Network Ports
Look up a port by number or service — protocol, category, and IANA registration status.
Web — HTTP servers and proxies
Ports used by web servers, reverse proxies, and HTTP/HTTPS development tools.Default port for unencrypted HTTP traffic — most sites today redirect automatically to the HTTPS version (443).
Default port for HTTP over TLS/SSL — the browser's padlock, and the encryption behind the whole modern Web, runs through here.
Generic alternative to port 80, used by proxies, application servers, and development environments when 80 is already taken or requires administrator privilege — with no fixed tie to any specific service.
Generic alternative to port 443, for the same reason as 8080 — common on application servers (Tomcat, Jenkins) that expose HTTPS without needing administrator privilege.
Default port for the Flask (Python) development server — and, since macOS Monterey, also used by the system's AirPlay Receiver, which causes a classic conflict when running a local Flask server on a Mac.
Common convention for HTTP development servers (e.g. python -m http.server, Django runserver) — not tied to any specific service, just a preference for keeping port 80 free for production.
Default port for the Jupyter Notebook/JupyterLab web interface — also used, less often, by other development servers and proxies.
Default listening port of Squid, one of the most widely used HTTP caching proxies in corporate and educational environments.
Database — storage and query
Ports used by relational databases, non-relational databases, and search engines to accept client connections.Default port for MySQL (and MariaDB, its most popular fork) — where clients and ORMs connect to run SQL queries.
Default port for PostgreSQL — the same role MySQL's port plays, the connection point for clients and ORMs.
Default port for MongoDB — chosen by the project itself, with no formal IANA assignment.
Default port for Redis — like MongoDB, a choice made by the project itself, not a formal IANA assignment.
Default port for Microsoft SQL Server — the connection point for the TDS protocol used by clients and administration tools.
Default port for the Oracle Database listener — the number was adopted by Oracle as its own convention; the original IANA registration for this port has nothing to do with databases.
Default port for Elasticsearch's REST API, used by virtually every client and administration tool to index and query documents.
Default port for Elasticsearch's internal transport protocol, used for communication between nodes of the same cluster — not the port external clients normally reach.
Default port for CouchDB's HTTP API — a document-oriented database that exposes its entire interface over REST.
Default port for the native CQL (Cassandra Query Language) protocol, used by drivers and administration tools to connect to a Cassandra cluster.
Default port for Memcached, a distributed in-memory caching system — unlike most databases on this list, it has a formal IANA registration (memcache), over both TCP and UDP.
Default port for InfluxDB's HTTP API — a time-series database used mainly for metrics and monitoring.
Default port for Neo4j's Bolt protocol — a graph database, used by official drivers for Cypher queries.
Email — sending and receiving messages
Ports used by the protocols for sending (SMTP) and receiving (POP3, IMAP) email.Default port for transferring email between servers (relay) — not the recommended port for an email client to send messages; many internet providers block outbound traffic on 25 to cut down on spam.
Recommended port for an email client (Outlook, Thunderbird, a phone app) to send messages through an authenticated server — the modern successor to 25 for that specific use.
Email submission port with implicit TLS (the connection is encrypted from the start, no STARTTLS negotiation) — it had a rocky history of deprecation and was later re-recommended by RFC 8314.
Default port for unencrypted POP3 — a protocol that downloads email from the server to the client, typically removing it from the server afterward.
Default port for POP3 over TLS/SSL — the same role as port 110, with the whole connection encrypted from the start.
Default port for unencrypted IMAP — a protocol that keeps email synchronized on the server, unlike POP3, letting the same mailbox be accessed from several devices.
Default port for IMAP over TLS/SSL — the same role as port 143, with the whole connection encrypted from the start; the recommended choice today for any email client.
Alternate email-sending port used by several transactional email providers (e.g. SendGrid, Mailgun) as an option when a client's network blocks ports 25 and 587.
Remote Access — shell, desktop, and files
Ports used to remotely access a shell, a graphical desktop, or a file system on another machine.Port used for FTP's active-mode data transfer — port 21 (control) negotiates the session, but the content itself travels here.
Default port for FTP commands and session control — the actual file transfer happens on a separate connection (port 20 in active mode, or a negotiated port in passive mode).
Default port for SSH — remote shell access, tunneling, and encrypted file transfer (SFTP/SCP); arguably the single most fundamental port in Linux server administration.
Default port for Telnet, a remote login protocol that predates SSH — all traffic, including the username and password, travels in plain text. Considered insecure and obsolete for production use.
Default port for rlogin, a Unix remote login protocol that predates SSH — like Telnet, it transmits everything unencrypted and is considered obsolete.
Port used for FTPS's (explicit TLS/SSL FTP) data transfer — the encrypted equivalent of traditional FTP's port 20.
Default port for FTPS with implicit TLS, for commands and session control — the encrypted equivalent of traditional FTP's port 21.
Common alternate port for SSH, used mainly by cloud providers and container images to avoid competing with the host's port 22, or to reduce the volume of automated login attempts targeting the default port.
Default port for RDP (Remote Desktop Protocol) — graphical remote access to a Windows desktop.
Default port for the RFB protocol used by VNC — cross-platform graphical remote access, an alternative to RDP outside the Windows ecosystem.
Default port for modern SMB (directly over TCP, without NetBIOS) — Windows file and printer sharing; historically associated with high-impact vulnerabilities, such as the one exploited by the WannaCry ransomware.
Port for SMB over NetBIOS, the older variant of Windows file sharing — largely superseded by 445 today, but still present on networks with legacy equipment.
DNS and Network Infrastructure — foundational services
Ports used by fundamental network services — DNS, DHCP, NTP, directory, VPN — the infrastructure everything else runs on.Default port for DNS, used both for ordinary queries (UDP) and for zone transfers or responses too large for a single UDP packet (TCP).
Port a DHCP server listens on for IP address requests — the counterpart to port 68, used by the client.
Port a DHCP client listens on for the server's reply with the assigned IP address — the counterpart to port 67.
Default port for TFTP, a simplified version of FTP with no authentication — used mainly to load firmware/configuration onto routers, switches, and embedded devices at boot.
Default port for the Kerberos authentication protocol — the foundation of authentication in corporate Windows networks (Active Directory) and many Unix environments.
Port for the portmapper/rpcbind service, which translates RPC program numbers to the actual port each service is listening on — used mainly by NFS.
Default port for NTP, the clock-synchronization protocol — keeps the system clock aligned with reference time servers.
Port a network device listens on for SNMP queries — the standard protocol for monitoring, and in some cases configuring, switches, routers, and other network equipment.
Port a management station listens on for notifications (traps) that a network device sends on its own initiative, without waiting for a query — the counterpart to port 161.
Default port for BGP, the protocol that exchanges routes between autonomous systems and effectively holds up global internet routing.
Default port for unencrypted LDAP — a protocol for querying directory services, such as Active Directory.
Port used by IKE to negotiate and establish an IPsec tunnel's security parameters, before any actual data travels.
Default port for LDAP over TLS/SSL — the same role as port 389, with the whole connection encrypted from the start.
Default port for OpenVPN — it can run over either UDP (more common, lower latency) or TCP.
Default port for L2TP, a tunneling protocol usually paired with IPsec (L2TP/IPsec) to form a complete VPN.
Default port for PPTP, one of the first widely adopted VPN protocols — considered insecure today due to known flaws in its authentication scheme, superseded by OpenVPN, IPsec, or WireGuard.
Default port for NFS, a protocol for sharing files between Unix/Linux systems over the network.
Port used by IPsec when at least one end of the tunnel is behind NAT — it encapsulates IPsec traffic inside UDP so it can traverse NAT without losing the negotiation done on port 500.
WireGuard's default port by convention — sitting within IANA's own dynamic/ephemeral range (49152–65535), reserved by design for free use with no need for a formal registration.
Messaging — queues and event streaming
Ports used by message brokers and event-streaming platforms for asynchronous communication between services.Default port for unencrypted MQTT — a lightweight publish/subscribe messaging protocol widely used in IoT for its low overhead.
Default port for MQTT over TLS/SSL — the same role as port 1883, with the whole connection encrypted.
Default port for AMQP, a queue-oriented messaging protocol used by brokers such as RabbitMQ.
Default port for RabbitMQ's web management interface — not part of the AMQP protocol itself, specific to this implementation.
Default port for Apache Kafka, a distributed event-streaming platform — chosen by the project itself, with no formal IANA assignment.
Default port for NATS, a lightweight messaging system built for communication between microservices.
Default port for Apache ActiveMQ's native OpenWire protocol — a Java message broker traditionally used in enterprise integrations.
Port commonly used by the STOMP connector of brokers such as ActiveMQ — a text-based messaging protocol, simpler than AMQP/OpenWire.
Port for the Erlang Port Mapper Daemon — helps nodes in an Erlang/Elixir cluster (such as a RabbitMQ cluster) find each other on the network.
DevOps and Monitoring — orchestration and observability
Ports used by container, orchestration, and observability tools — metrics, logs, dashboards.Port for the Docker daemon's REST API without TLS — exposes full control over the host's Docker; it should never be reachable over the network without authentication.
Port for the Docker daemon's REST API with TLS — the same role as port 2375, with certificate-based authentication, the recommended way to expose the API remotely.
Default port for the Kubernetes API server — the central point kubectl and every cluster component use to talk to the control plane.
Default port for the kubelet API, the agent that runs on every Kubernetes node — used by the control plane to run commands and collect metrics directly from the node.
Port used by several unrelated tools — PHP-FPM (internal communication with the web server), SonarQube, and Portainer, among others — the shared number is a coincidence of independent conventions, not a single standard.
Default port for Prometheus's web interface and HTTP API — a time-series-based monitoring and alerting system.
Default port for Node Exporter, which exposes a machine's operating-system metrics (CPU, memory, disk) in the format Prometheus consumes.
Default port for Zipkin's web interface and API — a distributed tracing system used to follow a request across several microservices.
Default port for Kibana's web interface, used to explore and visualize data indexed in Elasticsearch.
Default port for Consul's HTTP API and web interface — HashiCorp's service-discovery and distributed-configuration tool.
Default port for Vault's HTTP API and web interface — HashiCorp's secrets-management and encryption-as-a-service tool.
Default port for Apache ZooKeeper, a distributed coordination service historically used by Kafka and other systems for leader election and shared configuration.
The three port ranges
The TCP/UDP port space is split into three ranges defined by IANA itself: well-known (0–1023), historically reserved for the most fundamental internet services and, on Unix/Linux systems, openable only by a process with administrator privilege; registered (1024–49151), where any project can request a formal IANA registration for a specific service; and dynamic/ephemeral (49152–65535), reserved by design for temporary use — the range the operating system automatically uses for the source port of an outgoing connection, which never needs a formal registration. This reference covers all three ranges, not just the first — that's why the tool is named network ports, not well-known ports.
Registered, unofficial, and conflicting
Registered means the port has a formal entry in the IANA registry, and real-world use matches what was registered — the most common case. Unofficial means the port was never registered with IANA, but became a widely adopted convention within a project or community — usually because the project itself documents that the choice was arbitrary (Redis and MongoDB are classic examples). Conflicting is the subtler case: the port has a formal IANA registration, but today's dominant real-world use diverges from what was registered — port 8080 is the best-known example, used almost always as a "generic HTTP alternative," unrelated to the specific purpose of the original registration.
A non-default port isn't real security
Moving a service from its default port to an alternate one (e.g. SSH from 22 to 2222) cuts down the noise from automated login attempts that target the default port, but it isn't, by itself, a real security measure — a determined attacker scans every port in seconds. The practice has a name: security through obscurity, and the security community is unanimous that it's no substitute for real controls — strong authentication, a properly configured firewall, up-to-date software, encryption. An unnecessarily open port, whatever its number, is one more attack surface; the recommended principle is to expose only what genuinely needs to be reachable, and protect what is exposed with the right controls — not the hope that no one will notice.
Frequently asked questions
Because, unlike ports such as 27017 (MongoDB) or 6379 (Redis), 8080 has a history of formal IANA registration — it's just that today's dominant real-world use (any alternative HTTP server, unrelated to a specific service) diverges from the registration's original purpose. "Unofficial" describes a port that was never registered at all; "conflicting" describes a port whose registration exists but no longer reflects real-world use.
Both are part of the same protocol (SMTP), but with different roles: 25 is for transferring email between servers (relay) — and many internet providers block outbound traffic on it to cut down on spam. 587 is the submission port, specifically meant for an authenticated email client to send a message through its own server — it's the port any email app should use to send, never 25.
443 is the default, registered HTTPS port — the one a browser tries automatically when you type https://example.com without specifying a port. 8443 is a common alternative, used when a service can't (or doesn't want to) listen directly on 443 — for example, an application server behind a reverse proxy, or an environment without administrator privilege to open ports below 1024.
Changing the port (e.g. from 22 to 2222) reduces the volume of automated login attempts from bots that only ever probe the default port — a real but modest benefit. It doesn't stop a targeted attack: scanning all 65535 ports of an IP takes seconds with common tools. Real protection comes from disabling password login (public key only), keeping SSH up to date, and using a firewall that limits who can even attempt to connect — see "A non-default port isn't real security," above.
Because opening a port below 1024 requires administrator privilege on Linux/Unix — a decades-old restriction meant for the system's most fundamental services. Modern databases and message brokers (MySQL, PostgreSQL, Redis, Kafka...) typically run as an unprivileged process, so they picked numbers in the registered range (1024–49151) for operational convenience — most never went through a formal IANA registration, they just became convention through use.
TCP guarantees ordered, acknowledged delivery — it resends lost packets, ideal for protocols where no byte can go missing (HTTP, SSH, databases). UDP guarantees none of that — it sends and moves on, with less overhead and lower latency, ideal for traffic that tolerates occasional loss or is sensitive to delay (DNS, video streaming, VPN). Some ports use both for different purposes — port 53 (DNS), for instance, uses UDP for most queries and TCP for zone transfers or responses too large for a single UDP packet.
Nexinon Principles
Privacy
Your data never leaves your browser.No account needed
Use it now, no account or password.Free
No usage limits, no paid plan.Trustworthy content
Full explanation behind every tool, not just the result.