Linux, for example, defaults to 32768–60999 — so a high port in a connection log is usually just the client side.

What is listening on your own machine

These list the ports your computer is accepting connections on. Run them on machines you administer:

lsof -iTCP -sTCP:LISTEN -n -P       # macOS and Linux
ss -tlnp                            # Linux
netstat -ano | findstr LISTENING    # Windows

A port bound to 127.0.0.1 or ::1 is only reachable from the machine itself. One bound to 0.0.0.0 or :: accepts connections on every network interface, which is what to check first if something is reachable that should not be.

More commands like these, with what to look for in each, are on the local checks page.