跳到主要内容
MyIPKit— 读懂你的网络。

Common ports and what uses them

A reference table of the TCP and UDP ports you will meet in firewall rules, logs and error messages — with the ones that should never face the internet marked.

Updated 2026年9月25日4 min read

Information:

Shown in English

This guide has not been translated into your language yet, so you are reading the English original. The rest of the site stays in the language you chose.
Warning:

Before you run anything

These guides are reference material, not instructions for your particular network. Run commands only against networks you own or have explicit permission to examine — in many countries probing a network you are not authorised to touch is a criminal offence regardless of intent. Everything here is provided without warranty: you are responsible for what you run and for its effect on your systems.

A port number tells a machine which program an incoming connection is for. The assignments below come from the IANA registry and from long-standing convention. Two things are worth knowing before you use the table:

  • A port is a convention, not a guarantee. Any service can listen on any port. Traffic on 443 is usually HTTPS, but nothing forces it to be.
  • This page does not scan anything. It is a table to look things up in. Probing ports on machines you do not administer is, in many places, an offence regardless of intent.

The ports

Port Transport Service Notes
20, 21 TCP FTP Unencrypted. Prefer SFTP (22).
22 TCP SSH, SFTP Remote shell and file transfer.
23 TCP Telnet Unencrypted. Never expose.
25 TCP SMTP (server to server) Often blocked outbound on home connections.
53 UDP, TCP DNS TCP for large answers and zone transfers.
67, 68 UDP DHCP 67 is the server, 68 the client.
69 UDP TFTP Network booting and device firmware.
80 TCP HTTP
110 TCP POP3 Unencrypted form. See 995.
123 UDP NTP Time synchronisation.
137–139 UDP, TCP NetBIOS Legacy Windows networking. Never expose.
143 TCP IMAP Unencrypted form. See 993.
161, 162 UDP SNMP Device monitoring; 162 receives traps.
389 TCP LDAP Directory services. See 636.
443 TCP, UDP HTTPS UDP is HTTP/3 over QUIC.
445 TCP SMB Windows file sharing. Never expose.
465 TCP SMTP submission, implicit TLS Sending mail from a client.
514 UDP Syslog Log collection.
587 TCP SMTP submission, STARTTLS What most mail clients use to send.
636 TCP LDAPS LDAP over TLS.
853 TCP DNS over TLS
993 TCP IMAPS IMAP over TLS.
995 TCP POP3S POP3 over TLS.
1194 UDP OpenVPN Default; configurable.
1433 TCP Microsoft SQL Server Never expose.
1812, 1813 UDP RADIUS Network authentication and accounting.
1900 UDP SSDP / UPnP Device discovery. Never expose.
3306 TCP MySQL, MariaDB Never expose.
3389 TCP Remote Desktop (RDP) Heavily attacked. Never expose directly.
5060, 5061 UDP, TCP SIP VoIP signalling; 5061 is over TLS.
5353 UDP mDNS (Bonjour) Local name discovery.
5432 TCP PostgreSQL Never expose.
5900 TCP VNC Remote screen. Never expose directly.
6379 TCP Redis Never expose.
8080 TCP Alternate HTTP Convention for proxies and development servers.
8443 TCP Alternate HTTPS Convention, often admin interfaces.
27017 TCP MongoDB Never expose.
51820 UDP WireGuard Default; configurable.

“Never expose” means never reachable from the whole internet. Remote access to these belongs behind a VPN, where only people who can already authenticate can reach the port at all.

The three ranges

  • 0–1023, well-known. Assigned to core services. On most systems only an administrator can open one.
  • 1024–49151, registered. Assigned to specific applications on request.
  • 49152–65535, dynamic. Used for the local end of outgoing connections. Operating systems pick their own range here — Linux, for example, defaults to 32768–60999 — so a high port in a connection log is usually just the client side.

What is listening on your own machine

These list the ports your computer is accepting connections on. Run them on machines you administer:

lsof -iTCP -sTCP:LISTEN -n -P       # macOS and Linux
ss -tlnp                            # Linux
netstat -ano | findstr LISTENING    # Windows

A port bound to 127.0.0.1 or ::1 is only reachable from the machine itself. One bound to 0.0.0.0 or :: accepts connections on every network interface, which is what to check first if something is reachable that should not be.

More commands like these, with what to look for in each, are on the local checks page.

Related

All guides