Networking Reference
Common Ports Reference
A port number identifies which service on a machine a connection is meant for: 80 and 443 are HTTP and HTTPS, 22 is SSH, 25 and 587 are SMTP, 3306 is MySQL and 5432 is PostgreSQL. This reference lists the ports you will meet in practice, with their transport protocol.
Browse by Category
Web & Proxies
9HTTP, HTTPS, alternates and proxy ports.
Sending and retrieving mail, plain and encrypted.
File Transfer
8Moving files between machines.
Remote Access
9Shells, desktops and management protocols.
Databases
15Relational, document, cache and search engines.
Core Network Services
14DNS, DHCP, time, directory and routing.
Messaging & Streaming
10Queues, brokers and real-time transports.
DevOps & Monitoring
14Orchestration, metrics and container tooling.
All Common Ports (87)
Web & Proxies (9)
HTTP, HTTPS, alternates and proxy ports.
| Port | Service | What runs here | Protocol |
|---|---|---|---|
80 | HTTP | Unencrypted web traffic. Now used mainly to redirect straight to 443 and to answer ACME certificate challenges. | TCP |
443 | HTTPS | Web traffic over TLS, and the port HTTP/2 and HTTP/3 run on. QUIC uses 443 over UDP rather than TCP. | TCP · UDP |
8080 | HTTP alternate | The conventional port for a development server or an application behind a reverse proxy, since it needs no root privileges. | TCP |
8443 | HTTPS alternate | TLS equivalent of 8080, common for admin consoles and appliances. | TCP |
3000 | Node / React dev | The default for Create React App, Next.js and many Express templates. A convention, not an assignment. | TCP |
5173 | Vite dev server | The default development port for Vite-based frontends. | TCP |
8000 | Django / Python dev | Default for Django runserver and python -m http.server. | TCP |
3128 | Squid proxy | Default listening port for the Squid caching HTTP proxy. | TCP |
1080 | SOCKS proxy | SOCKS4 and SOCKS5 proxies, including the dynamic tunnel created by ssh -D. | TCP |
Service
HTTP
What runs here
Unencrypted web traffic. Now used mainly to redirect straight to 443 and to answer ACME certificate challenges.
Protocol
TCP
Service
HTTPS
What runs here
Web traffic over TLS, and the port HTTP/2 and HTTP/3 run on. QUIC uses 443 over UDP rather than TCP.
Protocol
TCP · UDP
Service
HTTP alternate
What runs here
The conventional port for a development server or an application behind a reverse proxy, since it needs no root privileges.
Protocol
TCP
Service
HTTPS alternate
What runs here
TLS equivalent of 8080, common for admin consoles and appliances.
Protocol
TCP
Service
Node / React dev
What runs here
The default for Create React App, Next.js and many Express templates. A convention, not an assignment.
Protocol
TCP
Service
Vite dev server
What runs here
The default development port for Vite-based frontends.
Protocol
TCP
Service
Django / Python dev
What runs here
Default for Django runserver and python -m http.server.
Protocol
TCP
Service
Squid proxy
What runs here
Default listening port for the Squid caching HTTP proxy.
Protocol
TCP
Service
SOCKS proxy
What runs here
SOCKS4 and SOCKS5 proxies, including the dynamic tunnel created by ssh -D.
Protocol
TCP
Email (8)
Sending and retrieving mail, plain and encrypted.
| Port | Service | What runs here | Protocol |
|---|---|---|---|
25 | SMTP | Server-to-server mail delivery. Widely blocked for residential and cloud clients to limit spam, so it is rarely the right port for an app. | TCP |
587 | SMTP submission | The correct port for a mail client or application to submit outgoing mail, upgrading to TLS with STARTTLS. | TCP |
465 | SMTPS | Submission over implicit TLS — encrypted from the first byte. Deprecated, then reinstated, and now widely supported. | TCP |
110 | POP3 | Downloads mail and typically deletes it from the server. Unencrypted. | TCP |
995 | POP3S | POP3 over implicit TLS. | TCP |
143 | IMAP | Reads mail while leaving it on the server, keeping several devices in sync. Unencrypted. | TCP |
993 | IMAPS | IMAP over implicit TLS — the port almost every modern mail client uses. | TCP |
2525 | SMTP alternate | An unofficial fallback offered by many providers when 25 and 587 are blocked upstream. | TCP |
Service
SMTP
What runs here
Server-to-server mail delivery. Widely blocked for residential and cloud clients to limit spam, so it is rarely the right port for an app.
Protocol
TCP
Service
SMTP submission
What runs here
The correct port for a mail client or application to submit outgoing mail, upgrading to TLS with STARTTLS.
Protocol
TCP
Service
SMTPS
What runs here
Submission over implicit TLS — encrypted from the first byte. Deprecated, then reinstated, and now widely supported.
Protocol
TCP
Service
POP3
What runs here
Downloads mail and typically deletes it from the server. Unencrypted.
Protocol
TCP
Service
POP3S
What runs here
POP3 over implicit TLS.
Protocol
TCP
Service
IMAP
What runs here
Reads mail while leaving it on the server, keeping several devices in sync. Unencrypted.
Protocol
TCP
Service
IMAPS
What runs here
IMAP over implicit TLS — the port almost every modern mail client uses.
Protocol
TCP
Service
SMTP alternate
What runs here
An unofficial fallback offered by many providers when 25 and 587 are blocked upstream.
Protocol
TCP
File Transfer (8)
Moving files between machines.
| Port | Service | What runs here | Protocol |
|---|---|---|---|
20 | FTP data | The data channel in active-mode FTP. Passive mode uses a high random port instead, which is why FTP and firewalls fight. | TCP |
21 | FTP control | The FTP command channel. Credentials cross in plaintext — use SFTP or FTPS instead. | TCP |
22 | SFTP / SCP | File transfer tunnelled inside SSH. Same port as SSH because it is the same protocol. | TCP |
69 | TFTP | Trivial FTP — no authentication, used for network booting and switch firmware. | UDP |
990 | FTPS | FTP over implicit TLS. Distinct from SFTP, which is not FTP at all. | TCP |
445 | SMB | Windows file and printer sharing. Should never be exposed to the internet — the vector for WannaCry and EternalBlue. | TCP |
2049 | NFS | Network File System, the standard Unix network share. | TCP · UDP |
873 | rsync daemon | rsync running as a standalone daemon rather than over SSH. | TCP |
Service
FTP data
What runs here
The data channel in active-mode FTP. Passive mode uses a high random port instead, which is why FTP and firewalls fight.
Protocol
TCP
Service
FTP control
What runs here
The FTP command channel. Credentials cross in plaintext — use SFTP or FTPS instead.
Protocol
TCP
Service
SFTP / SCP
What runs here
File transfer tunnelled inside SSH. Same port as SSH because it is the same protocol.
Protocol
TCP
Service
TFTP
What runs here
Trivial FTP — no authentication, used for network booting and switch firmware.
Protocol
UDP
Service
FTPS
What runs here
FTP over implicit TLS. Distinct from SFTP, which is not FTP at all.
Protocol
TCP
Service
SMB
What runs here
Windows file and printer sharing. Should never be exposed to the internet — the vector for WannaCry and EternalBlue.
Protocol
TCP
Service
NFS
What runs here
Network File System, the standard Unix network share.
Protocol
TCP · UDP
Service
rsync daemon
What runs here
rsync running as a standalone daemon rather than over SSH.
Protocol
TCP
Remote Access (9)
Shells, desktops and management protocols.
| Port | Service | What runs here | Protocol |
|---|---|---|---|
22 | SSH | Encrypted remote shell, port forwarding and file transfer. The one management port that should be open, and only with key authentication. | TCP |
23 | Telnet | Unencrypted remote shell, including the password. Obsolete — every use should be SSH. | TCP |
3389 | RDP | Windows Remote Desktop. A constant brute-force target; put it behind a VPN. | TCP · UDP |
5900 | VNC | Remote framebuffer access. Each extra display adds one to the port, so :1 is 5901. | TCP |
5985 | WinRM (HTTP) | Windows Remote Management over HTTP, used by PowerShell remoting and Ansible. | TCP |
5986 | WinRM (HTTPS) | The TLS-protected equivalent of 5985, and the one to use. | TCP |
1194 | OpenVPN | Default OpenVPN port. UDP by default for performance; TCP is available where UDP is blocked. | UDP · TCP |
51820 | WireGuard | Default WireGuard port. UDP only — the protocol has no TCP mode. | UDP |
500 | IKE / IPsec | Key exchange for IPsec VPNs. Paired with 4500 for NAT traversal. | UDP |
Service
SSH
What runs here
Encrypted remote shell, port forwarding and file transfer. The one management port that should be open, and only with key authentication.
Protocol
TCP
Service
Telnet
What runs here
Unencrypted remote shell, including the password. Obsolete — every use should be SSH.
Protocol
TCP
Service
RDP
What runs here
Windows Remote Desktop. A constant brute-force target; put it behind a VPN.
Protocol
TCP · UDP
Service
VNC
What runs here
Remote framebuffer access. Each extra display adds one to the port, so :1 is 5901.
Protocol
TCP
Service
WinRM (HTTP)
What runs here
Windows Remote Management over HTTP, used by PowerShell remoting and Ansible.
Protocol
TCP
Service
WinRM (HTTPS)
What runs here
The TLS-protected equivalent of 5985, and the one to use.
Protocol
TCP
Service
OpenVPN
What runs here
Default OpenVPN port. UDP by default for performance; TCP is available where UDP is blocked.
Protocol
UDP · TCP
Service
WireGuard
What runs here
Default WireGuard port. UDP only — the protocol has no TCP mode.
Protocol
UDP
Service
IKE / IPsec
What runs here
Key exchange for IPsec VPNs. Paired with 4500 for NAT traversal.
Protocol
UDP
Databases (15)
Relational, document, cache and search engines.
| Port | Service | What runs here | Protocol |
|---|---|---|---|
3306 | MySQL / MariaDB | The default MySQL and MariaDB port. Bind it to localhost and reach it over an SSH tunnel. | TCP |
5432 | PostgreSQL | The default PostgreSQL port. | TCP |
1433 | SQL Server | Microsoft SQL Server. Named instances are discovered on UDP 1434. | TCP |
1521 | Oracle DB | The Oracle TNS listener. | TCP |
27017 | MongoDB | Default MongoDB port. Early versions shipped with no authentication, which produced a long run of public data breaches. | TCP |
6379 | Redis | Default Redis port. Unauthenticated by default in older builds and trivially exploitable if exposed. | TCP |
11211 | Memcached | Default Memcached port. Its UDP mode was heavily abused for DDoS amplification and is now off by default. | TCP · UDP |
9200 | Elasticsearch HTTP | The REST API for Elasticsearch and OpenSearch. | TCP |
9300 | Elasticsearch transport | Node-to-node communication inside an Elasticsearch cluster. | TCP |
7000 | Cassandra internode | Cluster gossip between Cassandra nodes; 7001 is the TLS equivalent. | TCP |
9042 | Cassandra CQL | The client-facing CQL port for Cassandra. | TCP |
8086 | InfluxDB | HTTP API for the InfluxDB time-series database. | TCP |
7687 | Neo4j Bolt | The Bolt protocol for the Neo4j graph database; 7474 serves its HTTP browser. | TCP |
5984 | CouchDB | The CouchDB HTTP API. | TCP |
8123 | ClickHouse HTTP | HTTP interface for ClickHouse; 9000 carries its native protocol. | TCP |
Service
MySQL / MariaDB
What runs here
The default MySQL and MariaDB port. Bind it to localhost and reach it over an SSH tunnel.
Protocol
TCP
Service
PostgreSQL
What runs here
The default PostgreSQL port.
Protocol
TCP
Service
SQL Server
What runs here
Microsoft SQL Server. Named instances are discovered on UDP 1434.
Protocol
TCP
Service
Oracle DB
What runs here
The Oracle TNS listener.
Protocol
TCP
Service
MongoDB
What runs here
Default MongoDB port. Early versions shipped with no authentication, which produced a long run of public data breaches.
Protocol
TCP
Service
Redis
What runs here
Default Redis port. Unauthenticated by default in older builds and trivially exploitable if exposed.
Protocol
TCP
Service
Memcached
What runs here
Default Memcached port. Its UDP mode was heavily abused for DDoS amplification and is now off by default.
Protocol
TCP · UDP
Service
Elasticsearch HTTP
What runs here
The REST API for Elasticsearch and OpenSearch.
Protocol
TCP
Service
Elasticsearch transport
What runs here
Node-to-node communication inside an Elasticsearch cluster.
Protocol
TCP
Service
Cassandra internode
What runs here
Cluster gossip between Cassandra nodes; 7001 is the TLS equivalent.
Protocol
TCP
Service
Cassandra CQL
What runs here
The client-facing CQL port for Cassandra.
Protocol
TCP
Service
InfluxDB
What runs here
HTTP API for the InfluxDB time-series database.
Protocol
TCP
Service
Neo4j Bolt
What runs here
The Bolt protocol for the Neo4j graph database; 7474 serves its HTTP browser.
Protocol
TCP
Service
CouchDB
What runs here
The CouchDB HTTP API.
Protocol
TCP
Service
ClickHouse HTTP
What runs here
HTTP interface for ClickHouse; 9000 carries its native protocol.
Protocol
TCP
Core Network Services (14)
DNS, DHCP, time, directory and routing.
| Port | Service | What runs here | Protocol |
|---|---|---|---|
53 | DNS | Name resolution. UDP for ordinary queries, TCP when a response exceeds 512 bytes or for zone transfers. | UDP · TCP |
853 | DNS over TLS | Encrypted DNS, so queries are not readable in transit. DNS over HTTPS uses 443 instead. | TCP |
67 | DHCP server | Where a DHCP server listens for address requests. | UDP |
68 | DHCP client | Where the client listens for the server's offer. | UDP |
123 | NTP | Clock synchronisation. Skewed clocks break TLS validation and token expiry, so this matters more than it looks. | UDP |
161 | SNMP | Polling devices for monitoring data. Versions 1 and 2c send the community string in the clear. | UDP |
162 | SNMP trap | Where a monitoring system receives unsolicited alerts from devices. | UDP |
389 | LDAP | Directory lookups against Active Directory or OpenLDAP. Unencrypted. | TCP |
636 | LDAPS | LDAP over TLS — the port to use for anything carrying credentials. | TCP |
88 | Kerberos | Ticket-based authentication, central to Active Directory logins. | TCP · UDP |
514 | Syslog | Remote log collection. UDP by default, so delivery is not guaranteed. | UDP |
179 | BGP | The routing protocol that connects autonomous systems — the internet's backbone routing. | TCP |
546 | DHCPv6 client | IPv6 address configuration on the client side; 547 is the server. | UDP |
5353 | mDNS | Multicast DNS for local discovery — Bonjour, AirPlay and .local names. | UDP |
Service
DNS
What runs here
Name resolution. UDP for ordinary queries, TCP when a response exceeds 512 bytes or for zone transfers.
Protocol
UDP · TCP
Service
DNS over TLS
What runs here
Encrypted DNS, so queries are not readable in transit. DNS over HTTPS uses 443 instead.
Protocol
TCP
Service
DHCP server
What runs here
Where a DHCP server listens for address requests.
Protocol
UDP
Service
DHCP client
What runs here
Where the client listens for the server's offer.
Protocol
UDP
Service
NTP
What runs here
Clock synchronisation. Skewed clocks break TLS validation and token expiry, so this matters more than it looks.
Protocol
UDP
Service
SNMP
What runs here
Polling devices for monitoring data. Versions 1 and 2c send the community string in the clear.
Protocol
UDP
Service
SNMP trap
What runs here
Where a monitoring system receives unsolicited alerts from devices.
Protocol
UDP
Service
LDAP
What runs here
Directory lookups against Active Directory or OpenLDAP. Unencrypted.
Protocol
TCP
Service
LDAPS
What runs here
LDAP over TLS — the port to use for anything carrying credentials.
Protocol
TCP
Service
Kerberos
What runs here
Ticket-based authentication, central to Active Directory logins.
Protocol
TCP · UDP
Service
Syslog
What runs here
Remote log collection. UDP by default, so delivery is not guaranteed.
Protocol
UDP
Service
BGP
What runs here
The routing protocol that connects autonomous systems — the internet's backbone routing.
Protocol
TCP
Service
DHCPv6 client
What runs here
IPv6 address configuration on the client side; 547 is the server.
Protocol
UDP
Service
mDNS
What runs here
Multicast DNS for local discovery — Bonjour, AirPlay and .local names.
Protocol
UDP
Messaging & Streaming (10)
Queues, brokers and real-time transports.
| Port | Service | What runs here | Protocol |
|---|---|---|---|
5672 | AMQP / RabbitMQ | The AMQP 0-9-1 message broker port; 5671 is the TLS version. | TCP |
15672 | RabbitMQ management | The RabbitMQ web management UI — an admin surface that should not face the internet. | TCP |
9092 | Kafka broker | The default Apache Kafka broker port for producers and consumers. | TCP |
2181 | ZooKeeper | Coordination service used by older Kafka clusters and by Hadoop. | TCP |
1883 | MQTT | Lightweight publish-subscribe messaging for IoT devices. | TCP |
8883 | MQTT over TLS | The encrypted MQTT port, and the only one to use over a public network. | TCP |
4222 | NATS | The NATS messaging system client port. | TCP |
5060 | SIP | Call setup for VoIP. 5061 carries the TLS-protected version. | UDP · TCP |
3478 | STUN / TURN | NAT traversal for WebRTC — how two browsers discover a path to each other. | UDP · TCP |
1935 | RTMP | Real-Time Messaging Protocol, still the standard ingest for live streaming platforms. | TCP |
Service
AMQP / RabbitMQ
What runs here
The AMQP 0-9-1 message broker port; 5671 is the TLS version.
Protocol
TCP
Service
RabbitMQ management
What runs here
The RabbitMQ web management UI — an admin surface that should not face the internet.
Protocol
TCP
Service
Kafka broker
What runs here
The default Apache Kafka broker port for producers and consumers.
Protocol
TCP
Service
ZooKeeper
What runs here
Coordination service used by older Kafka clusters and by Hadoop.
Protocol
TCP
Service
MQTT
What runs here
Lightweight publish-subscribe messaging for IoT devices.
Protocol
TCP
Service
MQTT over TLS
What runs here
The encrypted MQTT port, and the only one to use over a public network.
Protocol
TCP
Service
NATS
What runs here
The NATS messaging system client port.
Protocol
TCP
Service
SIP
What runs here
Call setup for VoIP. 5061 carries the TLS-protected version.
Protocol
UDP · TCP
Service
STUN / TURN
What runs here
NAT traversal for WebRTC — how two browsers discover a path to each other.
Protocol
UDP · TCP
Service
RTMP
What runs here
Real-Time Messaging Protocol, still the standard ingest for live streaming platforms.
Protocol
TCP
DevOps & Monitoring (14)
Orchestration, metrics and container tooling.
| Port | Service | What runs here | Protocol |
|---|---|---|---|
2375 | Docker API (plain) | The unencrypted Docker daemon socket. Exposing it hands over root on the host — never open it. | TCP |
2376 | Docker API (TLS) | The Docker daemon with TLS client certificates required. | TCP |
6443 | Kubernetes API | The kube-apiserver endpoint that kubectl and every controller talks to. | TCP |
10250 | Kubelet API | The node agent API. Historically exposed without authentication, which granted container execution. | TCP |
2379 | etcd client | The etcd key-value store holding all Kubernetes state; 2380 is peer traffic. | TCP |
9090 | Prometheus | The Prometheus server UI and query API. | TCP |
9100 | Node Exporter | Where Prometheus scrapes host-level metrics from a Linux machine. | TCP |
3100 | Loki | Grafana Loki log aggregation API. | TCP |
8500 | Consul | HashiCorp Consul HTTP API for service discovery and configuration. | TCP |
8200 | Vault | HashiCorp Vault API for secrets management. | TCP |
8080 | Jenkins | The Jenkins web UI default, which is why it clashes so often with application servers. | TCP |
9000 | SonarQube / Portainer | A crowded port — SonarQube, Portainer and MinIO all default to it. | TCP |
4317 | OpenTelemetry gRPC | OTLP trace and metric ingest over gRPC; 4318 is the HTTP equivalent. | TCP |
5044 | Logstash Beats | Where Logstash receives events from Filebeat and the other Beats agents. | TCP |
Service
Docker API (plain)
What runs here
The unencrypted Docker daemon socket. Exposing it hands over root on the host — never open it.
Protocol
TCP
Service
Docker API (TLS)
What runs here
The Docker daemon with TLS client certificates required.
Protocol
TCP
Service
Kubernetes API
What runs here
The kube-apiserver endpoint that kubectl and every controller talks to.
Protocol
TCP
Service
Kubelet API
What runs here
The node agent API. Historically exposed without authentication, which granted container execution.
Protocol
TCP
Service
etcd client
What runs here
The etcd key-value store holding all Kubernetes state; 2380 is peer traffic.
Protocol
TCP
Service
Prometheus
What runs here
The Prometheus server UI and query API.
Protocol
TCP
Service
Node Exporter
What runs here
Where Prometheus scrapes host-level metrics from a Linux machine.
Protocol
TCP
Service
Loki
What runs here
Grafana Loki log aggregation API.
Protocol
TCP
Service
Consul
What runs here
HashiCorp Consul HTTP API for service discovery and configuration.
Protocol
TCP
Service
Vault
What runs here
HashiCorp Vault API for secrets management.
Protocol
TCP
Service
Jenkins
What runs here
The Jenkins web UI default, which is why it clashes so often with application servers.
Protocol
TCP
Service
SonarQube / Portainer
What runs here
A crowded port — SonarQube, Portainer and MinIO all default to it.
Protocol
TCP
Service
OpenTelemetry gRPC
What runs here
OTLP trace and metric ingest over gRPC; 4318 is the HTTP equivalent.
Protocol
TCP
Service
Logstash Beats
What runs here
Where Logstash receives events from Filebeat and the other Beats agents.
Protocol
TCP
Frequently Asked Questions
What is the difference between TCP and UDP ports?
They are separate number spaces on the same machine — TCP 53 and UDP 53 are different endpoints. TCP guarantees ordered, retransmitted delivery and suits anything where loss matters; UDP just sends datagrams, which suits DNS queries, video and games where a late packet is worse than a lost one.
What are well-known, registered and dynamic ports?
Ports 0–1023 are well-known and reserved for standard services, and on Unix binding one requires root. 1024–49151 are registered to specific applications by IANA. 49152–65535 are ephemeral, handed out by the operating system for the client side of outbound connections.
Which ports should be closed on a public server?
Everything you are not deliberately serving. Databases (3306, 5432, 6379, 27017), management interfaces and unencrypted equivalents of encrypted services (23 telnet, 21 FTP) should never face the internet — bind them to localhost or a private network and reach them over SSH or a VPN.
Why does email use so many ports?
They split by role and encryption. 25 is server-to-server delivery and is widely blocked for clients; 587 is submission from a mail client with STARTTLS; 465 is submission over implicit TLS. Retrieval is 110/995 for POP3 and 143/993 for IMAP, the second of each pair being the TLS version.