Common network ports cheat sheet
TCP and UDP ports fall into three IANA-defined ranges: well-known ports 0–1023 (system services such as 22 SSH and 443 HTTPS), registered ports 1024–49151 (application services such as 3306 MySQL), and dynamic/ephemeral ports 49152–65535 (outbound client connections). Every row below is checked against the IANA registry — use this page to look up which service goes with which port, or to check what a port is actually serving.
The three port ranges
Every TCP or UDP connection needs two ends: an address and a port. The port tells the stack which service the payload belongs to, and IANA keeps the registry that settles what a well-known number means. Three ranges come out of RFC 6335:
- Well-known ports 0-1023 — the classic services: 21 FTP, 22 SSH, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS.
- Registered ports 1024-49151 — published app-specific ports: 3306 MySQL, 5432 PostgreSQL, 8080 HTTP-alt.
- Dynamic / private range 49152-65535 — ephemeral ports the OS picks for outbound connections; nothing binds a static service here permanently.
The table
Use the filter to skip everything you don't care about: type mysql, tls or k8s to see only matching rows.
| Port | TCP/UDP | Service (IANA name where registered) | Uses |
|---|---|---|---|
| 20 | TCP | ftp-data | FTP data transfer — the control connection is port 21 |
| 21 | TCP | ftp | FTP control — authentication and commands |
| 22 | TCP/UDP | ssh | Secure Shell: remote shell, SFTP, SCP. IANA registers the UDP side too |
| 23 | TCP/UDP | telnet | Telnet — plaintext remote terminal; use SSH across the internet |
| 25 | TCP | smtp | SMTP mail transfer between servers |
| 53 | TCP/UDP | domain (DNS) | DNS name resolution; TCP 53 also carries zone transfers |
| 67-68 | UDP | bootps / bootpc | DHCP server (BOOTP server) and client — the server listens on 67, clients reply from 68 |
| 69 | UDP | tftp | Trivial File Transfer — no authentication; LAN imaging and firmware only |
| 80 | TCP | http | World Wide Web HTTP — the default cleartext web port |
| 88 | TCP/UDP | kerberos | Kerberos tickets — authentication in an AD domain |
| 110 | TCP | pop3 | POP3 mail retrieval |
| 111 | TCP/UDP | sunrpc | rpcbind/portmapper — RPC services register here; the legacy RPC-mode rsync used it |
| 123 | TCP/UDP | ntp | Network Time Protocol |
| 135 | TCP/UDP | epmap | DCE endpoint mapper — the handshake behind Windows WMI and DCOM remoting |
| 137-139 | TCP/UDP | netbios-ns / -dgm / -ssn | NetBIOS name, datagram and session — legacy Windows sharing, superseded by SMB on 445 |
| 143 | TCP | imap | IMAP mail retrieval with server-side folders |
| 161-162 | UDP | snmp / snmptrap | SNMP polling (161) and the traps devices push here (162) |
| 179 | TCP | bgp | BGP routing between networks |
| 194 | TCP | irc | Internet Relay Chat |
| 389 | TCP/UDP | ldap | LDAP directory queries; LDAP over TLS is 636 |
| 443 | TCP/UDP | https | HTTPS — the port web clients hit by default; also HTTP/2 and other tunnels |
| 445 | TCP/UDP | microsoft-ds | SMB direct — modern Windows file sharing, AD SYSVOL and netlogon |
| 465 | TCP | submissions (SMTPS) | SMTP over TLS — the registry renamed the service SMTPS to submissions |
| 514 | UDP | syslog | Syslog transport (UDP). TCP 514 is an IANA-registered RSH shell service — check before assuming |
| 515 | TCP | printer | LPD / LPR line-printer daemon |
| 548 | TCP | afpovertcp | AFP over TCP — Apple file sharing, Time Machine targets |
| 587 | TCP | submission | Mail submission — where authenticated mail clients hand mail to their server |
| 631 | TCP/UDP | ipp | IPP printing — CUPS and AirPrint |
| 636 | TCP/UDP | ldaps | LDAP over TLS |
| 873 | TCP | rsync | rsync daemon for rsync:// transfers; rsync over SSH still uses 22 |
| 9418 | TCP | git | git:// pack-transfer service |
| 989-990 | TCP | ftps-data / ftps | FTPS — FTP with TLS on the data and control channels |
| 992, 993, 995 | TCP | telnets / imaps / pop3s | Telnet, IMAP and POP3 wrapped in TLS |
| 1022 | TCP | exp2 | Convenient SSH alternate port for dual-stack or restricted setups (common use, not IANA) |
| 1433 | TCP | ms-sql-s | Microsoft SQL Server |
| 1521 | TCP | ncube-lm | Oracle Database listener (common use, not IANA) |
| 2049 | TCP/UDP | nfs | NFS file sharing |
| 2181 | TCP | eforward | Apache ZooKeeper clients (common use, not IANA) |
| 2375-2376 | TCP | docker / docker-s | Docker daemon HTTP API, plaintext and TLS — both IANA-registered; never expose plaintext |
| 3000 | TCP | hbci | Dev servers, Grafana, Node apps (common use, not IANA) |
| 3128 | TCP | ndl-aas | Squid proxy (common use, not IANA) |
| 3306 | TCP | mysql | MySQL |
| 3389 | TCP/UDP | ms-wbt-server | Remote Desktop (RDP) |
| 4369 | TCP | epmd | Erlang port mapper — RabbitMQ cluster peer discovery |
| 5432 | TCP | postgresql | PostgreSQL |
| 5601 | TCP | esmagent | Kibana dashboard (common use, not IANA) |
| 5671 | TCP | amqps | AMQP over TLS — RabbitMQ and other brokers |
| 5672 | TCP | amqp | AMQP — plaintext broker protocol |
| 5900 | TCP | rfb | VNC — IANA registers the protocol name (Remote Framebuffer), which is what VNC uses |
| 5985-5986 | TCP | wsman / wsmans | WinRM over HTTP (5985) and HTTPS (5986) — PowerShell remoting |
| 6379 | TCP | redis | Redis — IANA-registered; not bound to localhost by default, so firewall it or set requirepass/ACLs |
| 6443 | TCP | sun-sr-https | Kubernetes API server (common use, not IANA) |
| 8080-8443 | TCP | http-alt / pcsync-https | HTTP and HTTPS on alternate ports — proxies, app consoles, dev containers; 8443 also carries the k8s node listeners |
| 8500 | TCP | fmtp | Consul server RPC and HTTP UI (common use, not IANA) |
| 9000 | TCP | cslistener | PHP-FPM, SonarQube, Portainer and friends (common use, not IANA) |
| 9090 | TCP | websm | Prometheus web UI (common use, not IANA) |
| 9092 | TCP | XmlIpcRegSvc | Kafka broker (common use, not IANA) |
| 9200-9300 | TCP | wap-wsp / vrace | Elasticsearch HTTP API (9200) and node-to-node transport (9300) (common use, not IANA) |
| 11211 | TCP/UDP | memcache | Memcached — authless by default; never cross a firewall |
| 15672 | TCP | not registered | RabbitMQ management UI (common use, not IANA) |
| 27017 | TCP | mongodb | MongoDB — IANA-registered |
| 5000 | TCP | commplex-main | Local Docker registry for image pushes (common use, not IANA) |
How to check what a port is actually serving
netstat -ano | findstr :443
tasklist /fi "PID eq 5688"
# PowerShell equivalents
Get-NetTCPConnection -LocalPort 443 | Select-Object LocalAddress, LocalPort, State, OwningProcess
Get-Process -Id 5688For every listener you see, the State column says what it is: Listen is a service accepting new connections, Established is a live session, TimeWait is a just-closed connection. TimeWait is normal after a burst of short connections, but it is never the state you firewall against.
CAP_NET_BIND_SERVICE, so an unprivileged service such as a PHP-FPM pool or a Node app picks a registered-range or dynamic port. On Windows no special right is needed to bind a low port, which is why so many dev services sit on 8080 instead of 80. Reading the table is a different matter: a port is an identifier, not a policy — the port number never makes the traffic secure, only the service and its controls do.FAQ
What is a well-known port?
A port in the IANA well-known range (0-1023). IANA assigns each number to a service — 80 HTTP, 443 HTTPS, 25 SMTP — and the assignment is what lets clients know what they are talking to without prior configuration. The registered range (1024-49151) holds app-specific services, and 49152-65535 is the dynamic range the OS hands out to outbound connections. That classification came from RFC 6335.
Why is port 443 HTTPS?
Because IANA registered it that way: 'https' is the officially reserved name for HTTP over TLS/SSL on 443. Browsers use it by default when you type https://, and it has grown beyond web pages — HTTP/2, WebSockets and APIs all route through it, which makes it the only port most modern deployments have to open.
Is port 9000 secure?
The number is not the security boundary. IANA has no 'PHP-FPM' entry on 9000 — it is assigned to cslistener — so any app can use the port, and what matters is which service listens there and how you filter it. Check the actual service with netstat or Get-NetTCPConnection, restrict with firewall rules that match the service, and never treat a famous port number as authentication.
How do I find which process is using a port?
In cmd: netstat -ano | findstr :443, then tasklist /fi "PID eq <pid>". In PowerShell: Get-NetTCPConnection -LocalPort 443 | Select-Object State, OwningProcess, then Get-Process -Id <pid>. Watch the transport when checking: UDP 514 is syslog, while TCP 514 is a registered RSH shell protocol — the same number, two different services.
Related
- IPv4 subnet calculator — network, broadcast and host range for any CIDR block.
- PowerShell one-liners — the Get-NetTCPConnection check above with the other daily commands.
- Windows command line — the netstat / Get-NetTCPConnection pairs in cmd.exe form.