← All reference
Common TCP/UDP Port Numbers
The port numbers developers actually look up — system services, web, mail, databases, message queues, containers and monitoring — grouped by category with a live filter. All data ships with the page.
A port number identifies a specific service on a host: an IP address gets the packet to the machine, the port gets it to the right process. Ports are 16-bit values (0–65535), and by convention servers listen on fixed, well-known numbers so clients know where to connect — SSH on 22, HTTPS on 443, PostgreSQL on 5432. This table covers the well-known and registered ports you'll meet in real infrastructure. Defaults are conventions, not rules: anything can be configured to listen anywhere.
System & network services
| Port | TCP/UDP | Service | What it's for |
|---|---|---|---|
| 20 | TCP | FTP (data) | FTP data channel in active mode; passive mode negotiates a high port instead |
| 21 | TCP | FTP (control) | FTP command channel — logins, directory listings, transfer commands |
| 22 | TCP | SSH | Secure shell; also carries SFTP, SCP and Git-over-SSH |
| 23 | TCP | Telnet | Legacy remote terminal, plaintext — replaced by SSH, still seen on network gear |
| 53 | TCP/UDP | DNS | Name resolution; UDP for most queries, TCP for zone transfers and large responses |
| 67 | UDP | DHCP (server) | DHCP server side — hands out IP leases to clients broadcasting from port 68 |
| 68 | UDP | DHCP (client) | DHCP client side of the lease exchange (BOOTP client) |
| 69 | UDP | TFTP | Trivial FTP — PXE network boot, firmware and config transfer on LANs |
| 88 | TCP/UDP | Kerberos | Kerberos authentication — the core of Active Directory logins |
| 111 | TCP/UDP | rpcbind / portmapper | Maps ONC RPC program numbers to ports; required by classic NFS setups |
| 123 | UDP | NTP | Network Time Protocol — clock synchronization |
| 135 | TCP | MS RPC | Microsoft RPC endpoint mapper — Windows domain and DCOM traffic |
| 137–139 | TCP/UDP | NetBIOS | Legacy Windows networking: name service (137/UDP), datagram (138/UDP), session (139/TCP) |
| 161 | UDP | SNMP | Polling network devices for metrics and status |
| 162 | UDP | SNMP traps | Devices pushing alerts to the monitoring station |
| 179 | TCP | BGP | Border Gateway Protocol — routing between autonomous systems |
| 194 | TCP | IRC | IANA-assigned IRC port; real networks mostly use 6667 (plain) and 6697 (TLS) |
| 389 | TCP/UDP | LDAP | Directory lookups — users, groups, machines (Active Directory, OpenLDAP) |
| 445 | TCP | SMB | Windows file sharing / SMB over TCP — also the classic ransomware attack surface |
| 500 | UDP | IKE (IPsec) | Key exchange for IPsec VPN tunnels |
| 514 | UDP | Syslog | Traditional syslog forwarding (TCP 514 is used by some daemons, 6514 for TLS) |
| 631 | TCP | IPP / CUPS | Internet Printing Protocol; the CUPS admin interface |
| 636 | TCP | LDAPS | LDAP over TLS |
| 853 | TCP | DNS over TLS | Encrypted DNS (DoT); DNS over HTTPS uses 443 instead |
| 873 | TCP | rsync | rsync daemon mode (rsync over SSH uses 22) |
| 1194 | UDP/TCP | OpenVPN | OpenVPN default; UDP preferred, TCP as fallback |
| 4500 | UDP | IPsec NAT-T | IPsec NAT traversal — ESP wrapped in UDP to cross NAT devices |
| 51820 | UDP | WireGuard | Conventional WireGuard VPN port (configurable, no IANA assignment) |
Web & proxies
| Port | TCP/UDP | Service | What it's for |
|---|---|---|---|
| 80 | TCP | HTTP | Plain HTTP — today mostly a redirect to 443 |
| 443 | TCP/UDP | HTTPS | HTTP over TLS; HTTP/3 (QUIC) runs on UDP 443 |
| 1080 | TCP | SOCKS | SOCKS4/5 proxy — what ssh -D gives you |
| 3128 | TCP | Squid | Squid caching/forward proxy default |
| 8080 | TCP | HTTP alternate | Second web server on a box: Tomcat, reverse-proxy backends, dev proxies |
| 8443 | TCP | HTTPS alternate | TLS on a non-privileged port — admin consoles, Tomcat SSL, ingress test setups |
| 8888 | TCP | HTTP alternate | Jupyter Notebook default; generic secondary web port |
| Port | TCP/UDP | Service | What it's for |
|---|---|---|---|
| 25 | TCP | SMTP | Server-to-server mail relay; blocked for outbound traffic by most cloud providers |
| 110 | TCP | POP3 | Download-and-delete mail retrieval, plaintext |
| 143 | TCP | IMAP | Server-side mailbox access, plaintext or STARTTLS |
| 465 | TCP | SMTPS (submission) | Mail submission over implicit TLS — re-standardized in RFC 8314 |
| 587 | TCP | SMTP submission | The standard client-to-server submission port, upgraded with STARTTLS |
| 993 | TCP | IMAPS | IMAP over implicit TLS — what modern mail clients actually use |
| 995 | TCP | POP3S | POP3 over implicit TLS |
Databases & caches
| Port | TCP/UDP | Service | What it's for |
|---|---|---|---|
| 1433 | TCP | SQL Server | Microsoft SQL Server default instance (1434/UDP is the browser service) |
| 1521 | TCP | Oracle | Oracle Database TNS listener |
| 2049 | TCP/UDP | NFS | Network File System; NFSv4 needs only this port |
| 3306 | TCP | MySQL / MariaDB | MySQL and MariaDB client connections |
| 5432 | TCP | PostgreSQL | PostgreSQL client connections |
| 5984 | TCP | CouchDB | Apache CouchDB HTTP API |
| 6379 | TCP | Redis | Redis — cache, session store, queues; never expose it unauthenticated |
| 7687 | TCP | Neo4j Bolt | Neo4j's binary Bolt protocol (7474 is its HTTP interface) |
| 8086 | TCP | InfluxDB | InfluxDB HTTP API — time-series writes and queries |
| 9042 | TCP | Cassandra | Cassandra CQL native transport for client drivers |
| 9200 | TCP | Elasticsearch | Elasticsearch / OpenSearch REST API |
| 9300 | TCP | Elasticsearch transport | Elasticsearch node-to-node cluster traffic |
| 11211 | TCP/UDP | Memcached | Memcached; UDP mode is disabled by default since the 2018 amplification attacks |
| 27017 | TCP | MongoDB | MongoDB — mongod and mongos router default |
Messaging & queues
| Port | TCP/UDP | Service | What it's for |
|---|---|---|---|
| 1883 | TCP | MQTT | Lightweight IoT pub/sub messaging, plaintext |
| 2181 | TCP | ZooKeeper | ZooKeeper client port — coordination for Kafka (legacy mode), HBase, etc. |
| 4222 | TCP | NATS | NATS client connections |
| 5672 | TCP | AMQP / RabbitMQ | AMQP 0-9-1 — RabbitMQ's main client port |
| 8883 | TCP | MQTT over TLS | Encrypted MQTT — what cloud IoT brokers require |
| 9092 | TCP | Kafka | Apache Kafka broker listener for producers and consumers |
| 15672 | TCP | RabbitMQ management | RabbitMQ web management UI and HTTP API |
Dev servers & local tooling
| Port | TCP/UDP | Service | What it's for |
|---|---|---|---|
| 3000 | TCP | Node / React / Rails | create-react-app, Next.js, Express and Rails dev defaults — also Grafana |
| 4000 | TCP | Jekyll / Phoenix | Jekyll serve and Phoenix dev server defaults |
| 4200 | TCP | Angular | Angular CLI dev server (ng serve) |
| 5000 | TCP | Flask / registry | Flask dev server and Docker Registry — collides with AirPlay on modern macOS |
| 5173 | TCP | Vite | Vite dev server default |
| 6006 | TCP | Storybook / TensorBoard | Storybook dev server; also TensorBoard's default |
| 8000 | TCP | Django / generic dev | Django runserver, python -m http.server, many ad-hoc dev servers |
| 9000 | TCP | PHP-FPM / SonarQube / MinIO | Heavily overloaded: PHP-FPM FastCGI, SonarQube UI, MinIO S3 API |
| 9418 | TCP | Git daemon | The native git:// protocol — unauthenticated, read-only mirrors |
Containers & orchestration
| Port | TCP/UDP | Service | What it's for |
|---|---|---|---|
| 2375 | TCP | Docker API (plain) | Unencrypted, unauthenticated Docker daemon socket — root on the host if exposed |
| 2376 | TCP | Docker API (TLS) | Docker daemon with TLS client-certificate auth |
| 2379 | TCP | etcd (client) | etcd client API — Kubernetes' state store |
| 2380 | TCP | etcd (peer) | etcd server-to-server raft traffic |
| 6443 | TCP | Kubernetes API | kube-apiserver — the endpoint kubectl talks to |
| 10250 | TCP | kubelet | Kubelet API on every node — logs, exec, metrics; keep it off the internet |
| 30000–32767 | TCP/UDP | NodePort range | Kubernetes' default range for NodePort services |
Remote desktop & access
| Port | TCP/UDP | Service | What it's for |
|---|---|---|---|
| 3389 | TCP/UDP | RDP | Windows Remote Desktop; UDP transport speeds it up when available |
| 5900 | TCP | VNC | VNC display :0; display :1 is 5901, :2 is 5902, and so on |
Monitoring & logging
| Port | TCP/UDP | Service | What it's for |
|---|---|---|---|
| 3000 | TCP | Grafana | Grafana web UI (shared with the Node dev-server convention) |
| 5044 | TCP | Beats / Logstash | Elastic Beats shipping logs into Logstash |
| 5601 | TCP | Kibana | Kibana / OpenSearch Dashboards web UI |
| 8125 | UDP | StatsD | StatsD metric ingestion — fire-and-forget UDP counters and timers |
| 9090 | TCP | Prometheus | Prometheus server UI and API |
| 9093 | TCP | Alertmanager | Prometheus Alertmanager |
| 9100 | TCP | node_exporter | Prometheus host metrics exporter (historically HP JetDirect raw printing) |
| 24224 | TCP/UDP | Fluentd | Fluentd forward protocol for log shipping |
How port numbers work
IANA divides the 16-bit port space into three ranges:
| Range | Name | Meaning |
|---|---|---|
| 0–1023 | Well-known (system) | Reserved for core services (HTTP, SSH, DNS). On Unix-like systems, binding to these traditionally requires root or CAP_NET_BIND_SERVICE. |
| 1024–49151 | Registered (user) | Registered with IANA for specific applications (PostgreSQL 5432, RDP 3389), but any process can bind them — many popular defaults here were never formally registered. |
| 49152–65535 | Dynamic / ephemeral | The pool the OS picks from for the client side of a connection. Linux defaults to 32768–60999 (ip_local_port_range), overlapping the registered range. |
A TCP connection is identified by the 4-tuple (source IP, source port, destination IP, destination port) — that's how one server port serves thousands of clients simultaneously. TCP and UDP port spaces are independent: TCP 53 and UDP 53 are separate registrations that happen to be the same service (DNS), and a port can be assigned to different things in each protocol. "Port in use" errors (EADDRINUSE) mean another process already bound that port on the same address — find it with lsof -i :PORT or netstat -ano on Windows.
About this reference
Port assignments follow the IANA Service Name and Transport Protocol Port Number Registry plus the de-facto conventions of widely used software (Docker, Kubernetes, dev servers) that shape what these ports mean in practice. Defaults shown are what stock installs use — production deployments often move them.
Related tools on this site: subnet math with the CIDR calculator, resolve records with the DNS lookup, and inspect certificates with the certificate decoder. The filter above runs entirely in your browser — nothing you type leaves the page.