Well-Known Ports and What They Mean

A port is a 16-bit number that tells a computer which program should receive incoming network data. An IP address finds the right machine, and the port finds the right service on that machine, for example 443 for HTTPS or 25 for email delivery. Ports go from 0 to 65535, and a service "listens" on a port until a client connects.

What a port is

A connection is identified by five values: the protocol (TCP or UDP), the source address and port, and the destination address and port. Your browser picks a random source port for each connection, but the destination port is fixed by the service. That is why standard port numbers matter: a browser knows that https:// means port 443 without being told.

TCP and UDP

• TCP is connection-based. It sets up a connection, numbers the data, resends lost parts and delivers them in order. Web, email, SSH and databases use TCP.
• UDP sends independent datagrams with no connection and no resending. It has lower delay and less overhead. DNS queries, DHCP, NTP and many voice and video services use UDP.

TCP port 80 and UDP port 80 are different things. Some services use both, for example DNS on port 53. For more about how the layers fit together, see the OSI model.

Port ranges

The Internet Assigned Numbers Authority (IANA) divides the ports into three ranges:

Range	Name	Use
0 – 1023	Well-known (system) ports	Core services such as HTTP, SSH and SMTP. On Unix-like systems, only privileged processes can listen here.
1024 – 49151	Registered ports	Applications registered with IANA, for example MySQL (3306) and PostgreSQL (5432).
49152 – 65535	Dynamic (ephemeral) ports	Temporary source ports chosen by clients. Some operating systems use a different default range, for example Linux uses 32768 – 60999.

Registration is not a guarantee. Any program can listen on any free port, and some services run on non-standard ports, such as SSH on 2222.

Common ports and what they are used for

How to check if a port is open

You can test a port from outside with our port checker. It tries to open a TCP connection to the host and port you enter and reports one of three results:

• Open: a service accepted the connection. The host is reachable and something is listening.
• Closed: the host answered, but refused the connection (a TCP reset). The network path works, but no program listens on that port.
• Filtered: no answer came back before the timeout. A firewall is probably dropping the packets silently. It can also mean the host is offline.

From your own computer you can test with these commands:

Test-NetConnection -ComputerName example.com -Port 443   (Windows PowerShell)
nc -vz example.com 443                                     (Linux, macOS)
ss -tlnp                                                   (Linux: list local listening ports)
netstat -ano                                               (Windows: list local connections)

Testing UDP is harder, because a lack of answer can mean either "open" or "filtered". For that reason, online port checkers mostly test TCP.

Security advice: ports you should not expose

Every open port is a possible entry point. Open only what you need, and close the rest. Some services should almost never be reachable from the whole internet:

• Telnet (23): sends passwords in clear text. Use SSH (22) instead.
• SMB (445) and NetBIOS (137-139): Windows file sharing. It has been a target of many worms and ransomware attacks. Never expose it to the internet.
• RDP (3389): remote desktop is a common target of password guessing. Put it behind a VPN or a gateway with multi-factor authentication.
• Databases: MySQL (3306), PostgreSQL (5432), SQL Server (1433), MongoDB (27017), Redis (6379) and Elasticsearch (9200). Allow only the application servers that need them.
• FTP (21): unencrypted. Use SFTP or FTPS.
• SSH (22): acceptable if you use keys, disable password login and limit the source addresses, but expect constant automated login attempts.

General rules: deny all incoming traffic by default and allow only specific ports; limit by source address where possible; keep the software behind each port updated; and scan your own servers regularly to compare what is open with what you expect. A port that is open without a known reason should be investigated.

Related reading

To see how ports relate to IP addresses, read what an IP address is. To test a specific service now, use the port checker.