Port Number Lookup (TCP and UDP Ports)
Find the service behind a TCP or UDP port, with security notes.
This is a reference list. It does not scan or connect to anything.
277 port entries
1tcpmuxTCP
TCP port service multiplexer.
5rjeTCP/UDP
Remote job entry (obsolete).
7echoTCP/UDP
Echo protocol, returns whatever it receives.
Security: Can be abused for reflection and amplification attacks. Disable it.
9discardTCP/UDP
Discard protocol, also used for Wake-on-LAN over UDP.
11systatTCP
Active users service (obsolete).
Security: Leaks user information. Disable it.
13daytimeTCP/UDP
Daytime protocol (obsolete).
17qotdTCP/UDP
Quote of the Day.
Security: Abused for amplification attacks.
19chargenTCP/UDP
Character generator protocol.
Security: A classic UDP amplification vector. Never expose it.
20ftp-dataTCP
FTP data transfer (active mode).
Security: FTP sends credentials and data unencrypted. Prefer SFTP or FTPS.
21ftpTCP
FTP control (commands and login).
Security: Credentials travel in plain text and anonymous login is often left on. Prefer SFTP.
22sshTCP
Secure Shell, also SFTP and SCP.
Security: Constantly brute-forced on the internet. Use keys, disable password login and root login.
23telnetTCP
Telnet remote login.
Security: Unencrypted, and a top target for IoT botnets such as Mirai. Never expose it; use SSH.
25smtpTCP
Simple Mail Transfer Protocol, server-to-server email relay.
Security: Open relays get abused for spam. Many ISPs block outbound 25.
37timeTCP/UDP
Time protocol (obsolete).
42nameserverTCP/UDP
Host Name Server Protocol, also WINS replication.
43whoisTCP
WHOIS directory lookups.
49tacacsTCP/UDP
TACACS+ authentication for network devices.
53dnsTCP/UDP
Domain Name System.
Security: Open resolvers are abused for DNS amplification. Only answer recursive queries for your own clients.
67dhcp-serverUDP
DHCP and BOOTP server.
Security: Rogue DHCP servers can redirect traffic on a LAN.
68dhcp-clientUDP
DHCP and BOOTP client.
69tftpUDP
Trivial File Transfer Protocol, used for network boot and device configs.
Security: No authentication. Keep it off the internet.
70gopherTCP
Gopher protocol.
79fingerTCP
Finger user information protocol.
Security: Leaks user names. Disable it.
80httpTCP
Hypertext Transfer Protocol (web).
Security: Traffic is unencrypted. Redirect to HTTPS on 443.
81http-altTCP
Alternative HTTP port, often used by routers and cameras.
82http-altTCP
Alternative HTTP port.
88kerberosTCP/UDP
Kerberos authentication, used by Active Directory.
102iso-tsapTCP
ISO-TSAP, used by Siemens S7 PLCs.
Security: Industrial control traffic. Never expose PLCs to the internet.
104dicomTCP
DICOM medical imaging.
Security: Exposed PACS servers have leaked patient scans.
110pop3TCP
Post Office Protocol 3, email retrieval.
Security: Plain text. Use POP3S on 995.
111rpcbindTCP/UDP
ONC RPC portmapper, used by NFS.
Security: Leaks service information and is abused for amplification. Keep it internal.
113identTCP
Ident protocol.
119nntpTCP
Network News Transfer Protocol (Usenet).
123ntpUDP
Network Time Protocol.
Security: Old servers answer monlist queries used for huge amplification attacks. Keep NTP patched.
135msrpcTCP/UDP
Microsoft RPC endpoint mapper.
Security: Frequent target of Windows worms. Block it at the perimeter.
137netbios-nsUDP
NetBIOS name service.
Security: Leaks host and user names. Block at the perimeter.
138netbios-dgmUDP
NetBIOS datagram service.
Security: Block at the perimeter.
139netbios-ssnTCP
NetBIOS session service, legacy SMB.
Security: Legacy file sharing. Never expose it to the internet.
143imapTCP
Internet Message Access Protocol.
Security: Plain text unless STARTTLS is enforced. Prefer IMAPS on 993.
161snmpUDP
Simple Network Management Protocol.
Security: Default community strings (public, private) leak device details and allow changes. Use SNMPv3.
162snmptrapUDP
SNMP traps (notifications).
177xdmcpUDP
X Display Manager Control Protocol.
Security: Unencrypted remote desktop. Keep internal.
179bgpTCP
Border Gateway Protocol, internet routing.
Security: Restrict to known peers and use TCP-AO or MD5 authentication.
194ircTCP
Internet Relay Chat (official port).
199smuxTCP
SNMP multiplexer.
201at-rtmpTCP
AppleTalk routing.
213ipxUDP
IPX over IP.
220imap3TCP
IMAP version 3.
264bgmpTCP
Border Gateway Multicast Protocol.
318tspTCP
Time-Stamp Protocol.
389ldapTCP/UDP
Lightweight Directory Access Protocol.
Security: Plain text binds leak passwords, and exposed CLDAP (UDP) is an amplification vector. Use LDAPS.
401upsTCP/UDP
Uninterruptible power supply monitoring.
427svrlocTCP/UDP
Service Location Protocol.
Security: Exposed SLP has been used for very large amplification attacks and VMware ESXi exploits.
443httpsTCP/UDP
HTTP over TLS, and HTTP/3 over QUIC on UDP.
444snppTCP
Simple Network Paging Protocol.
445microsoft-dsTCP
SMB file sharing directly over TCP.
Security: Exploited by WannaCry and NotPetya (EternalBlue). Never expose SMB to the internet.
464kpasswdTCP/UDP
Kerberos password change.
465smtpsTCP
SMTP submission over implicit TLS.
497retrospectTCP/UDP
Retrospect backup.
500isakmpUDP
IPsec IKE key exchange (VPN).
502modbusTCP
Modbus/TCP industrial control.
Security: No authentication. Exposed Modbus lets anyone read and write PLC values.
512execTCP
Remote process execution (rexec).
Security: Unencrypted and insecure. Disable it.
513loginTCP
Remote login (rlogin).
Security: Trust-based authentication that is easy to abuse. Disable it.
514shellTCP
Remote shell (rsh).
Security: Insecure. Disable it.
514syslogUDP
Syslog message logging.
Security: No authentication, so logs can be spoofed. Use TLS syslog on 6514.
515printerTCP
Line Printer Daemon (LPD).
520ripUDP
Routing Information Protocol.
521ripngUDP
RIP for IPv6.
523ibm-db2TCP/UDP
IBM DB2 discovery.
530rpcTCP/UDP
Remote procedure call.
540uucpTCP
Unix-to-Unix Copy.
543kloginTCP
Kerberos login.
544kshellTCP
Kerberos remote shell.
546dhcpv6-clientUDP
DHCPv6 client.
547dhcpv6-serverUDP
DHCPv6 server.
548afpTCP
Apple Filing Protocol.
Security: Legacy file sharing. Keep internal.
554rtspTCP/UDP
Real Time Streaming Protocol, used by IP cameras.
Security: Exposed cameras often have default passwords or no authentication.
563nntpsTCP
NNTP over TLS.
587submissionTCP
Email message submission (SMTP with STARTTLS and authentication).
593http-rpc-epmapTCP
Microsoft RPC over HTTP.
623ipmiUDP
IPMI remote management (BMC).
Security: IPMI has serious authentication flaws. Never expose BMCs to the internet.
631ippTCP/UDP
Internet Printing Protocol (CUPS).
Security: Exposed CUPS on UDP 631 had a remote code execution chain in 2024. Keep it internal.
636ldapsTCP
LDAP over TLS.
639msdpTCP
Multicast Source Discovery Protocol.
646ldpTCP/UDP
Label Distribution Protocol (MPLS).
660mac-srvr-adminTCP
macOS Server administration.
749kerberos-admTCP/UDP
Kerberos administration.
853domain-sTCP/UDP
DNS over TLS, and DNS over QUIC on UDP.
860iscsiTCP
iSCSI (old port).
873rsyncTCP
rsync file synchronisation daemon.
Security: Anonymous rsync modules often leak backups. Require authentication.
902vmware-authTCP
VMware ESXi and Workstation authentication.
953rndcTCP
BIND remote name daemon control.
Security: Keep internal.
989ftps-dataTCP
FTP data over TLS.
990ftpsTCP
FTP control over TLS.
992telnetsTCP
Telnet over TLS.
993imapsTCP
IMAP over TLS.
995pop3sTCP
POP3 over TLS.
1023reservedTCP
Highest well-known port.
1080socksTCP
SOCKS proxy.
Security: Open proxies get abused to hide attackers. Require authentication.
1194openvpnTCP/UDP
OpenVPN.
1214kazaaTCP
Kazaa peer-to-peer.
1241nessusTCP
Nessus vulnerability scanner (old port).
1311dell-openmanageTCP
Dell OpenManage web interface.
1337wasteTCP
Commonly used by hobby and malware services.
1352lotusnoteTCP
IBM Notes (Lotus Notes).
1433ms-sql-sTCP
Microsoft SQL Server.
Security: Databases should never face the internet. Brute-forced constantly.
1434ms-sql-mUDP
Microsoft SQL Server Browser.
Security: Abused by the Slammer worm and for amplification. Block it.
1521oracleTCP
Oracle Database listener.
Security: Keep databases internal.
1604citrix-icaUDP
Citrix ICA browser (legacy).
1645radius-oldUDP
RADIUS authentication (old port).
1646radacct-oldUDP
RADIUS accounting (old port).
1701l2tpUDP
Layer 2 Tunnelling Protocol (VPN).
1720h323TCP
H.323 call signalling (VoIP).
1723pptpTCP
Point-to-Point Tunnelling Protocol VPN.
Security: PPTP encryption is broken. Replace it with WireGuard, IPsec or OpenVPN.
1755mmsTCP/UDP
Microsoft Media Services.
1812radiusUDP
RADIUS authentication.
1813radius-acctUDP
RADIUS accounting.
1883mqttTCP
MQTT messaging (IoT).
Security: Many brokers allow anonymous access. Use authentication and TLS on 8883.
1900ssdpUDP
SSDP / UPnP discovery.
Security: A major amplification vector, and UPnP can open firewall ports. Block from the internet.
2000cisco-sccpTCP
Cisco Skinny Client Control Protocol.
2049nfsTCP/UDP
Network File System.
Security: Exposed NFS shares often allow anyone to read files. Keep internal.
2082cpanelTCP
cPanel (HTTP).
2083cpanel-sslTCP
cPanel (HTTPS).
2086whmTCP
WebHost Manager (HTTP).
2087whm-sslTCP
WebHost Manager (HTTPS).
2095webmailTCP
cPanel webmail (HTTP).
2096webmail-sslTCP
cPanel webmail (HTTPS).
2100oracle-xdbTCP
Oracle XML DB FTP.
2121ftp-altTCP
Alternative FTP port.
2181zookeeperTCP
Apache ZooKeeper client port.
Security: No authentication by default. Keep internal.
2222ssh-altTCP
Common alternative SSH port, also DirectAdmin.
2375dockerTCP
Docker daemon API without TLS.
Security: Gives full root control of the host to anyone who can reach it. Never expose it.
2376docker-tlsTCP
Docker daemon API over TLS.
Security: Require client certificates.
2377docker-swarmTCP
Docker Swarm cluster management.
2379etcd-clientTCP
etcd client API (Kubernetes).
Security: Holds cluster secrets. Require TLS client authentication.
2380etcd-peerTCP
etcd peer communication.
2404iec-104TCP
IEC 60870-5-104 power grid control.
Security: Industrial protocol with no authentication. Keep isolated.
2483oracle-dbTCP
Oracle database listener (unencrypted).
2484oracle-db-sslTCP
Oracle database listener (TLS).
2601zebraTCP
Quagga/FRRouting zebra daemon.
2628dictTCP
DICT dictionary server.
2947gpsdTCP
GPS daemon.
3000dev-serverTCP
Common development server port (Node.js, Grafana, Rails).
Security: Development servers are not hardened. Do not expose them.
3020cifsTCP
CIFS.
3128squidTCP
Squid HTTP proxy.
Security: Open proxies get abused. Restrict access.
3260iscsiTCP
iSCSI storage.
Security: Keep storage networks isolated.
3268globalcatTCP
Active Directory Global Catalog.
3269globalcat-sslTCP
Active Directory Global Catalog over TLS.
3283net-assistantTCP/UDP
Apple Remote Desktop reporting.
Security: Abused for amplification.
3306mysqlTCP
MySQL and MariaDB.
Security: Databases should never face the internet. Bind to localhost or a private network.
3310clamavTCP
ClamAV daemon.
3343ms-clusterUDP
Microsoft Cluster Service.
3389rdpTCP/UDP
Remote Desktop Protocol (Windows).
Security: One of the most attacked services and a common ransomware entry point. Put it behind a VPN or gateway with MFA.
3478stunTCP/UDP
STUN and TURN for WebRTC NAT traversal.
3479stun-altUDP
STUN/TURN alternative, also PlayStation Network.
3632distccTCP
distcc distributed compiler.
Security: Unauthenticated remote code execution if exposed.
3689daapTCP
Digital Audio Access Protocol (iTunes sharing).
3690svnTCP
Subversion.
3702ws-discoveryUDP
Web Services Dynamic Discovery.
Security: Abused for amplification attacks.
3724blizzardTCP
Blizzard games (World of Warcraft).
3784bfdUDP
Bidirectional Forwarding Detection.
4000dev-altTCP
Common development server port.
4040spark-uiTCP
Apache Spark application UI.
4045nfs-lockdTCP/UDP
NFS lock daemon.
4369epmdTCP
Erlang Port Mapper (RabbitMQ, CouchDB).
Security: Exposed Erlang nodes with weak cookies allow remote code execution.
4443https-altTCP
Alternative HTTPS port.
4500ipsec-nat-tUDP
IPsec NAT traversal.
4505salt-pubTCP
SaltStack publisher.
Security: Exposed Salt masters were mass-exploited in 2020. Keep internal.
4506salt-retTCP
SaltStack request server.
4567sinatraTCP
Sinatra default port, also Galera replication.
4711emule-webTCP
eMule web interface.
4789vxlanUDP
VXLAN overlay networks.
4840opc-uaTCP
OPC UA industrial automation.
4848glassfishTCP
GlassFish admin console.
5000upnp-devTCP
Flask and many dev servers, macOS AirPlay receiver, Synology DSM.
5001synology-httpsTCP
Synology DSM over HTTPS, also iperf.
5004rtpUDP
Real-time Transport Protocol media.
5005rtcpUDP
RTP control protocol.
5060sipTCP/UDP
Session Initiation Protocol (VoIP).
Security: Scanned constantly for toll fraud. Restrict to your providers.
5061sipsTCP
SIP over TLS.
5222xmpp-clientTCP
XMPP (Jabber) client connections.
5223apns-legacyTCP
Apple Push Notification service (legacy) and XMPP over TLS.
5228gcmTCP
Google Play services and Firebase Cloud Messaging.
5269xmpp-serverTCP
XMPP server-to-server.
5353mdnsUDP
Multicast DNS (Bonjour, Avahi).
Security: Should never be reachable from the internet; abused for amplification.
5355llmnrUDP
Link-Local Multicast Name Resolution.
Security: Poisoned by tools such as Responder to steal Windows hashes. Disable it.
5432postgresqlTCP
PostgreSQL.
Security: Databases should never face the internet.
5500vnc-httpTCP
VNC listening viewer.
5601kibanaTCP
Kibana.
Security: Often exposed without login. Put it behind authentication.
5631pcanywhereTCP
pcAnywhere data.
Security: Legacy remote access with known flaws.
5666nrpeTCP
Nagios Remote Plugin Executor.
5672amqpTCP
AMQP (RabbitMQ).
Security: Change the default guest account.
5683coapUDP
Constrained Application Protocol (IoT).
Security: Abused for amplification.
5800vnc-httpTCP
VNC over HTTP.
5900vncTCP
Virtual Network Computing remote desktop.
Security: Many VNC servers are exposed with no password. Tunnel it over SSH or a VPN.
5938teamviewerTCP/UDP
TeamViewer.
5984couchdbTCP
Apache CouchDB.
Security: Old versions had admin party mode with no login. Keep internal.
5985winrm-httpTCP
Windows Remote Management over HTTP.
Security: Remote command execution. Restrict to admin networks.
5986winrm-httpsTCP
Windows Remote Management over HTTPS.
Security: Restrict to admin networks.
6000x11TCP
X Window System.
Security: Exposed X servers let attackers capture keystrokes and screens.
6379redisTCP
Redis.
Security: No password by default in older versions; exposed Redis is mass-exploited for cryptomining. Bind to localhost.
6443kubernetes-apiTCP
Kubernetes API server.
Security: Require authentication and restrict network access.
6514syslog-tlsTCP
Syslog over TLS.
6566saneTCP
SANE scanner daemon.
6660irc-altTCP
IRC (range 6660 to 6669).
6667ircTCP
Internet Relay Chat (common port).
Security: Historically used by botnet command channels.
6697ircsTCP
IRC over TLS.
6881bittorrentTCP/UDP
BitTorrent (range 6881 to 6889).
6969bittorrent-trackerTCP
BitTorrent tracker.
7000cassandraTCP
Apache Cassandra inter-node, also AirPlay on macOS.
7001weblogicTCP
Oracle WebLogic Server.
Security: Frequently exploited deserialisation flaws. Patch and restrict.
7070realserverTCP
RealServer / RTSP alternative.
7199cassandra-jmxTCP
Cassandra JMX monitoring.
7474neo4jTCP
Neo4j browser (HTTP).
7547cwmpTCP
TR-069 router management by ISPs.
Security: Mass-exploited on home routers (Mirai variants). Should only be reachable by the ISP.
7687boltTCP
Neo4j Bolt protocol.
8000http-altTCP
Common alternative HTTP and development port (Django, Python http.server).
8008http-altTCP
Alternative HTTP, also Chromecast.
8009ajp13TCP
Apache JServ Protocol (Tomcat).
Security: Ghostcat (CVE-2020-1938) let attackers read files. Disable AJP if unused.
8010http-altTCP
Alternative HTTP port.
8080http-proxyTCP
Common alternative HTTP port, proxies and Tomcat.
Security: Often an unhardened admin or dev service. Check what is listening.
8081http-altTCP
Alternative HTTP port.
8086influxdbTCP
InfluxDB HTTP API.
8088http-altTCP
Alternative HTTP, Hadoop YARN.
Security: Exposed YARN ResourceManager allows remote code execution.
8089splunkdTCP
Splunk management.
8090http-altTCP
Alternative HTTP, Atlassian Confluence.
8096jellyfinTCP
Jellyfin and Emby media server.
8125statsdUDP
StatsD metrics.
8140puppetTCP
Puppet server.
8161activemq-webTCP
Apache ActiveMQ web console.
8200vaultTCP
HashiCorp Vault API.
8291winboxTCP
MikroTik Winbox.
Security: Exploited in the wild. Restrict to management networks.
8300consul-rpcTCP
HashiCorp Consul server RPC.
8333bitcoinTCP
Bitcoin peer-to-peer network.
8443https-altTCP
Common alternative HTTPS port.
8500consulTCP
HashiCorp Consul HTTP API and UI.
Security: Consul with script checks enabled allows remote code execution.
8545ethereum-rpcTCP
Ethereum JSON-RPC.
Security: Exposed RPC with unlocked accounts has been drained. Keep internal.
8728mikrotik-apiTCP
MikroTik RouterOS API.
8883mqtt-tlsTCP
MQTT over TLS.
8888http-altTCP
Alternative HTTP, Jupyter Notebook.
Security: Jupyter without a token gives a full shell. Always use a token or password.
9000http-altTCP
PHP-FPM, SonarQube, Portainer and many others.
Security: Exposed PHP-FPM (FastCGI) allows code execution.
9001tor-orportTCP
Tor relay, Supervisor web UI.
9042cassandra-cqlTCP
Cassandra CQL native transport.
9050tor-socksTCP
Tor SOCKS proxy.
9080http-altTCP
Alternative HTTP port.
9090prometheusTCP
Prometheus, also Cockpit and Openfire.
Security: Prometheus exposes infrastructure details without login.
9091transmissionTCP
Transmission BitTorrent web UI.
9092kafkaTCP
Apache Kafka broker.
Security: No authentication by default. Keep internal.
9093alertmanagerTCP
Prometheus Alertmanager.
9100jetdirectTCP
Raw printing (HP JetDirect), also Prometheus node exporter.
Security: Exposed printers can be made to print or leak data.
9200elasticsearchTCP
Elasticsearch REST API.
Security: Exposed clusters without security are a leading cause of data leaks.
9300elasticsearch-nodeTCP
Elasticsearch node transport.
9418gitTCP
Git protocol (git://).
Security: Unauthenticated and unencrypted. Prefer HTTPS or SSH.
9443https-altTCP
Alternative HTTPS, Portainer.
9999abyssTCP
Common admin and debug port.
10000webminTCP
Webmin, also Network Data Management Protocol.
Security: Webmin has had critical remote code execution flaws. Restrict it.
10050zabbix-agentTCP
Zabbix agent.
10051zabbix-trapperTCP
Zabbix server.
10250kubeletTCP
Kubernetes kubelet API.
Security: Anonymous kubelet access allows running commands in pods.
11211memcachedTCP/UDP
Memcached.
Security: Exposed UDP memcached powered record DDoS attacks (51,000x amplification). Disable UDP and bind to localhost.
11434ollamaTCP
Ollama local LLM API.
Security: No authentication. Exposed instances let anyone use or delete models.
15672rabbitmq-mgmtTCP
RabbitMQ management UI.
16992intel-amtTCP
Intel AMT remote management (HTTP).
Security: Out-of-band control of the machine. Disable if unused.
17500dropbox-lanTCP/UDP
Dropbox LAN sync.
19132minecraft-bedrockUDP
Minecraft Bedrock Edition server.
20000dnp3TCP
DNP3 utility control, also Usermin.
Security: Industrial protocol. Keep isolated.
25565minecraftTCP
Minecraft Java Edition server.
27015steamTCP/UDP
Steam and Source engine game servers.
27017mongodbTCP
MongoDB.
Security: Thousands of exposed MongoDB databases have been wiped and ransomed. Enable authentication and bind locally.
28015rethinkdbTCP
RethinkDB client port.
32400plexTCP
Plex Media Server.
33060mysqlxTCP
MySQL X Protocol.
44818ethernet-ipTCP/UDP
EtherNet/IP industrial (Rockwell).
Security: Industrial protocol. Keep isolated.
47808bacnetUDP
BACnet building automation.
Security: Exposed building controls can be changed remotely.
49152dynamicTCP
Start of the dynamic (ephemeral) port range used by most operating systems.
50000sapTCP
SAP and IBM DB2.
51820wireguardUDP
WireGuard VPN (default).
Use via API
Look up TCP and UDP port numbers: the service, what it's for, and security notes for ports that are risky to expose. Search by port, list, range or service name. Send JSON, get JSON back.
POST https://pithlab.com/api/v1/tools/port-number-lookup
curl https://pithlab.com/api/v1/tools/port-number-lookup \
-H "Authorization: Bearer $PITHLAB_KEY" \
-H "Content-Type: application/json" \
-d '{"query":"6379"}'About the Port Number Lookup
Look up what runs on a TCP or UDP port: search over 250 well-known and registered ports by number, range or service name, with security notes for risky ones.
How to use the Port Number Lookup
- Type a port number (3389), several numbers (22, 80, 443), a range (8000-8100) or a service name (redis).
- Narrow the list to TCP or UDP, or tick Security-sensitive only to see ports that are risky to expose.
- Read the service, protocol, description and any security note, and copy an entry if you need it.
Examples
Input
22
Output
22/TCP ssh: Secure Shell, also SFTP and SCP.
Input
postgresql
Output
5432/TCP postgresql: PostgreSQL.
Input
6379-6380
Output
6379/TCP redis: Redis.
Frequently asked questions
Does this tool scan my ports?
No. It is a reference list only and makes no network connections. To see which ports are open on your own machine, use a command such as netstat, ss or lsof, or nmap against hosts you are allowed to test.
What is the difference between well-known, registered and dynamic ports?
Ports 0 to 1023 are well-known and reserved for core services. Ports 1024 to 49151 are registered by IANA for specific applications. Ports 49152 to 65535 are dynamic, used briefly by clients for outgoing connections.
Which ports should never be open to the internet?
Remote access and file sharing such as Telnet (23), SMB (445) and RDP (3389), and databases such as MySQL (3306), PostgreSQL (5432), Redis (6379) and MongoDB (27017). Put them behind a VPN or firewall allowlist.
Is a service always on its standard port?
No. Ports are conventions. Any service can listen on any port, and malware often uses common ports such as 443 to blend in, so check what is actually listening.