Support Library
Common TCP and UDP Ports Explained
A port number tells a computer which service should receive network traffic, such as 443 for HTTPS or 25 for email. This guide lists the TCP and UDP ports you will meet most often and what runs on each one.
The short answer
A port is a number from 0 to 65535 that tells a computer which program should receive a piece of network traffic. The IP address gets the traffic to the right machine. The port gets it to the right service on that machine, such as the web server on 443 or the mail server on 25.
Ports belong to a transport protocol. TCP port 53 and UDP port 53 are separate, which is why the tables below list the protocol next to each number. The TCP vs UDP guide explains how the two differ.
How ports work
Every TCP connection and UDP exchange has a source port and a destination port. A server listens on a fixed, well-known port so clients know where to find it. The client picks a temporary port of its own, called an ephemeral port, for the reply to come back to.
So when a browser opens a site, the connection might run from 203.0.113.7:51544 on your laptop to 198.51.100.20:443 on the server. The pair of addresses and ports, plus the protocol, identifies that one connection.
The port numbers in this guide are conventions registered with IANA, not rules. A service can listen on any port, and the same port can be used for something else entirely. A scanner that finds port 3306 open is telling you something is listening there, which is very likely MySQL, but not certainly.
Port ranges
| Range | Name | Used for |
|---|---|---|
| 0–1023 | Well-known ports | Core internet services such as DNS, HTTP and SMTP. On Linux and macOS, a program needs extra privileges to listen on them. |
| 1024–49151 | Registered ports | Services registered with IANA, such as databases, VPNs and remote desktop. |
| 49152–65535 | Dynamic or private ports | Temporary client-side ports. Many Linux systems pick ephemeral ports from 32768–60999 instead. |
Web ports
A URL with no port in it uses 443 for https:// and 80 for http://. Any other port has to be written in the address, as in https://example.com:8443/.
| Port | Protocol | Service | What it is for |
|---|---|---|---|
| 80 | TCP | HTTP | Plain, unencrypted web traffic. Most sites only use it to redirect visitors to HTTPS. |
| 443 | TCP | HTTPS | Encrypted web traffic (HTTP/1.1 and HTTP/2 over TLS). Also carries DNS over HTTPS. |
| 443 | UDP | HTTP/3 (QUIC) | The newest version of HTTP, which runs over QUIC instead of TCP. |
| 8080 | TCP | HTTP alternate | A common choice for proxies, development servers and admin consoles. |
| 8443 | TCP | HTTPS alternate | A second HTTPS port, often used by appliances and management interfaces. |
A browser that sees an HTTPS record or an Alt-Svc header can switch to HTTP/3 on UDP 443. The SVCB and HTTPS records guide covers how DNS advertises that.
Email ports
Email uses different ports for servers talking to each other and for people sending and reading their own mail.
| Port | Protocol | Service | What it is for |
|---|---|---|---|
| 25 | TCP | SMTP | Mail servers passing messages to each other. Your MX records point here. |
| 587 | TCP | SMTP submission | Mail apps sending outgoing mail through their own provider, upgraded to TLS with STARTTLS. |
| 465 | TCP | SMTP submission over TLS | The same job as 587, but encrypted from the first byte. RFC 8314 recommends it. |
| 143 | TCP | IMAP | Reading mail that stays on the server. |
| 993 | TCP | IMAPS | IMAP over TLS. Use this instead of 143. |
| 110 | TCP | POP3 | Downloading mail to one device. |
| 995 | TCP | POP3S | POP3 over TLS. Use this instead of 110. |
Many home and cloud networks block outbound TCP 25 to stop infected machines sending spam. Mail apps should use 587 or 465 instead. Server-to-server delivery on 25 can be protected with MTA-STS or DANE.
DNS ports
| Port | Protocol | Service | What it is for |
|---|---|---|---|
| 53 | UDP and TCP | DNS | Ordinary DNS queries. UDP for most answers, TCP for large ones and zone transfers. |
| 853 | TCP | DNS over TLS | Encrypted DNS between a client and its resolver. |
| 853 | UDP | DNS over QUIC | Encrypted DNS over QUIC. |
| 443 | TCP and UDP | DNS over HTTPS | Encrypted DNS that looks like ordinary web traffic. |
| 5353 | UDP | Multicast DNS (mDNS) | Name lookups on a local network without a DNS server, such as printers and speakers. |
A firewall that allows UDP 53 but blocks TCP 53 breaks large answers, including many DNSSEC responses, in ways that are hard to spot. The DoH vs DoT vs DoQ guide compares the encrypted options.
Remote access ports
| Port | Protocol | Service | What it is for |
|---|---|---|---|
| 22 | TCP | SSH, SFTP, SCP | Encrypted remote shell and file transfer. |
| 23 | TCP | Telnet | Unencrypted remote shell. Passwords cross the network in plain text. |
| 3389 | TCP and UDP | RDP | Windows Remote Desktop. |
| 5900 | TCP | VNC | Remote screen sharing. Later displays use 5901, 5902 and so on. |
These are the ports attackers try first. SSH on 22 and RDP on 3389 see constant password-guessing from the moment they are reachable. Keep them behind a VPN or an allow list where you can, and turn off Telnet.
File sharing ports
| Port | Protocol | Service | What it is for |
|---|---|---|---|
| 20, 21 | TCP | FTP | File transfer. Port 21 carries commands and 20 carries data in active mode. Unencrypted. |
| 990 | TCP | FTPS | FTP wrapped in TLS. |
| 69 | UDP | TFTP | Very simple file transfer, used to boot network devices and load phone configs. |
| 445 | TCP | SMB | Windows file and printer sharing. |
| 137–139 | UDP and TCP | NetBIOS | Older Windows name and session services that SMB used to depend on. |
| 2049 | TCP and UDP | NFS | Unix and Linux network file systems. |
SMB on 445 and NetBIOS on 137–139 should not be reachable from the internet. Several of the worst worms, including WannaCry, spread through exposed SMB.
Directory and sign-in ports
| Port | Protocol | Service | What it is for |
|---|---|---|---|
| 88 | TCP and UDP | Kerberos | Sign-in tickets for Active Directory and other Kerberos realms. |
| 389 | TCP and UDP | LDAP | Directory lookups, such as finding users and groups. |
| 636 | TCP | LDAPS | LDAP over TLS. |
| 1812, 1813 | UDP | RADIUS | Authentication and accounting for Wi-Fi, VPNs and network devices. |
Active Directory finds its domain controllers through DNS SRV records such as _ldap._tcp and _kerberos._tcp, which carry these port numbers. The SRV records guide shows how.
Network infrastructure ports
| Port | Protocol | Service | What it is for |
|---|---|---|---|
| 67, 68 | UDP | DHCP | Handing out IP addresses. Servers listen on 67 and clients on 68. |
| 123 | UDP | NTP | Keeping clocks in sync. Certificates, Kerberos and DNSSEC all need the right time. |
| 161, 162 | UDP | SNMP | Monitoring network devices. 161 answers queries and 162 receives alerts (traps). |
| 514 | UDP | Syslog | Sending log messages to a central server. Syslog over TLS uses TCP 6514. |
| 179 | TCP | BGP | Routers exchanging internet routes. |
Open NTP and SNMP servers on UDP can be abused to send floods of traffic to a spoofed victim, the same trick used in DNS amplification attacks. Answer only the networks you serve.
VPN ports
| Port | Protocol | Service | What it is for |
|---|---|---|---|
| 500 | UDP | IKE (IPsec) | Setting up IPsec VPN tunnels. |
| 4500 | UDP | IPsec NAT traversal | IPsec traffic wrapped in UDP so it can pass through NAT. |
| 1194 | UDP | OpenVPN | The default OpenVPN port. TCP 1194 or 443 are used where UDP is blocked. |
| 51820 | UDP | WireGuard | The usual WireGuard port, although any UDP port can be configured. |
Database and cache ports
| Port | Protocol | Service | What it is for |
|---|---|---|---|
| 1433 | TCP | Microsoft SQL Server | SQL Server databases. |
| 1521 | TCP | Oracle Database | The Oracle listener. |
| 3306 | TCP | MySQL, MariaDB | MySQL and MariaDB databases. |
| 5432 | TCP | PostgreSQL | PostgreSQL databases. |
| 6379 | TCP | Redis | In-memory data store and cache. |
| 11211 | TCP and UDP | Memcached | In-memory cache. Open UDP 11211 has been abused for very large reflection attacks. |
| 27017 | TCP | MongoDB | MongoDB databases. |
| 9200 | TCP | Elasticsearch | The Elasticsearch HTTP API. |
Databases and caches are meant to be reached by your own applications, not the whole internet. Exposed Redis, MongoDB and Elasticsearch servers are a common source of data leaks, often because they were installed with no password.
Voice and video ports
| Port | Protocol | Service | What it is for |
|---|---|---|---|
| 5060 | UDP and TCP | SIP | Setting up voice and video calls. |
| 5061 | TCP | SIP over TLS | Encrypted SIP signaling. |
| 3478 | UDP and TCP | STUN, TURN | Helping calls and video meetings get through NAT and firewalls. |
Calls also need a wide range of UDP ports for the audio and video itself (RTP). The exact range depends on the phone system or meeting service, so check its documentation before you open a firewall.
How to check whether a port is open
Only test systems you own or have permission to test. A quick check of a single TCP port:
MacOS and Linux:
nc -vz example.com 443Windows PowerShell:
Test-NetConnection example.com -Port 443To see what is listening on your own machine, use ss -tulpn on Linux, lsof -i -P -n on macOS or netstat -ano on Windows.
To check a public host from outside your network, use the TCP Port Check.
A port that does not answer can be in one of two states. Closed means the machine replied that nothing is listening, so the connection is refused straight away. Filtered means a firewall dropped the traffic, so the connection just times out. The TCP handshakes and port states guide explains both. UDP is harder to test because a service often sends nothing back to a probe it does not understand.
How DNS Panopticon uses ports
DNS Panopticon does not scan ranges of ports. Its scans only connect to the standard ports a visitor would use, and one tool checks a single port you choose:
- Website Recon opens the homepage on 443 (HTTPS) first and falls back to 80 (HTTP) if that fails. The Homepage card shows which one answered.
- The HTTP Status Code Verification tool in Zone Analyzer requests each selected host over HTTPS on 443.
- Domain Visualizer asks its DNS questions through public resolvers over DNS over HTTPS, an encrypted web request, rather than as plain DNS on port 53.
- The TCP Port Check opens a TCP connection to one host and port you enter, from Cloudflare’s network, and reports whether it is open, closed or filtered, with the handshake and connect times.
When a site does not answer at all, there is no HTTP status code to show. The HTTP status codes guide explains what each kind of failure means.
FAQ
What is the difference between TCP and UDP ports?
They are separate number spaces. TCP port 53 and UDP port 53 are different ports, even though DNS happens to use both. A firewall rule has to name the protocol as well as the number.
Which ports does a website need?
TCP 443 for HTTPS, plus TCP 80 if you want plain http:// addresses to redirect to HTTPS. Allow UDP 443 as well if you serve HTTP/3.
Is it dangerous to have open ports?
An open port is only as risky as the service behind it. Web and mail ports are meant to be public. Remote access, file sharing and database ports should be limited to the people and systems that need them.
Does changing a service to a non-standard port make it secure?
Not on its own. Moving SSH off port 22 cuts down on automated noise, but scanners check every port. Strong authentication and a firewall matter far more.