Networking
Common Network Ports: TCP and UDP Reference List
meine-ip.info Editorial
·
·
3 min read
·
Updated May 2026
ports
TCP
UDP
firewall
networking
reference
Common network ports at a glance
The most-used Well-Known ports (0–1023) and selected Registered ports (1024–49151), with service, transport, encryption status and a brief note. To check whether a specific port is open on a host, use the Port Scanner.
System / Remote access
| Port | Proto | Service | Encrypted | Note |
|---|---|---|---|---|
| 22 | TCP | SSH | ✅ | Linux remote login, SCP, SFTP |
| 23 | TCP | Telnet | ❌ | Clear-text — should be disabled |
| 3389 | TCP/UDP | RDP | ✅ | Windows Remote Desktop |
| 5900 | TCP | VNC | ⚠ | Often tunneled over SSH |
| 5985/5986 | TCP | WinRM (HTTP/HTTPS) | ⚠/✅ | PowerShell remoting |
Web & APIs
| Port | Proto | Service | Encrypted | Note |
|---|---|---|---|---|
| 80 | TCP | HTTP | ❌ | Should redirect to HTTPS |
| 443 | TCP/UDP | HTTPS / HTTP/3 (QUIC) | ✅ | UDP/443 for HTTP/3 |
| 8080 | TCP | HTTP alt | ❌ | Proxies, dev servers |
| 8443 | TCP | HTTPS alt | ✅ | Admin panels |
| 3000 | TCP | Node.js, Grafana | ⚠ | Dev default |
| 5000 | TCP | Flask, various | ⚠ | Dev default |
| Port | Proto | Service | Encrypted | Note |
|---|---|---|---|---|
| 25 | TCP | SMTP (MX relay) | STARTTLS | Server-to-server mail |
| 587 | TCP | SMTP Submission | STARTTLS | Client → server (must auth) |
| 465 | TCP | SMTPS | ✅ (implicit TLS) | Alternative to 587 |
| 110 | TCP | POP3 | STARTTLS | Legacy |
| 995 | TCP | POP3S | ✅ | |
| 143 | TCP | IMAP | STARTTLS | |
| 993 | TCP | IMAPS | ✅ | Recommended |
File transfer
| Port | Proto | Service | Encrypted | Note |
|---|---|---|---|---|
| 20/21 | TCP | FTP (data/control) | ❌ | Legacy; prefer SFTP (22) or FTPS |
| 22 | TCP | SFTP | ✅ | SSH subsystem |
| 990 | TCP | FTPS (implicit) | ✅ | |
| 989 | TCP | FTPS data | ✅ | |
| 445 | TCP | SMB | ⚠ | SMB 3.0+ encrypts; disable SMBv1 |
| 2049 | TCP/UDP | NFS | ⚠ | Use Krb5 for auth |
Databases
| Port | Proto | Service | Encrypted | Note |
|---|---|---|---|---|
| 1433 | TCP | MS SQL Server | ⚠ | TLS optional |
| 3306 | TCP | MySQL / MariaDB | ⚠ | TLS recommended |
| 5432 | TCP | PostgreSQL | ⚠ | ssl=on |
| 6379 | TCP | Redis | ⚠ | Auth + TLS required |
| 27017 | TCP | MongoDB | ⚠ | TLS recommended |
| 9200/9300 | TCP | Elasticsearch | ⚠ | Never expose to internet |
DNS / DHCP / Directory
| Port | Proto | Service | Encrypted | Note |
|---|---|---|---|---|
| 53 | TCP/UDP | DNS | ❌ | UDP < 512 bytes, otherwise TCP |
| 853 | TCP/UDP | DNS over TLS / QUIC | ✅ | DoT / DoQ |
| 443 | TCP | DNS over HTTPS (DoH) | ✅ | Browser default resolver |
| 67/68 | UDP | DHCP (server/client) | ❌ | |
| 389 | TCP | LDAP | STARTTLS | |
| 636 | TCP | LDAPS | ✅ | |
| 88 | TCP/UDP | Kerberos | ✅ (internal) |
Realtime / Messaging / Gaming
| Port | Proto | Service | Note |
|---|---|---|---|
| 5060 | TCP/UDP | SIP | VoIP signalling |
| 5061 | TCP | SIPS | TLS SIP |
| 5222 | TCP | XMPP-Client | Jabber, Matrix bridges |
| 5269 | TCP | XMPP-Server | |
| 1883 | TCP | MQTT | IoT broker |
| 8883 | TCP | MQTT-TLS | |
| 6667 | TCP | IRC | |
| 25565 | TCP | Minecraft | |
| 27015 | UDP | Source games | CS, TF2, Garry's Mod |
| 3478 | UDP | STUN | WebRTC |
Tunnels / VPN
| Port | Proto | Service | Note |
|---|---|---|---|
| 1194 | UDP | OpenVPN | Default |
| 51820 | UDP | WireGuard | Default |
| 500 | UDP | IKE (IPsec) | |
| 4500 | UDP | IPsec NAT-T | |
| 1701 | UDP | L2TP | |
| 1723 | TCP | PPTP | Insecure, avoid |
Monitoring / Management
| Port | Proto | Service | Note |
|---|---|---|---|
| 161/162 | UDP | SNMP / Trap | Avoid public community |
| 9090 | TCP | Prometheus | |
| 3000 | TCP | Grafana | |
| 9100 | TCP | Node Exporter | |
| 5601 | TCP | Kibana |
Well-Known / Registered / Dynamic — what's the difference?
| Range | Numbers | Assignment |
|---|---|---|
| Well-Known | 0 – 1023 | IANA reserved (root-only on Linux) |
| Registered | 1024 – 49151 | IANA-registered for applications |
| Dynamic / Ephemeral | 49152 – 65535 | Allocated temporarily by clients |
Security rules of thumb
- Never expose clear-text protocols (Telnet, FTP, HTTP, POP3, IMAP, SNMPv2) to the open internet.
- Database ports (1433, 3306, 5432, 6379, 27017, 9200) belong behind a firewall/VPN — they are constantly scanned.
- Disable SMBv1 (445/TCP) — vulnerable to WannaCry et al.
- PPTP (1723) is broken — replace with WireGuard or OpenVPN.
- SSH (22): key-only auth, fail2ban, port-knocking or moving to a higher port reduce bot traffic.
Related tools and reading
- Port Scanner — check which ports are open on a host
- HTTP Header Check — inspect web-server config
- SSL Check — test certificate and TLS version on port 443
- Article: Ports and Firewalls explained
- Article: HTTP Security Headers Guide
- Glossary: TCP, UDP, Port, Firewall
Related Tools