TCP and UDP ports
Reference of the TCP and UDP ports most used in servers, networks and development: which service listens on each one, over which transport protocol and which ones travel unencrypted. Search by number or by service name.
130 of 130 ports
| Port | Protocol | Service | Use |
|---|---|---|---|
| 20System | TCP | FTP-DATAUnencrypted | FTP data channel in active mode. Files |
| 21System | TCP | FTPUnencrypted | FTP control: user name, password and commands travel unencrypted. Files |
| 22System | TCP | SSH | Encrypted remote access; SFTP, SCP and Git over SSH use it too. Remote access |
| 23System | TCP | TelnetUnencrypted | Unencrypted remote terminal; today only on old network equipment. Remote access |
| 25System | TCP | SMTP | Mail delivery between servers; many providers block it outbound. Email |
| 49System | TCP | TACACS+ | Authentication and authorisation of administrators on network devices. Directory and authentication |
| 53System | TCP/UDP | DNS | Name resolution; TCP for large responses and zone transfers. Network services |
| 67System | UDP | DHCP | DHCP server: assigns IP addresses on the local network. Network services |
| 68System | UDP | DHCP | DHCP client: receives the assigned IP address. Network services |
| 69System | UDP | TFTPUnencrypted | Transfer with no authentication, used for network boot (PXE) and firmware. Files |
| 80System | TCP | HTTPUnencrypted | Unencrypted web; today it almost always redirects to HTTPS. Web and development |
| 88System | TCP/UDP | Kerberos | Kerberos authentication, the basis of Active Directory sign-in. Directory and authentication |
| 110System | TCP | POP3Unencrypted | Unencrypted mail download; its secure version uses 995. Email |
| 111System | TCP/UDP | rpcbind | Unix RPC port mapper, required for NFS v3. Network services |
| 123System | UDP | NTP | Time synchronisation with time servers. Network services |
| 135System | TCP | MS-RPC | Windows RPC endpoint mapper, used by DCOM and WMI. Directory and authentication |
| 137System | UDP | NetBIOS-NS | NetBIOS name service of older Windows networks. Files |
| 138System | UDP | NetBIOS-DGM | NetBIOS datagrams for announcing computers on the network. Files |
| 139System | TCP | NetBIOS-SSN | NetBIOS sessions; SMB file shares over NetBIOS. Files |
| 143System | TCP | IMAPUnencrypted | Unencrypted mailbox access; its secure version uses 993. Email |
| 161System | UDP | SNMPUnencrypted | Monitoring queries to network devices; v1 and v2c do not encrypt. Network services |
| 162System | UDP | SNMP-TRAP | Alerts (traps) that devices send to the monitoring system. Network services |
| 179System | TCP | BGP | Route exchange between routers and autonomous systems. Network services |
| 389System | TCP/UDP | LDAPUnencrypted | Directory queries (Active Directory, OpenLDAP) without TLS. Directory and authentication |
| 443System | TCP/UDP | HTTPS | Web encrypted with TLS; over UDP it is used by HTTP/3 over QUIC. Web and development |
| 445System | TCP | SMB | Windows file and printer sharing; it should never be exposed to the Internet. Files |
| 464System | TCP/UDP | kpasswd | Kerberos password changes. Directory and authentication |
| 465System | TCP | SMTPS | Mail submission with implicit TLS, recommended by RFC 8314. Email |
| 500System | UDP | IKE | Key negotiation for IPsec VPNs. VPN and proxies |
| 514System | UDP | SyslogUnencrypted | Sending logs to a syslog server, unencrypted and without delivery confirmation. Network services |
| 520System | UDP | RIP | RIP routing protocol in small networks. Network services |
| 546System | UDP | DHCPv6 | DHCPv6 client. Network services |
| 547System | UDP | DHCPv6 | DHCPv6 server. Network services |
| 548System | TCP | AFP | Apple file sharing (AFP), replaced by SMB in macOS. Files |
| 554System | TCP/UDP | RTSP | Video streaming control, typical of IP cameras. Voice, video and messaging |
| 587System | TCP | Submission | Authenticated mail submission from clients and applications, with STARTTLS. Email |
| 631System | TCP/UDP | IPP | Network printing (IPP) and the CUPS web interface. Network services |
| 636System | TCP | LDAPS | LDAP encrypted with TLS. Directory and authentication |
| 853System | TCP/UDP | DoT / DoQ | Encrypted DNS: DNS over TLS on TCP and DNS over QUIC on UDP. Network services |
| 873System | TCP | rsync | rsync daemon for syncing files between servers. Files |
| 989System | TCP | FTPS-DATA | FTP data channel with implicit TLS. Files |
| 990System | TCP | FTPS | FTP control with implicit TLS. Files |
| 993System | TCP | IMAPS | IMAP encrypted with TLS; the one current mail clients use. Email |
| 995System | TCP | POP3S | POP3 encrypted with TLS. Email |
| 1080Registered | TCP | SOCKS | SOCKS proxy; the port usually chosen for a dynamic tunnel with ssh -D. VPN and proxies |
| 1194Registered | UDP | OpenVPN | OpenVPN VPN; it can also run over TCP. VPN and proxies |
| 1433Registered | TCP | MS SQL Server | Microsoft SQL Server database engine. Databases |
| 1434Registered | UDP | SQL Browser | Service that reports the port of SQL Server named instances. Databases |
| 1521Registered | TCP | Oracle | Oracle Database listener. Databases |
| 1701Registered | UDP | L2TP | L2TP tunnels, usually combined with IPsec. VPN and proxies |
| 1723Registered | TCP | PPTPUnencrypted | PPTP VPN, obsolete: its authentication has been considered broken since 2012. VPN and proxies |
| 1812Registered | UDP | RADIUS | RADIUS authentication for enterprise Wi-Fi (802.1X) and VPNs. Directory and authentication |
| 1813Registered | UDP | RADIUS-ACCT | RADIUS usage records (accounting). Directory and authentication |
| 1883Registered | TCP | MQTTUnencrypted | Unencrypted MQTT IoT messaging; the TLS version uses 8883. Voice, video and messaging |
| 1900Registered | UDP | SSDP | UPnP discovery of devices on the local network. Network services |
| 1935Registered | TCP | RTMP | Sending live streams to platforms such as YouTube or Twitch. Voice, video and messaging |
| 2049Registered | TCP/UDP | NFS | NFS network file system. Files |
| 2181Registered | TCP | ZooKeeper | Cluster coordination with Apache ZooKeeper. Containers and DevOps |
| 2222Registered | TCP | SSH (alt) | Common alternative port for SSH; not official. Remote access |
| 2375Registered | TCP | Docker APIUnencrypted | Docker API without TLS: exposing it is the same as giving root access to the host. Containers and DevOps |
| 2376Registered | TCP | Docker API (TLS) | Docker API protected with mutual TLS. Containers and DevOps |
| 2379Registered | TCP | etcd | etcd client API, the state database of Kubernetes. Containers and DevOps |
| 2380Registered | TCP | etcd peer | Communication between the nodes of an etcd cluster. Containers and DevOps |
| 2525Registered | TCP | SMTP (alt) | Unofficial alternative to 587 offered by sending services when the provider blocks ports. Email |
| 3000Registered | TCP | Node.js / Grafana | Node.js development servers and the Grafana web interface. Web and development |
| 3128Registered | TCP | Squid | Squid HTTP proxy. VPN and proxies |
| 3260Registered | TCP | iSCSI | Remote disks over the network with iSCSI. Files |
| 3268Registered | TCP | Global Catalog | Active Directory global catalogue for forest-wide searches. Directory and authentication |
| 3269Registered | TCP | Global Catalog (TLS) | Active Directory global catalogue with TLS. Directory and authentication |
| 3306Registered | TCP | MySQL | MySQL and MariaDB databases. Databases |
| 3389Registered | TCP/UDP | RDP | Windows Remote Desktop; a frequent target of attacks if exposed. Remote access |
| 3478Registered | TCP/UDP | STUN / TURN | NAT traversal for WebRTC video calls. Voice, video and messaging |
| 4200Registered | TCP | Angular CLI | Angular development server (ng serve). Web and development |
| 4222Registered | TCP | NATS | Messaging between microservices with NATS. Containers and DevOps |
| 4500Registered | UDP | IPsec NAT-T | IPsec encapsulated in UDP to traverse NAT. VPN and proxies |
| 5000Registered | TCP | Flask / Registry | Flask and the Docker registry by default; on macOS it is taken by the AirPlay receiver. Containers and DevOps |
| 5044Registered | TCP | Logstash Beats | Logstash input for Beats agents. Containers and DevOps |
| 5060Registered | TCP/UDP | SIP | Unencrypted IP telephony signalling. Voice, video and messaging |
| 5061Registered | TCP | SIPS | IP telephony signalling with TLS. Voice, video and messaging |
| 5173Registered | TCP | Vite | Vite development server. Web and development |
| 5222Registered | TCP | XMPP | Client connections for XMPP (Jabber) messaging. Voice, video and messaging |
| 5269Registered | TCP | XMPP S2S | Federation between XMPP servers. Voice, video and messaging |
| 5349Registered | TCP | TURN (TLS) | STUN and TURN over TLS. Voice, video and messaging |
| 5353Registered | UDP | mDNS | Multicast DNS (Bonjour) to discover devices without a DNS server. Network services |
| 5355Registered | UDP | LLMNR | Windows local name resolution; it should be disabled because of spoofing risk. Network services |
| 5432Registered | TCP | PostgreSQL | PostgreSQL database. Databases |
| 5601Registered | TCP | Kibana | Kibana web interface. Containers and DevOps |
| 5672Registered | TCP | AMQP | AMQP message queues, such as RabbitMQ. Containers and DevOps |
| 5683Registered | UDP | CoAP | CoAP protocol for low-resource IoT devices. Voice, video and messaging |
| 5900Registered | TCP | VNC | VNC remote desktop; each additional display adds one. Remote access |
| 5938Registered | TCP | TeamViewer | TeamViewer connections. Remote access |
| 5984Registered | TCP | CouchDB | Apache CouchDB HTTP API. Databases |
| 5985Registered | TCP | WinRM | Windows remote management (PowerShell Remoting) over HTTP. Remote access |
| 5986Registered | TCP | WinRM (HTTPS) | Windows remote management over HTTPS. Remote access |
| 6000Registered | TCP | X11 | X11 window system over the network; today it is tunnelled over SSH. Remote access |
| 6379Registered | TCP | Redis | Redis and Valkey in-memory databases. Databases |
| 6443Registered | TCP | Kubernetes API | Kubernetes API server, which kubectl connects to. Containers and DevOps |
| 6514Registered | TCP | Syslog (TLS) | Syslog over TLS. Network services |
| 6667Registered | TCP | IRCUnencrypted | Unencrypted IRC chat; with TLS it uses 6697. Voice, video and messaging |
| 7474Registered | TCP | Neo4j | HTTP interface of the Neo4j graph database; the Bolt protocol uses 7687. Databases |
| 8000Registered | TCP | HTTP (dev) | Development servers such as Django or python -m http.server. Web and development |
| 8080Registered | TCP | HTTP (alt) | Alternative HTTP for proxies and application servers such as Tomcat or Jenkins. Web and development |
| 8081Registered | TCP | HTTP (alt) | Another alternative HTTP port; Nexus Repository uses it by default. Web and development |
| 8086Registered | TCP | InfluxDB | HTTP API of the InfluxDB time-series database. Databases |
| 8123Registered | TCP | ClickHouse / Home Assistant | ClickHouse HTTP interface; also the Home Assistant web interface. Databases |
| 8200Registered | TCP | Vault | HashiCorp Vault API for managing secrets. Containers and DevOps |
| 8443Registered | TCP | HTTPS (alt) | Alternative HTTPS for admin panels and application servers. Web and development |
| 8500Registered | TCP | Consul | HTTP API and web interface of HashiCorp Consul. Containers and DevOps |
| 8883Registered | TCP | MQTT (TLS) | MQTT encrypted with TLS. Voice, video and messaging |
| 8888Registered | TCP | Jupyter | Jupyter Notebook and JupyterLab. Web and development |
| 9000Registered | TCP | PHP-FPM | PHP-FPM behind Nginx; ClickHouse, SonarQube and Portainer use it too. Web and development |
| 9042Registered | TCP | Cassandra | CQL protocol of Apache Cassandra and ScyllaDB. Databases |
| 9050Registered | TCP | Tor SOCKS | SOCKS proxy of the Tor client. VPN and proxies |
| 9090Registered | TCP | Prometheus | Prometheus metrics server. Containers and DevOps |
| 9092Registered | TCP | Kafka | Apache Kafka brokers. Containers and DevOps |
| 9100Registered | TCP | JetDirect / node_exporter | Direct RAW printing to network printers; also Prometheus node_exporter. Network services |
| 9200Registered | TCP | Elasticsearch | REST API of Elasticsearch and OpenSearch. Databases |
| 9300Registered | TCP | Elasticsearch transport | Communication between the nodes of an Elasticsearch cluster. Databases |
| 9418Registered | TCP | GitUnencrypted | Read-only git:// protocol, with no authentication or encryption. Containers and DevOps |
| 10250Registered | TCP | kubelet | kubelet API on every Kubernetes node. Containers and DevOps |
| 11211Registered | TCP/UDP | Memcached | Memcached cache; over UDP it was abused for amplification attacks. Databases |
| 11434Registered | TCP | Ollama | Local Ollama API for running language models. Containers and DevOps |
| 15672Registered | TCP | RabbitMQ UI | RabbitMQ management web interface. Containers and DevOps |
| 19132Registered | UDP | Minecraft Bedrock | Minecraft Bedrock Edition servers. Games |
| 25565Registered | TCP | Minecraft | Minecraft Java Edition servers. Games |
| 27015Registered | TCP/UDP | Steam / Source | Game servers on the Source engine and Steam, such as Counter-Strike. Games |
| 27017Registered | TCP | MongoDB | MongoDB database. Databases |
| 32400Registered | TCP | Plex | Plex media server. Voice, video and messaging |
| 50000Dynamic | TCP | Db2 / Jenkins agent | IBM Db2 by default; also the connection for Jenkins agents. Databases |
| 51820Dynamic | UDP | WireGuard | Common WireGuard port; it has no official one and can be changed. VPN and proxies |
How it works
A port is a 16-bit number, from 0 to 65535, that lets a single IP serve many services at once: the operating system delivers each packet to the program listening on the destination port. TCP and UDP each have their own set of ports, so 53/TCP and 53/UDP are two different ports even when the same service uses both.
IANA splits the range into three parts (RFC 6335). From 0 to 1023 are the system ports, assigned to the classic protocols, which on Linux, by default, only a privileged process can open. From 1024 to 49151, the registered ports, which applications request from IANA. From 49152 to 65535, the dynamic ports, which the system assigns temporarily to the client side of each connection.
The table gathers the ports an administrator or developer runs into in practice, including some that are not official but everyone uses, such as 8080, 3000 or WireGuard's 51820. A port tells you what is usually there, not what is there: any service can listen on any number, so to find out what answers on a machine you have to ask the machine itself.
Examples
443/UDPHTTP/3 · QUICFor years 443 was TCP only. HTTP/3 runs over QUIC, which uses UDP, so a firewall that only lets 443/TCP through forces the browser to fall back to HTTP/2.ss -tulpn | grep :8080tcp LISTEN 0 100 *:8080 *:* users:(("java",pid=2314,fd=45))On Linux, ss shows which process listens on each port. On Windows the equivalent is netstat -ano, which gives the PID, or Get-NetTCPConnection in PowerShell; on macOS, lsof -i :8080.sysctl net.ipv4.ip_local_port_range32768 60999By default Linux assigns client-side ephemeral ports in that range, not in the 49152-65535 range recommended by IANA and used by Windows. On a proxy or load balancer with many outgoing connections, that range can fall short.Use cases
- Build firewall rules or cloud security group rules knowing what each service opens.
- Interpret the results of a port scan of your own network.
- Spot exposed services that should not be, such as SMB, RDP, Redis or the Docker API.
- Pick a port for a new service without clashing with a well-known one.
- Understand a "port already in use" error when starting a development server or a container.
- Identify which protocols on the network still travel unencrypted.
Frequently asked questions
What is the difference between a TCP port and a UDP port?
TCP sets up a connection, guarantees that data arrives complete and in order, and resends what is lost; the web, email and SSH use it. UDP sends standalone packets without acknowledgement and with less latency; DNS, voice, games and QUIC use it. They are independent number spaces: opening 53/TCP on a firewall does not open 53/UDP.
How do I find out which program is using a port?
On Linux, ss -tulpn lists listening ports with the process that opened them. On Windows, netstat -ano shows the PID, which you then look up in Task Manager, or use Get-NetTCPConnection -LocalPort 8080 in PowerShell. On macOS and Linux, lsof -i :8080 also works. If the command does not show the process, run it with administrator privileges.
Does changing a service's port make it more secure?
Barely. Moving SSH from 22 to 2222 cuts down the noise from bots that try passwords on the default port, but a full scan finds the service in seconds. Real protection comes from key-based authentication, limiting which IPs can connect and not exposing to the Internet what does not need to be there.
Which ports should never be open to the Internet?
Management and database ports: SMB (445), RDP (3389), Telnet (23), databases such as MySQL, PostgreSQL, Redis or MongoDB, the Docker API (2375) and the kubelet (10250). They are the most sought after by automated scanners. If you need access from outside, the right way is a VPN or an SSH tunnel.
Why does a development server use 8080 or 3000 instead of 80?
Because on Linux, by default, only root can open ports below 1024, and running a development server with privileges is a bad idea. That is why each tool picked a high number: 8080 for Java servers, 3000 for Node.js, 4200 for Angular, 5173 for Vite, 8000 for Django. In production, a proxy such as Nginx handles 80 and 443 and forwards to those internal ports.