# Common Network Ports Cheat Sheet (TCP/UDP)

> Common TCP and UDP ports cheat sheet: SSH, HTTP/HTTPS, DNS, mail, SMB, databases, WinRM and dev tools with IANA service names and quick check commands.

- Page URL: https://itinsighthub.com/common-ports/
- Markdown variant of this page: append `?format=md` to any URL on this site or send `Accept: text/markdown`.
- Full site index for AI assistants: https://itinsighthub.com/llms.txt
- Full site export: https://itinsighthub.com/llms-full.txt

# Common network ports cheat sheet

TCP and UDP ports fall into three IANA-defined ranges: **well-known ports 0–1023** (system services such as 22 SSH and 443 HTTPS), **registered ports 1024–49151** (application services such as 3306 MySQL), and **dynamic/ephemeral ports 49152–65535** (outbound client connections). Every row below is checked against the IANA registry — use this page to look up which service goes with which port, or to check what a port is actually serving.

Published August 22, 2026

## The three port ranges

Every TCP or UDP connection needs two ends: an address and a port. The port tells the stack which *service* the payload belongs to, and IANA keeps the registry that settles what a well-known number means. Three ranges come out of RFC 6335:

- **Well-known ports 0-1023** — the classic services: 21 FTP, 22 SSH, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS.
- **Registered ports 1024-49151** — published app-specific ports: 3306 MySQL, 5432 PostgreSQL, 8080 HTTP-alt.
- **Dynamic / private range 49152-65535** — ephemeral ports the OS picks for outbound connections; nothing binds a static service here permanently.

Sources: the [IANA service name and port number registry](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml) and [RFC 6335](https://datatracker.ietf.org/doc/html/rfc6335), which defines how ports are assigned today.

## The table

Use the filter to skip everything you don't care about: type `mysql`, `tls` or `k8s` to see only matching rows.

*Stacked from the IANA registry: the registered service name where one exists, and the software that actually owns the port in real networks. Rows marked "common use, not IANA" are conventions, not registrations.*

| Port | TCP/UDP | Service (IANA name where registered) | Uses |
| --- | --- | --- | --- |
| 20 | TCP | ftp-data | FTP data transfer — the control connection is port 21 |
| 21 | TCP | ftp | FTP control — authentication and commands |
| 22 | TCP/UDP | ssh | Secure Shell: remote shell, SFTP, SCP. IANA registers the UDP side too |
| 23 | TCP/UDP | telnet | Telnet — plaintext remote terminal; use SSH across the internet |
| 25 | TCP | smtp | SMTP mail transfer between servers |
| 53 | TCP/UDP | domain (DNS) | DNS name resolution; TCP 53 also carries zone transfers |
| 67-68 | UDP | bootps / bootpc | DHCP server (BOOTP server) and client — the server listens on 67, clients reply from 68 |
| 69 | UDP | tftp | Trivial File Transfer — no authentication; LAN imaging and firmware only |
| 80 | TCP | http | World Wide Web HTTP — the default cleartext web port |
| 88 | TCP/UDP | kerberos | Kerberos tickets — authentication in an AD domain |
| 110 | TCP | pop3 | POP3 mail retrieval |
| 111 | TCP/UDP | sunrpc | rpcbind/portmapper — RPC services register here; the legacy RPC-mode rsync used it |
| 123 | TCP/UDP | ntp | Network Time Protocol |
| 135 | TCP/UDP | epmap | DCE endpoint mapper — the handshake behind Windows WMI and DCOM remoting |
| 137-139 | TCP/UDP | netbios-ns / -dgm / -ssn | NetBIOS name, datagram and session — legacy Windows sharing, superseded by SMB on 445 |
| 143 | TCP | imap | IMAP mail retrieval with server-side folders |
| 161-162 | UDP | snmp / snmptrap | SNMP polling (161) and the traps devices push here (162) |
| 179 | TCP | bgp | BGP routing between networks |
| 194 | TCP | irc | Internet Relay Chat |
| 389 | TCP/UDP | ldap | LDAP directory queries; LDAP over TLS is 636 |
| 443 | TCP/UDP | https | HTTPS — the port web clients hit by default; also HTTP/2 and other tunnels |
| 445 | TCP/UDP | microsoft-ds | SMB direct — modern Windows file sharing, AD SYSVOL and netlogon |
| 465 | TCP | submissions (SMTPS) | SMTP over TLS — the registry renamed the service SMTPS to submissions |
| 514 | UDP | syslog | Syslog transport (UDP). TCP 514 is an IANA-registered RSH shell service — check before assuming |
| 515 | TCP | printer | LPD / LPR line-printer daemon |
| 548 | TCP | afpovertcp | AFP over TCP — Apple file sharing, Time Machine targets |
| 587 | TCP | submission | Mail submission — where authenticated mail clients hand mail to their server |
| 631 | TCP/UDP | ipp | IPP printing — CUPS and AirPrint |
| 636 | TCP/UDP | ldaps | LDAP over TLS |
| 873 | TCP | rsync | rsync daemon for rsync:// transfers; rsync over SSH still uses 22 |
| 9418 | TCP | git | git:// pack-transfer service |
| 989-990 | TCP | ftps-data / ftps | FTPS — FTP with TLS on the data and control channels |
| 992, 993, 995 | TCP | telnets / imaps / pop3s | Telnet, IMAP and POP3 wrapped in TLS |
| 1022 | TCP | exp2 | Convenient SSH alternate port for dual-stack or restricted setups (common use, not IANA) |
| 1433 | TCP | ms-sql-s | Microsoft SQL Server |
| 1521 | TCP | ncube-lm | Oracle Database listener (common use, not IANA) |
| 2049 | TCP/UDP | nfs | NFS file sharing |
| 2181 | TCP | eforward | Apache ZooKeeper clients (common use, not IANA) |
| 2375-2376 | TCP | docker / docker-s | Docker daemon HTTP API, plaintext and TLS — both IANA-registered; never expose plaintext |
| 3000 | TCP | hbci | Dev servers, Grafana, Node apps (common use, not IANA) |
| 3128 | TCP | ndl-aas | Squid proxy (common use, not IANA) |
| 3306 | TCP | mysql | MySQL |
| 3389 | TCP/UDP | ms-wbt-server | Remote Desktop (RDP) |
| 4369 | TCP | epmd | Erlang port mapper — RabbitMQ cluster peer discovery |
| 5432 | TCP | postgresql | PostgreSQL |
| 5601 | TCP | esmagent | Kibana dashboard (common use, not IANA) |
| 5671 | TCP | amqps | AMQP over TLS — RabbitMQ and other brokers |
| 5672 | TCP | amqp | AMQP — plaintext broker protocol |
| 5900 | TCP | rfb | VNC — IANA registers the protocol name (Remote Framebuffer), which is what VNC uses |
| 5985-5986 | TCP | wsman / wsmans | WinRM over HTTP (5985) and HTTPS (5986) — PowerShell remoting |
| 6379 | TCP | redis | Redis — IANA-registered; not bound to localhost by default, so firewall it or set requirepass/ACLs |
| 6443 | TCP | sun-sr-https | Kubernetes API server (common use, not IANA) |
| 8080-8443 | TCP | http-alt / pcsync-https | HTTP and HTTPS on alternate ports — proxies, app consoles, dev containers; 8443 also carries the k8s node listeners |
| 8500 | TCP | fmtp | Consul server RPC and HTTP UI (common use, not IANA) |
| 9000 | TCP | cslistener | PHP-FPM, SonarQube, Portainer and friends (common use, not IANA) |
| 9090 | TCP | websm | Prometheus web UI (common use, not IANA) |
| 9092 | TCP | XmlIpcRegSvc | Kafka broker (common use, not IANA) |
| 9200-9300 | TCP | wap-wsp / vrace | Elasticsearch HTTP API (9200) and node-to-node transport (9300) (common use, not IANA) |
| 11211 | TCP/UDP | memcache | Memcached — authless by default; never cross a firewall |
| 15672 | TCP | not registered | RabbitMQ management UI (common use, not IANA) |
| 27017 | TCP | mongodb | MongoDB — IANA-registered |
| 5000 | TCP | commplex-main | Local Docker registry for image pushes (common use, not IANA) |

## How to check what a port is actually serving

Find what owns a port

```
netstat -ano | findstr :443
tasklist /fi "PID eq 5688"

# PowerShell equivalents
Get-NetTCPConnection -LocalPort 443 | Select-Object LocalAddress, LocalPort, State, OwningProcess
Get-Process -Id 5688
```

For every listener you see, the `State` column says what it is: `Listen` is a service accepting new connections, `Established` is a live session, `TimeWait` is a just-closed connection. TimeWait is normal after a burst of short connections, but it is never the state you firewall against.

Who may bind low ports: on Linux, binding below 1024 needs root or CAP_NET_BIND_SERVICE, so an unprivileged service such as a PHP-FPM pool or a Node app picks a registered-range or dynamic port. On Windows no special right is needed to bind a low port, which is why so many dev services sit on 8080 instead of 80. Reading the table is a different matter: a port is an identifier, not a policy — the port number never makes the traffic secure, only the service and its controls do.

## FAQ

**What is a well-known port?**

A port in the IANA well-known range (0-1023). IANA assigns each number to a service — 80 HTTP, 443 HTTPS, 25 SMTP — and the assignment is what lets clients know what they are talking to without prior configuration. The registered range (1024-49151) holds app-specific services, and 49152-65535 is the dynamic range the OS hands out to outbound connections. That classification came from RFC 6335.

**Why is port 443 HTTPS?**

Because IANA registered it that way: 'https' is the officially reserved name for HTTP over TLS/SSL on 443. Browsers use it by default when you type https://, and it has grown beyond web pages — HTTP/2, WebSockets and APIs all route through it, which makes it the only port most modern deployments have to open.

**Is port 9000 secure?**

The number is not the security boundary. IANA has no 'PHP-FPM' entry on 9000 — it is assigned to cslistener — so any app can use the port, and what matters is which service listens there and how you filter it. Check the actual service with netstat or Get-NetTCPConnection, restrict with firewall rules that match the service, and never treat a famous port number as authentication.

**How do I find which process is using a port?**

In cmd: netstat -ano | findstr :443, then tasklist /fi "PID eq ". In PowerShell: Get-NetTCPConnection -LocalPort 443 | Select-Object State, OwningProcess, then Get-Process -Id . Watch the transport when checking: UDP 514 is syslog, while TCP 514 is a registered RSH shell protocol — the same number, two different services.

## Related

- [IPv4 subnet calculator](https://itinsighthub.com/subnet-calculator/) — network, broadcast and host range for any CIDR block.
- [PowerShell one-liners](https://itinsighthub.com/powershell/one-liners/) — the Get-NetTCPConnection check above with the other daily commands.
- [Windows command line](https://itinsighthub.com/windows/command-line/) — the netstat / Get-NetTCPConnection pairs in cmd.exe form.

---

© 2026 ITInsightHub · [About](https://itinsighthub.com/about/) · [Contact](https://itinsighthub.com/contact/) · [Privacy](https://itinsighthub.com/privacy/)