Common Ports Lookup | TCP UDP Port Number Cheat Sheet

Common ports lookup: search 96 well-known TCP and UDP ports by number or service name. Shows whether each port is safe to expose to the internet and why not. Works offline.

Also known as: common ports list · well known ports tcp udp · what port does redis use · network ports cheat sheet · tcp udp port lookup · port number reference

csv and spreadsheet tools

network tools

networking

Look Up a Port

96 ports

Port number or service name

Type a number for an exact port, or a name to find every port a service uses.

Filter by category

What the exposure ratings mean

Safe to expose

Designed to face the internet directly.

Expose with care

Fine to expose only when hardened, authenticated and rate limited.

Never expose

Should be bound to localhost or a private network. Reachable from the internet, it is a live incident.

Port ranges

0-1023 are well-known ports and need root to bind on Unix. 1024-49151 are IANA-registered. 49152-65535 is the ephemeral range your OS draws from for outbound connections.

All Well-Known Ports

96 results

70 risky

20TCPFTP data

Active-mode FTP data channel.

Never expose

21TCPFTP control

FTP command channel; data moves on 20 or a passive port range.

Credentials and data are plaintext. Use SFTP on 22 or FTPS on 990.

Never expose

22TCPSSH / SFTP

Encrypted shell, file transfer and port forwarding.

Safe to expose only with key-only auth, no root login and fail2ban or an allowlist. It is the single most brute-forced port.

Expose with care

23TCPTelnet

Unencrypted remote shell. Obsolete.

Everything including the password is plaintext. Exposed Telnet built the Mirai botnet.

Never expose

25TCPSMTP

Server-to-server mail relay.

Required inbound for a real mail server, but an open relay will be abused within hours. Most cloud providers block outbound 25.

Expose with care

53TCP/UDPDNS

Name resolution. UDP for queries, TCP for zone transfers and large responses.

An open recursive resolver becomes an amplification DDoS weapon. Serve recursion only to your own network.

Expose with care

67UDPDHCP server

Address assignment; clients listen on 68.

Never expose

69UDPTFTP

Trivial FTP, used for PXE boot and network device firmware.

No authentication whatsoever. Keep it on a provisioning VLAN.

Never expose

80TCPHTTP

Unencrypted web traffic. Normally redirected straight to 443.

Safe to expose

88TCP/UDPKerberos

Kerberos key distribution centre.

Never expose

110TCPPOP3

Plaintext mailbox retrieval.

Credentials cross the wire in the clear. Use 995 instead.

Never expose

123UDPNTP

Time synchronisation.

The monlist command in old ntpd builds enabled huge amplification attacks. Keep the daemon patched.

Expose with care

139TCPNetBIOS session

Legacy SMB over NetBIOS.

Never expose

143TCPIMAP

Plaintext mailbox access.

Use 993 unless STARTTLS is enforced.

Never expose

161UDPSNMP

Device monitoring and management.

v1 and v2c authenticate with a plaintext community string, usually still 'public'. Also an amplification vector.

Never expose

162UDPSNMP trap

Asynchronous device notifications.

Never expose

179TCPBGP

Border Gateway Protocol between routers.

Never expose

389TCPLDAP

Directory queries, plaintext or with STARTTLS.

Never expose

443TCPHTTPS

TLS-encrypted web traffic, and the transport for HTTP/2 and HTTP/3 (over QUIC on UDP).

Safe to expose

445TCPSMB / CIFS

Windows file and printer sharing.

The vector for WannaCry and EternalBlue. ISPs commonly block it outright.

Never expose

465TCPSMTPS

Implicit-TLS submission, unofficially deprecated then reinstated by RFC 8314.

Expose with care

500UDPIPsec IKE

IKE negotiation; 4500 carries NAT-traversal traffic.

Safe to expose

514UDPsyslog

Classic unencrypted log shipping.

Unauthenticated and spoofable - anyone can inject fake log entries.

Never expose

587TCPSMTP submission

Authenticated client mail submission with STARTTLS. The correct port for sending from an app.

Expose with care

631TCPIPP / CUPS

Internet Printing Protocol and the CUPS admin interface.

Never expose

636TCPLDAPS

LDAP over TLS.

Expose with care

853TCPDNS over TLS

Encrypted DNS (DoT).

Safe to expose

873TCPrsync daemon

rsync in daemon mode, without SSH.

Never expose

990TCPFTPS

FTP with implicit TLS.

Expose with care

993TCPIMAPS

IMAP over TLS.

Expose with care

995TCPPOP3S

POP3 over TLS.

Expose with care

1080TCPSOCKS proxy

SOCKS4/5 proxy, including SSH dynamic forwarding.

An open proxy will be used to launder someone else's traffic.

Never expose

1194UDPOpenVPN

OpenVPN default port.

Safe to expose

1313TCPHugo dev server

hugo server default port.

Never expose

1433TCPMicrosoft SQL Server

Default SQL Server instance.

Never expose

1521TCPOracle Database

Oracle TNS listener.

Never expose

1723TCPPPTP

Legacy Microsoft VPN protocol.

MS-CHAPv2 is broken - PPTP offers no meaningful confidentiality.

Never expose

1812UDPRADIUS auth

Network access authentication; 1813 handles accounting.

Never expose

1883TCPMQTT

Lightweight IoT publish/subscribe.

Anonymous access is the default in many brokers - thousands of open brokers leak live sensor data.

Never expose

1900UDPSSDP / UPnP

UPnP device discovery.

A major reflection and amplification DDoS source. Block it at the edge.

Never expose

2049TCP/UDPNFS

Network File System.

Authorisation is by IP address, which is trivially spoofed. Private networks only.

Never expose

2181TCPZooKeeper

ZooKeeper client port, still used by older Kafka clusters.

The four-letter admin commands leak cluster configuration to anyone who connects.

Never expose

2375TCPDocker API (plaintext)

Unencrypted Docker Engine API.

Full root-equivalent control of the host with no authentication. Among the most exploited misconfigurations in cloud - never bind it to a public interface.

Never expose

2376TCPDocker API (TLS)

Docker Engine API with mutual TLS.

Never expose

2379TCPetcd client

etcd key-value client API; 2380 is peer traffic.

etcd holds every Kubernetes Secret in the cluster. Read access is total compromise.

Never expose

3000TCPNode dev server / Grafana

Default for Express, Next.js and Create React App in dev, and for Grafana in production.

If this is Grafana, put it behind a proxy with auth; if it is a dev server, never expose it.

Never expose

3100TCPGrafana Loki

Loki log ingestion and query API.

Never expose

3128TCPSquid proxy

Squid HTTP caching proxy.

Never expose

3268TCPAD Global Catalog

Active Directory global catalog LDAP; 3269 is the TLS variant.

Never expose

3306TCPMySQL / MariaDB

The MySQL wire protocol.

Bind to localhost or a private subnet. Internet-exposed MySQL is scanned and brute-forced constantly.

Never expose

3389TCP/UDPRDP

Windows Remote Desktop.

The primary entry vector for ransomware. Put it behind a VPN or an RD Gateway - never on the open internet.

Never expose

3478TCP/UDPSTUN / TURN

NAT traversal for WebRTC and VoIP.

Safe to expose

4200TCPAngular dev server

ng serve default.

Never expose

4222TCPNATS

NATS client connections.

Never expose

4317TCPOTLP gRPC

OpenTelemetry collector gRPC receiver; 4318 is the HTTP receiver.

Never expose

5000TCPFlask dev / AirPlay

Flask's default, and on macOS the AirPlay Receiver that steals it.

On macOS disable AirPlay Receiver in System Settings to free this port.

Never expose

5060TCP/UDPSIP

VoIP call signalling; 5061 is the TLS variant.

Constantly scanned for toll fraud. Rate limit and require authentication.

Expose with care

5173TCPVite dev server

Vite's default port for local development.

Never expose

5353UDPmDNS

Multicast DNS - Bonjour and service discovery.

Leaks hostnames and service inventory. Should never cross a network boundary.

Never expose

5432TCPPostgreSQL

PostgreSQL frontend/backend protocol.

Keep it in a private network and control access through pg_hba.conf.

Never expose

5601TCPKibana

Elasticsearch dashboard UI.

Never expose

5672TCPAMQP / RabbitMQ

AMQP 0-9-1 broker port.

Never expose

5900TCPVNC

Remote framebuffer protocol; :1 is 5901, :2 is 5902.

Weak 8-character password limit and often no encryption. Tunnel it over SSH.

Never expose

5984TCPCouchDB

CouchDB's HTTP API.

Never expose

5985TCPWinRM HTTP

Windows Remote Management, used by PowerShell remoting and Ansible.

Never expose

5986TCPWinRM HTTPS

WinRM over TLS.

Expose with care

6000TCPX11

X Window System display :0.

An open X server lets anyone read your keystrokes and screen. Forward it over SSH instead.

Never expose

6379TCPRedis

Redis serialization protocol (RESP).

Redis has no auth by default and its CONFIG command can write files - exposure is effectively remote code execution.

Never expose

6443TCPKubernetes API server

The kube-apiserver HTTPS endpoint.

Managed clusters expose it publicly, but restrict by CIDR allowlist and rely on RBAC.

Expose with care

6514TCPsyslog over TLS

Encrypted syslog.

Expose with care

7687TCPNeo4j Bolt

Neo4j's binary Bolt protocol; the browser UI is on 7474.

Never expose

8000TCPDev HTTP server

Django runserver, python -m http.server, and many local APIs.

Development servers have no hardening, no rate limiting and often debug mode on.

Never expose

8080TCPHTTP alternate

Second-choice HTTP port: app servers behind a proxy, Tomcat, Jenkins.

Usually an unhardened app server or admin UI. Keep it behind a reverse proxy.

Expose with care

8086TCPInfluxDB

InfluxDB HTTP API and write endpoint.

Never expose

8200TCPHashiCorp Vault

Vault HTTP API and UI.

Expose with care

8443TCPHTTPS alternate

Alternate TLS port, common for admin consoles and Tomcat.

Expose with care

8500TCPHashiCorp Consul

Consul HTTP API and web UI.

Default configuration allows anyone to register services and read the KV store.

Never expose

8883TCPMQTT over TLS

Encrypted MQTT.

Expose with care

8888TCPJupyter Notebook

Jupyter's default web interface.

A notebook server is a remote code execution service by design.

Never expose

9000TCPPHP-FPM / SonarQube / MinIO

Shared by PHP-FPM's FastCGI listener, SonarQube and MinIO.

An exposed PHP-FPM FastCGI socket allows arbitrary code execution.

Never expose

9042TCPCassandra

Cassandra CQL native transport.

Never expose

9090TCPPrometheus

Prometheus web UI and query API.

No authentication by design, and its metrics reveal your entire internal topology.

Never expose

9092TCPApache Kafka

Kafka broker listener.

Kafka has no authentication unless SASL is configured explicitly.

Never expose

9093TCPAlertmanager

Prometheus Alertmanager API and UI.

Never expose

9100TCPnode_exporter

Host metrics endpoint scraped by Prometheus.

Never expose

9200TCPElasticsearch HTTP

Elasticsearch REST API.

Historically unauthenticated; an exposed cluster leaks or deletes every index.

Never expose

9300TCPElasticsearch transport

Node-to-node clustering traffic.

Never expose

10250TCPkubelet API

Node agent API, including the exec and logs endpoints.

If anonymous auth is enabled this grants command execution in every pod on the node.

Never expose

11211TCP/UDPMemcached

Memcached text and binary protocol.

The UDP listener was used for record-breaking amplification DDoS attacks. Disable UDP entirely.

Never expose

15672TCPRabbitMQ management

RabbitMQ web UI and HTTP API.

Ships with the guest/guest account enabled on some builds.

Never expose

16686TCPJaeger UI

Distributed tracing web interface.

Never expose

25565TCPMinecraft server

Minecraft Java Edition default port.

Safe to expose

26257TCPCockroachDB

CockroachDB SQL, wire-compatible with PostgreSQL.

Never expose

27017TCPMongoDB

MongoDB wire protocol.

Older releases shipped with no authentication, which caused mass ransom attacks on exposed instances.

Never expose

51820UDPWireGuard

WireGuard tunnel endpoint. Silent to unauthenticated packets.

Safe to expose

61616TCPActiveMQ

ActiveMQ OpenWire transport.

Never expose

About Common Ports Lookup

Search 96 well-known TCP and UDP ports by number or service name and get the answer most port tables leave out: whether that port is safe to expose to the internet, and exactly what goes wrong when it is. Fully offline - no scanning, no network requests, nothing sent anywhere.

Key Features

96 ports across web, databases, mail, remote access, file transfer, DNS, messaging, DevOps, monitoring, VPN and network services
Exposure rating on every entry - safe to expose, expose with care, or never expose - with the specific reason why
Search by number or by service name, so both 'what is port 6379' and 'what port does Redis use' work
Covers the ports that actually cause incidents: Docker API 2375, kubelet 10250, etcd 2379, Redis 6379, Memcached 11211
Explains the port ranges, including why 49152-65535 has no fixed services

Use Cases

Identifying an unexpected listening port found by netstat, ss or a security scan
Deciding which ports a firewall or security group should actually allow inbound
Checking whether a service you are about to publish belongs on the public internet
Looking up the right port when configuring a database client, mail sender or message broker

Related Keywords

common ports list

well known ports tcp udp

what port does redis use

port 3306 mysql

network ports cheat sheet

ports to never expose to internet

tcp udp port lookup

Privacy & Security

All processing happens locally in your browser. Your data never leaves your computer, ensuring complete privacy and security.

Liked this tool?

DevToolLab is free to use. If this networking saved you some time today, please consider supporting our work.

Buy us a coffee ☕

Frequently asked questions

What is Common Ports Lookup used for?

Common ports lookup: search 96 well-known TCP and UDP ports by number or service name. Shows whether each port is safe to expose to the internet and why not. Works offline.

Is Common Ports Lookup free to use?

Yes. Common Ports Lookup is completely free with no usage limits, and there is no paid tier required to use it.

Do I need an account to use Common Ports Lookup?

No. Common Ports Lookup works immediately in your browser with no signup, login, or email address required.

Related Tools

HTTP Status Checker | URL Response Checker

Free URL status and HTTP response checker. See the status code, response headers, every 301/302 redirect hop and the response time for any link. No signup.

api and http tools

url and link tools

Webhook Receiver & Inspector | Test HTTP Webhooks

Generate a unique URL to easily test, receive and inspect HTTP webhooks in real-time. View request headers, query parameters, JSON payloads, and more.

json tools

api and http tools

Subnet Calculator | IPv4 CIDR Network Calculator Online

Subnet calculator computes IPv4 network masks, broadcast addresses, and host ranges from any IP and CIDR prefix - fast, free, and works entirely in your browser.

network tools

networking

More Tools You Might Like

Pastebin Online | Share Code & Text Snippets Free

Popular

Share code snippets, logs, and text with a shareable link. Syntax highlighting for 30+ languages, expiration controls, and password protection for Pro users.

text tools

password and key generators

math calculators

utilities

Use Tool

URL Tracker & Link Shortener | Track Clicks

Popular

Create short, trackable URLs with detailed click analytics. Track visitor location, devices, referrers, and more. Password protection & QR codes included.

text tools

password and key generators

url and link tools

networking

Use Tool

Webhook Receiver & Inspector | Test HTTP Webhooks

Popular

Generate a unique URL to easily test, receive and inspect HTTP webhooks in real-time. View request headers, query parameters, JSON payloads, and more.