Well-known network ports an admin meets every week, with the transport protocol and what each one is for.
TCP/UDP means both are used or registered. Numbers are defaults: services can be moved to other ports.
Remote access and file transfer
| Port | Protocol | Service | Used for |
|---|---|---|---|
| 20, 21 | TCP | FTP | 21 is control, 20 is data in active mode. Sends passwords in clear text. |
| 22 | TCP | SSH, SFTP, SCP | Encrypted remote shell and file transfer |
| 23 | TCP | Telnet | Unencrypted remote shell. Avoid; still found on old network gear. |
| 69 | UDP | TFTP | Simple file transfer with no login: PXE boot, switch and phone configs |
| 990 | TCP | FTPS (implicit TLS) | FTP wrapped in TLS |
| 3389 | TCP/UDP | RDP | Windows Remote Desktop. UDP improves performance when allowed. |
| 5900 | TCP | VNC | Remote desktop for many platforms (display :0; :1 is 5901) |
| 5985 | TCP | WinRM HTTP | PowerShell remoting (message-level encryption in a domain) |
| 5986 | TCP | WinRM HTTPS | PowerShell remoting over TLS |
Web and email
| Port | Protocol | Service | Used for |
|---|---|---|---|
| 80 | TCP | HTTP | Unencrypted web traffic, redirects to HTTPS |
| 443 | TCP | HTTPS | Web traffic over TLS |
| 443 | UDP | HTTP/3 (QUIC) | Newer HTTPS transport used by modern browsers |
| 8080 | TCP | HTTP alternate | Proxies, test servers, admin consoles |
| 8443 | TCP | HTTPS alternate | Admin consoles and appliances (by convention) |
| 25 | TCP | SMTP | Mail server to mail server delivery. Often blocked outbound by ISPs. |
| 587 | TCP | SMTP submission | Mail clients and devices sending mail, with STARTTLS and login |
| 465 | TCP | SMTPS | Mail submission over implicit TLS |
| 110 | TCP | POP3 | Download mail, unencrypted |
| 995 | TCP | POP3S | POP3 over TLS |
| 143 | TCP | IMAP | Mailbox access, unencrypted or STARTTLS |
| 993 | TCP | IMAPS | IMAP over TLS |
Core network services
| Port | Protocol | Service | Used for |
|---|---|---|---|
| 53 | TCP/UDP | DNS | Name lookups use UDP. TCP for zone transfers and large answers. |
| 853 | TCP | DNS over TLS | Encrypted DNS lookups |
| 67 | UDP | DHCP server | Hands out IP addresses (server listens here) |
| 68 | UDP | DHCP client | Client side of DHCP |
| 546, 547 | UDP | DHCPv6 | 546 client, 547 server |
| 123 | UDP | NTP | Time sync. Kerberos breaks if clocks drift more than 5 minutes. |
| 161 | UDP | SNMP | Polling devices for status and counters |
| 162 | UDP | SNMP trap | Devices sending alerts to a monitoring server |
| 514 | UDP | Syslog | Sending log messages to a collector |
| 6514 | TCP | Syslog over TLS | Encrypted syslog |
| 1812 | UDP | RADIUS authentication | Wi-Fi (802.1X), VPN and switch logins |
| 1813 | UDP | RADIUS accounting | Session records. Old gear may use 1645 and 1646. |
| 49 | TCP | TACACS+ | Network device admin logins (common on Cisco) |
| 179 | TCP | BGP | Routing between networks and providers |
| 5353 | UDP | mDNS | Local name discovery (Bonjour, printers, .local names) |
| 5355 | UDP | LLMNR | Windows local name fallback. Often disabled for security. |
Windows and Active Directory
| Port | Protocol | Service | Used for |
|---|---|---|---|
| 88 | TCP/UDP | Kerberos | Domain authentication |
| 464 | TCP/UDP | Kerberos password change | kpasswd: users changing passwords |
| 135 | TCP | RPC endpoint mapper | Tells clients which dynamic port a Windows service is on |
| 49152-65535 | TCP | RPC dynamic range | Ports handed out by the endpoint mapper (Vista and Server 2008 onward) |
| 137 | UDP | NetBIOS name service | Legacy Windows name resolution |
| 138 | UDP | NetBIOS datagram | Legacy browsing and announcements |
| 139 | TCP | NetBIOS session | SMB over NetBIOS, legacy file sharing |
| 445 | TCP | SMB | Windows file and printer sharing, SYSVOL, Group Policy. Never expose to the internet. |
| 389 | TCP/UDP | LDAP | Directory queries. UDP is used by the domain controller locator. |
| 636 | TCP | LDAPS | LDAP over TLS |
| 3268 | TCP | Global Catalog | Forest-wide LDAP searches |
| 3269 | TCP | Global Catalog over TLS | Forest-wide searches over TLS |
| 9389 | TCP | AD Web Services | Used by the ActiveDirectory PowerShell module and AD Administrative Center |
| 8530 | TCP | WSUS HTTP | Clients getting updates from WSUS |
| 8531 | TCP | WSUS HTTPS | WSUS over TLS |
Databases
| Port | Protocol | Service | Used for |
|---|---|---|---|
| 1433 | TCP | Microsoft SQL Server | Default instance |
| 1434 | UDP | SQL Server Browser | Finds named instances and their ports |
| 3306 | TCP | MySQL, MariaDB | Default port |
| 5432 | TCP | PostgreSQL | Default port |
| 1521 | TCP | Oracle | Database listener (conventional default) |
| 27017 | TCP | MongoDB | Default port |
| 6379 | TCP | Redis | Default port. Never expose without authentication. |
VPN, storage, printing and voice
| Port | Protocol | Service | Used for |
|---|---|---|---|
| 500 | UDP | IKE | IPsec VPN key exchange |
| 4500 | UDP | IPsec NAT traversal | IPsec through NAT |
| 1194 | UDP | OpenVPN | Default port (TCP is also possible) |
| 51820 | UDP | WireGuard | Common default port |
| 1723 | TCP | PPTP | Legacy VPN. Insecure, replace it. |
| 2049 | TCP/UDP | NFS | Unix and Linux file sharing |
| 111 | TCP/UDP | rpcbind | Maps RPC services, used by older NFS |
| 3260 | TCP | iSCSI | Block storage over the network |
| 631 | TCP | IPP | Internet Printing Protocol, CUPS |
| 9100 | TCP | Raw printing | Direct print jobs to a printer (JetDirect) |
| 5060 | TCP/UDP | SIP | VoIP call setup |
| 5061 | TCP | SIP over TLS | Encrypted VoIP call setup |
Check a port
| Task | Command |
|---|---|
| Windows: can I reach it? | Test-NetConnection server01 -Port 445 |
| Windows: what is listening locally? | Get-NetTCPConnection -State Listen or netstat -ano |
| Linux: what is listening locally? | ss -tulpn |
| Linux: can I reach it? | nc -zv server01 22 |
Ping uses ICMP, which has no port number. A failed ping does not prove a TCP port is closed.