This article lists the most commonly used TCP and UDP port numbers, with the service name and what each port is used for. It covers standard internet services as well as ports used by Cisco, FortiGate, SonicWall, Ubiquiti UniFi, Microsoft, VoIP and monitoring systems.
Tip: Press Ctrl + F (or Cmd + F on a Mac) and type a port number or service name to find it quickly.
Port Number Ranges
- 0 to 1023 – Well-known ports: assigned to core internet services such as HTTP, DNS and SSH.
- 1024 to 49151 – Registered ports: registered by software vendors for specific applications.
- 49152 to 65535 – Dynamic or private ports: used temporarily by clients for outgoing connections.
TCP Ports
| Port Number | Name | Description |
| 1 | tcpmux | TCP Port Service Multiplexer |
| 7 | echo | Echo |
| 9 | discard | Discard |
| 13 | daytime | Daytime |
| 17 | qotd | Quote of the Day |
| 19 | chargen | Character Generator |
| 20 | ftp-data | FTP data transfer |
| 21 | ftp | File Transfer Protocol (FTP) control channel |
| 22 | ssh | Secure Shell (SSH), SCP and SFTP |
| 23 | telnet | Telnet (unencrypted remote login) |
| 25 | smtp | Simple Mail Transfer Protocol (mail relay between servers) |
| 37 | time | Time Protocol |
| 43 | whois | WHOIS domain and IP lookup |
| 49 | tacacs | TACACS / TACACS+ authentication (AAA) |
| 53 | domain | DNS zone transfers and large DNS responses |
| 70 | gopher | Gopher |
| 79 | finger | Finger user information |
| 80 | http | Hypertext Transfer Protocol (HTTP) |
| 88 | kerberos | Kerberos authentication (Active Directory) |
| 101 | hostname | NIC host name server |
| 102 | iso-tsap | ISO-TSAP; Siemens S7 PLC communication |
| 109 | pop2 | Post Office Protocol v2 |
| 110 | pop3 | Post Office Protocol v3 |
| 111 | sunrpc | Sun RPC / rpcbind (portmapper) |
| 113 | ident | Ident protocol |
| 119 | nntp | Network News Transfer Protocol |
| 135 | msrpc | Microsoft RPC endpoint mapper |
| 139 | netbios-ssn | NetBIOS session service (SMB over NetBIOS) |
| 143 | imap | Internet Message Access Protocol |
| 179 | bgp | Border Gateway Protocol |
| 194 | irc | Internet Relay Chat |
| 389 | ldap | Lightweight Directory Access Protocol |
| 427 | svrloc | Service Location Protocol (SLP) |
| 443 | https | HTTP over TLS/SSL; also SSL VPN (e.g. Cisco AnyConnect) |
| 445 | microsoft-ds | SMB / CIFS file sharing, Active Directory |
| 464 | kpasswd | Kerberos password change |
| 465 | smtps | SMTP over implicit TLS |
| 496 | pim-auto-rp | PIM Auto Rendezvous Point |
| 502 | modbus | Modbus TCP (industrial control) |
| 512 | exec | Remote process execution (rexec) |
| 513 | login | Remote login (rlogin) |
| 514 | cmd / shell | Remote commands (rsh / rcmd) |
| 515 | printer | Line Printer Daemon (LPD) remote printing |
| 517 | talk | Talk |
| 540 | uucp | UNIX-to-UNIX Copy Program |
| 541 | fgfm | FortiGate to FortiManager communication (FGFM) |
| 543 | klogin | Kerberos login |
| 544 | kshell | Kerberos remote shell |
| 548 | afp | Apple Filing Protocol |
| 554 | rtsp | Real Time Streaming Protocol |
| 563 | nntps | NNTP over TLS |
| 587 | submission | Email submission from clients (SMTP with STARTTLS) |
| 593 | http-rpc-epmap | Microsoft RPC over HTTP |
| 631 | ipp | Internet Printing Protocol |
| 636 | ldaps | LDAP over TLS/SSL |
| 639 | msdp | Multicast Source Discovery Protocol |
| 646 | ldp | MPLS Label Distribution Protocol (sessions) |
| 703 | fortigate-ha | FortiGate HA (FGCP) session synchronisation |
| 749 | kerberos-adm | Kerberos administration |
| 830 | netconf-ssh | NETCONF over SSH (network automation) |
| 853 | domain-s | DNS over TLS (DoT) |
| 873 | rsync | rsync file synchronisation |
| 902 | vmware | VMware ESXi host agent / remote console |
| 989 | ftps-data | FTP over TLS/SSL, data |
| 990 | ftps | FTP over TLS/SSL, control |
| 992 | telnets | Telnet over TLS/SSL |
| 993 | imaps | IMAP over TLS/SSL |
| 995 | pop3s | POP3 over TLS/SSL |
| 1080 | socks | SOCKS proxy |
| 1090 | ucm | Cisco UCM: RTMT / AMC service |
| 1194 | openvpn | OpenVPN (TCP mode) |
| 1433 | ms-sql-s | Microsoft SQL Server |
| 1494 | citrix-ica | Citrix ICA (Virtual Apps and Desktops) |
| 1500 | ucm database | Cisco UCM database (Informix) |
| 1521 | oracle | Oracle Database listener |
| 1720 | h323 | H.323 call setup (Q.931) |
| 1723 | pptp | Point-to-Point Tunneling Protocol VPN (legacy) |
| 1883 | mqtt | MQTT messaging (IoT) |
| 2000 | sccp | Skinny Client Control Protocol (Cisco IP phones) |
| 2049 | nfs | Network File System |
| 2082 | cpanel | cPanel (HTTP) |
| 2083 | cpanel-ssl | cPanel (HTTPS) |
| 2086 | whm | WHM (HTTP) |
| 2087 | whm-ssl | WHM (HTTPS) |
| 2095 | webmail | cPanel Webmail (HTTP) |
| 2096 | webmail-ssl | cPanel Webmail (HTTPS) |
| 2181 | zookeeper | Apache ZooKeeper |
| 2375 | docker | Docker API (unencrypted) |
| 2376 | docker-s | Docker API over TLS |
| 2379-2380 | etcd | etcd client and peer (Kubernetes) |
| 2443 | sccp-s | Secure SCCP over TLS (Cisco IP phones) |
| 2598 | citrix-sr | Citrix session reliability |
| 3000 | dev-http | Ruby on Rails, Node.js and Grafana (common default) |
| 3128 | squid | Squid web proxy |
| 3260 | iscsi | iSCSI storage |
| 3268 | gc | Active Directory Global Catalog |
| 3269 | gc-ssl | Active Directory Global Catalog over TLS/SSL |
| 3306 | mysql | MySQL / MariaDB |
| 3389 | ms-wbt-server | Remote Desktop Protocol (RDP) |
| 3478 | stun | STUN/TURN (TCP mode) |
| 3690 | svn | Subversion |
| 4433 | sonicwall-sslvpn | SonicWall SSL VPN / NetExtender (default) |
| 4786 | smart-install | Cisco Smart Install (disable if not used) |
| 5000 | upnp / dsm | Synology DSM (HTTP), Flask development server |
| 5001 | dsm-ssl | Synology DSM (HTTPS) |
| 5060 | sip | Session Initiation Protocol (VoIP signalling) |
| 5061 | sips | SIP over TLS |
| 5222 | xmpp-client | XMPP / Jabber client |
| 5269 | xmpp-server | XMPP / Jabber server-to-server |
| 5432 | postgresql | PostgreSQL database |
| 5601 | kibana | Kibana web interface |
| 5671 | amqps | AMQP over TLS (RabbitMQ) |
| 5672 | amqp | AMQP (RabbitMQ) |
| 5900 | vnc | VNC remote access |
| 5938 | teamviewer | TeamViewer |
| 5985 | winrm | Windows Remote Management (HTTP) |
| 5986 | winrm-s | Windows Remote Management (HTTPS) |
| 6000 | x11 | X Window System |
| 6379 | redis | Redis |
| 6443 | kube-api | Kubernetes API server |
| 6514 | syslog-tls | Syslog over TLS |
| 6789 | unifi-speedtest | UniFi mobile speed test |
| 8000 | http-alt | Alternate HTTP; Splunk web interface |
| 8080 | http-alt | Alternate HTTP; Tomcat; UniFi device inform |
| 8089 | splunkd | Splunk management port |
| 8291 | winbox | MikroTik Winbox |
| 8443 | https-alt | Alternate HTTPS; Tomcat / OpenSSL; UniFi controller GUI |
| 8445 | cisco finesse | Cisco Finesse |
| 8530 | wsus | Windows Server Update Services (HTTP) |
| 8531 | wsus-ssl | Windows Server Update Services (HTTPS) |
| 8843 | unifi-portal-ssl | UniFi guest portal redirect (HTTPS) |
| 8880 | unifi-portal | UniFi guest portal redirect (HTTP) |
| 8883 | mqtts | MQTT over TLS |
| 9080 | debug | Debugging |
| 9090 | prometheus | Prometheus; Cockpit web console |
| 9092 | kafka | Apache Kafka |
| 9100 | jetdirect | Raw network printing (HP JetDirect) |
| 9200 | elasticsearch | Elasticsearch HTTP API |
| 9300 | elasticsearch | Elasticsearch node communication |
| 9389 | adws | Active Directory Web Services |
| 9418 | git | Git protocol |
| 10000 | webmin | Webmin; NDMP backup |
| 10050 | zabbix-agent | Zabbix agent |
| 10051 | zabbix-trapper | Zabbix server / proxy |
| 10250 | kubelet | Kubernetes kubelet API |
| 11211 | memcached | Memcached |
| 12015 | uccx | Cisco UCCX |
| 27017 | mongodb | MongoDB |
UDP Ports
| Port Number | Name | Description |
| 7 | echo | Echo |
| 9 | discard | Discard; often used for Wake-on-LAN |
| 37 | time | Time Protocol |
| 42 | nameserver | IEN 116 name service (obsolete) |
| 49 | tacacs | TACACS (legacy) |
| 53 | domain | DNS queries and replies |
| 67 | bootps | DHCP / BOOTP server |
| 68 | bootpc | DHCP / BOOTP client |
| 69 | tftp | Trivial File Transfer Protocol |
| 88 | kerberos | Kerberos authentication |
| 111 | sunrpc | Sun RPC / rpcbind (portmapper) |
| 123 | ntp | Network Time Protocol |
| 137 | netbios-ns | NetBIOS name service |
| 138 | netbios-dgm | NetBIOS datagram service |
| 161 | snmp | Simple Network Management Protocol (polling) |
| 162 | snmptrap | SNMP traps |
| 177 | xdmcp | X Display Manager Control Protocol |
| 195 | dnsix | DNSIX security protocol auditing |
| 389 | cldap | Connectionless LDAP (Active Directory DC locator) |
| 434 | mobile-ip | Mobile IP registration |
| 443 | https / quic | HTTP/3 (QUIC); DTLS for SSL VPN (e.g. AnyConnect) |
| 464 | kpasswd | Kerberos password change |
| 496 | pim-auto-rp | PIM Auto Rendezvous Point |
| 500 | isakmp | IKE / ISAKMP (IPsec VPN key exchange) |
| 512 | biff | Biff mail notification (comsat) |
| 513 | who | Remote who service (rwho) |
| 514 | syslog | Syslog remote logging |
| 517 | talk | Talk |
| 520 | rip | Routing Information Protocol |
| 521 | ripng | RIP for IPv6 |
| 546 | dhcpv6-client | DHCPv6 client |
| 547 | dhcpv6-server | DHCPv6 server |
| 623 | ipmi | IPMI remote management (e.g. Dell iDRAC) |
| 646 | ldp | MPLS LDP neighbour discovery |
| 853 | doq | DNS over QUIC |
| 1194 | openvpn | OpenVPN (default) |
| 1434 | ms-sql-m | Microsoft SQL Server Browser |
| 1645 | radius (legacy) | RADIUS authentication (old port) |
| 1646 | radacct (legacy) | RADIUS accounting (old port) |
| 1701 | l2tp | Layer 2 Tunneling Protocol (L2TP VPN) |
| 1719 | h323ras | H.323 gatekeeper RAS |
| 1812 | radius | RADIUS authentication |
| 1813 | radacct | RADIUS accounting |
| 1900 | ssdp | SSDP / UPnP discovery; UniFi L2 discovery |
| 1985 | hsrp | Hot Standby Router Protocol |
| 2049 | nfs | Network File System |
| 2055 | netflow | NetFlow export (common default) |
| 2427 | mgcp | MGCP gateway |
| 2727 | mgcp-callagent | MGCP call agent |
| 3222 | glbp | Gateway Load Balancing Protocol (Cisco) |
| 3389 | rdp | Remote Desktop Protocol (UDP transport) |
| 3478 | stun | Unifi STUN Port; STUN / TURN for VoIP and video calls |
| 3478-3481 | teams-media | Microsoft Teams media |
| 3784 | bfd | Bidirectional Forwarding Detection (single-hop) |
| 3785 | bfd-echo | BFD echo |
| 4500 | non500-isakmp | IPsec NAT traversal (NAT-T) |
| 4739 | ipfix | IPFIX flow export |
| 4789 | vxlan | VXLAN overlay networks |
| 5060 | sip | Session Initiation Protocol (VoIP signalling) |
| 5246 | capwap-control | CAPWAP control (Cisco WLC and access points) |
| 5247 | capwap-data | CAPWAP data (Cisco WLC and access points) |
| 5353 | mdns | Multicast DNS (Bonjour / AirPlay) |
| 5355 | llmnr | Link-Local Multicast Name Resolution |
| 6343 | sflow | sFlow export |
| 8801-8810 | zoom | Zoom meeting media |
| 10001 | unifi-discovery | UniFi device discovery |
| 12222-12223 | lwapp | LWAPP (legacy Cisco wireless, replaced by CAPWAP) |
| 16384-32767 | rtp | RTP voice and video media (Cisco default range) |
| 33434-33534 | traceroute | Traceroute probes (Linux / Unix / Cisco) |
| 51820 | wireguard | WireGuard VPN (default) |
IP Protocol Numbers (Not Ports)
Some protocols run directly on IP and do not use a TCP or UDP port at all. When you write firewall rules or access lists, you allow these by their IP protocol number instead.
| Protocol Number | Name | Description |
| 1 | ICMP | Ping, traceroute replies and error messages |
| 6 | TCP | Transmission Control Protocol |
| 17 | UDP | User Datagram Protocol |
| 47 | GRE | Generic Routing Encapsulation tunnels |
| 50 | ESP | IPsec Encapsulating Security Payload |
| 51 | AH | IPsec Authentication Header |
| 88 | EIGRP | Enhanced Interior Gateway Routing Protocol (Cisco) |
| 89 | OSPF | Open Shortest Path First |
| 103 | PIM | Protocol Independent Multicast |
| 112 | VRRP | Virtual Router Redundancy Protocol |
How to Check Which Ports Are Open
Windows – list listening ports and the process using them:
netstat -anoWindows PowerShell – test whether a remote port is reachable:
Test-NetConnection 192.168.1.1 -Port 443Linux – list listening TCP and UDP ports:
ss -tulpnMany applications let you change their default ports, so always confirm the actual port in the device or software configuration.
Disclaimer: This article is for educational purposes only and is not professional financial, medical, or legal advice. It may contain affiliate links, which earn us a small commission at no extra cost to you. See our Disclaimer and Affiliate Disclosure.
Article ID: EA00019