Ports & port numbers
Starts from zero — what a port actually is, in plain English — then covers every port worth knowing, and the ways attackers abuse them.
What a port is
No background assumed. If you've never touched networking, this section is the whole idea — the rest of the page builds on it.
Start with the problem ports exist to solve. Right now your computer is probably doing several things on the network at once — a few browser tabs, email checking in the background, a messaging app, maybe a video call. All of that arrives over one internet connection, on one address. So when data lands on your machine, something has to decide which of those programs it belongs to.
That's the job of a port. An address gets data to the right machine. A port gets it to the right program on that machine.
A port is simply a number, from 0 to 65535, attached to every piece of data sent over the network. Nothing more mysterious than that. Every piece carries two of them: the number it came from, and the number it's for.
- The street address
- gets the letter to the right building — that's the IP address, which identifies one machine on the network.
- The apartment number
- gets it to the right person inside — that's the port, which identifies one program on that machine.
- Without the apartment number
- the letter reaches the building and stops there. Nobody knows who it's for. That's a machine with no ports: data arrives and has nowhere to go.
And like apartment numbers, the useful ones are agreed in advance. Everyone knows to send web traffic to port 80 or 443, the same way everyone knows the manager is in apartment 1. If the numbers changed randomly, nothing could find anything.
How it works, step by step
A program claims a port and waits
When you run a web server, it tells the operating system: anything arriving for port 443, send it to me. It then sits there waiting. That's called listening, and the program is a service — software whose whole job is to wait for requests and answer them. A machine can run many services at once, each listening on its own port.
Someone connects to that number
When you open a website, your browser sends a request to that machine's address, aimed at port 443. The receiving machine looks at the number, sees the web server claimed it, and hands the data over. Nothing else on that machine ever sees it.
Your side gets a temporary number too
Your browser also needs a number for the reply to come back to, but it doesn't need a famous one. It grabs a random high number — say 51834 — uses it for that one conversation, and releases it when done. That's an ephemeral port (ephemeral = short-lived). It's why every tab can talk to the same website at once without the replies getting mixed up: same destination, different temporary number each.
Why one server can serve thousands of people
A connection isn't identified by the port alone — it's the combination of both addresses and both ports (plus whether it's TCP or UDP). That five-part combination is unique for every conversation, so one web server on a single port 443 can hold thousands of separate connections at the same time and never confuse them.
Why any of this matters for security
- Every open port is a door into the machine. A port with a program listening behind it is something an outsider can send data to — and if that program has a flaw, or a weak password, that's the way in.
- Attackers look for open ports first. Before anything else, they scan a machine to see which numbers answer. Each one that does tells them what software is running and gives them something to attack.
- So the basic defensive question is: what's listening, and does it need to be? A port that's open for no reason is a door left unlocked for no reason. Most of this page is about knowing which doors exist, what's normally behind each one, and which should never be reachable from the internet.
▸Words used on this page, in plain English
- IP address
- The number that identifies one machine on a network, like
192.0.2.15. The street address. - Packet
- Data doesn't travel in one lump — it's chopped into small chunks called packets, sent separately, and reassembled at the other end. Each packet carries the port numbers.
- Protocol
- An agreed set of rules for a conversation, so both sides understand each other. HTTP is the protocol for web pages; TCP and UDP are the two ways of moving the data underneath.
- Service / daemon
- A program that runs quietly in the background waiting for network requests — a web server, a mail server, a database.
- Client and server
- The server waits and answers; the client starts the conversation. Your browser is a client, the website's machine is a server.
- Listening
- A program has claimed a port and is waiting for data on it. "Port 22 is open" means something is listening on 22.
- Host
- Any machine on a network — a laptop, a server, a phone, a printer.
The three ranges
The 65,536 numbers are split into three bands by IANA, the body that hands out internet numbers. Which band a port sits in tells you roughly what it's for.
The famous ones, reserved for core internet services and the same on every machine in the world — web on 80 and 443, email on 25, remote login on 22. On Linux and Mac, only an administrator can start a program on one of these, which stops any random user from impersonating a real service.
Numbers claimed by specific products so they don't clash — MySQL on 3306, Windows Remote Desktop on 3389, Redis on 6379. Any user can start a program here, no admin rights needed.
Never permanently assigned to anything. These are the throwaway numbers your own machine grabs for the outgoing side of a connection. Windows uses exactly this range; Linux usually starts around 32768.
TCP vs UDP, and port states
Ports are just numbers — but there are two different ways to move data to them, and a port number means something different depending on which one you're talking about. Think of TCP as a phone call (you dial, they pick up, you confirm you can hear each other, then talk) and UDP as shouting across a room (fast, no confirmation, maybe they missed it). Because they're separate systems, TCP/53 and UDP/53 are two different channels that happen to share a number.
TCP
- Sets up the connection first — a short back-and-forth called a handshake (
SYN→SYN, ACK→ACK) before any real data moves. - Reliable: anything lost along the way is noticed and sent again, and it all arrives in the right order.
- Used where nothing can go missing — web pages, file transfers, remote login, email, most databases.
UDP
- No setup, no confirmation, no guarantee it arrived. Send it and move on.
- Much less overhead, so it's faster — good for tiny question-and-answer exchanges and for live audio and video, where a late packet is worse than a missing one.
- Used by DNS lookups, clock sync, network device monitoring, voice/video calls, and modern web traffic over QUIC. Also the favourite of attackers running amplification attacks.
What a scanner sees — the three port states
- open
- A service is listening and accepted the connection. TCP completes the handshake; the attacker now has something to talk to.
- closed
- The host is reachable but nothing is listening — it replies with a TCP
RST. Still tells a scanner the host is alive. - filtered
- A firewall dropped the probe or sent no reply. The scanner can't tell what's behind it. This is how unused ports should look from outside.
Seeing what's in use
Every incident that involves a suspicious port starts here — what's listening, what's connected, and which process owns it.
netstat -ano(Windows) orss -tulpn(Linux) — every port the host listens on, every active connection, and the owning process ID.Get-NetTCPConnection/Get-NetUDPEndpoint(PowerShell) — the same, as objects you can filter and sort.lsof -i(macOS / Linux) — connections mapped to processes and users.- In a capture: filter
tcp.port == 445, or openStatistics → Conversationsand read the port columns. - The habit that matters: for any unexpected listener, map the port to the process, then the process to who started it and why.
Ports that matter
Grouped by function. For each: what it's for, and the security angle — how it's abused and what to watch. This is the part to come back to.
Web
| Port | Service | Purpose | Security angle |
|---|---|---|---|
| 80 / TCP | HTTP | Cleartext web. | Everything is readable on the wire — credentials, cookies, content. Used for malware downloads, C2, and exfil inside POST bodies. Cleartext HTTP on a corporate LAN is itself worth a second look. |
| 443 / TCP + UDP | HTTPS / TLS, QUIC | Encrypted web. QUIC (HTTP/3) runs on UDP/443. | The default channel for modern C2 and exfil — encrypted and always allowed outbound. Domain fronting and ordinary-looking domains let malware blend into normal traffic. |
| 8080 / 8443 / TCP | HTTP / HTTPS alternate | Proxies, app servers, admin consoles, dev servers. | Exposed admin panels — Tomcat, Jenkins, routers. One of the most common ways in. |
Remote access & management
| Port | Service | Purpose | Security angle |
|---|---|---|---|
| 22 / TCP | SSH | Encrypted remote shell, plus SFTP/SCP and tunnels. | The number-one brute-force target on the internet. Also used for tunnelling — pivoting and exfil inside an encrypted session. Stolen keys skip passwords entirely. |
| 23 / TCP | Telnet | Cleartext remote shell. Obsolete. | Credentials in plaintext. IoT botnets (Mirai and its descendants) mass-scan 23 with default passwords. Should never be open anywhere. |
| 3389 / TCP | RDP | Windows remote desktop. | A leading ransomware entry point. Brute-forced constantly; BlueKeep (CVE-2019-0708) was wormable. Exposed RDP is an incident waiting to happen — put it behind a VPN. |
| 5900 / TCP | VNC | Cross-platform remote desktop. | Frequently deployed with weak or no authentication and left exposed to the internet. |
| 5985 / 5986 / TCP | WinRM / PowerShell Remoting | Remote management over HTTP / HTTPS. | A primary lateral-movement path with valid credentials (Evil-WinRM). Remote command execution by design. |
Windows, Active Directory & file sharing
| Port | Service | Purpose | Security angle |
|---|---|---|---|
| 135 / TCP | MS-RPC endpoint mapper | Tells clients which dynamic port a Windows RPC service is on. | Recon, plus WMI/DCOM lateral movement and authentication-coercion attacks (PetitPotam). |
| 137–139 / UDP + TCP | NetBIOS | Legacy Windows name service, datagrams, and sessions. | NBT-NS poisoning with Responder captures NTLM hashes straight off the wire. Disable NetBIOS where you can. |
| 445 / TCP | SMB | Windows file sharing, named pipes, and remote admin. | EternalBlue (MS17-010) → WannaCry and NotPetya. SMB relay, PsExec, and ransomware all move over 445. Never expose it to the internet; segment it internally. |
| 389 / 636 / 3268 / 3269 | LDAP / LDAPS / Global Catalog | Directory queries against Active Directory. | Full enumeration of users, groups, and permissions. Anonymous binds leak structure. Log4Shell payloads used jndi:ldap://. |
| 88 / TCP + UDP | Kerberos | Authentication in Active Directory. | Kerberoasting and AS-REP roasting pull crackable hashes. Golden and silver tickets forge access. A burst of 88 traffic from one workstation is a signal. |
| 5355 / 5353 / UDP | LLMNR / mDNS | Fallback name resolution on the local subnet. | Poisoning these is one of the most reliable ways to steal credentials on an internal network. Turn LLMNR off. |
| Port | Service | Purpose | Security angle |
|---|---|---|---|
| 25 / TCP | SMTP | Mail transfer between servers. | Open relays send spam and spoofed mail. Also an exfil channel — data mailed out to an attacker's server. |
| 587 / 465 / TCP | SMTP submission / SMTPS | Authenticated mail sending by clients. | Password spraying against submission; stolen credentials send phishing from a trusted domain. |
| 110 / 995 / TCP | POP3 / POP3S | Download mail to a client. | Cleartext on 110. Mailbox access with stolen credentials where MFA isn't enforced. |
| 143 / 993 / TCP | IMAP / IMAPS | Server-side mailbox access. | Legacy IMAP is a common way around MFA — watch for logins from unusual locations. |
Name resolution & network services
| Port | Service | Purpose | Security angle |
|---|---|---|---|
| 53 / UDP + TCP | DNS | Name-to-IP resolution. UDP for queries, TCP for zone transfers and large replies. | Tunnelling — C2 and exfil hidden in subdomain labels or TXT records. Amplification DDoS. Cache poisoning. Zone transfer (AXFR) leaks the whole namespace. DNS over HTTPS hides all of it on 443. |
| 67 / 68 / UDP | DHCP | Hands out IP addresses on a network. | Rogue DHCP servers redirect traffic. Option 121 can push an attacker's route. Starvation attacks exhaust the address pool. |
| 123 / UDP | NTP | Clock synchronisation. | The monlist command made NTP a huge amplification-DDoS source. Shifting a host's clock breaks auth and logging. |
| 161 / 162 / UDP | SNMP | Monitoring and managing network devices. | Default community strings (public / private) dump full device configs. Write access is device takeover. Also an amplification vector. |
| 514 / UDP | Syslog | Central logging. | Unauthenticated — logs can be spoofed or flooded to bury real events. Sometimes abused as an exfil channel. |
| 500 / 4500 / UDP | IKE / IPsec | VPN key exchange and NAT traversal. | Aggressive-mode IKE can leak a crackable pre-shared-key hash. A scan target for VPN enumeration. |
File transfer
| Port | Service | Purpose | Security angle |
|---|---|---|---|
| 20 / 21 / TCP | FTP | File transfer — 21 control, 20 data. | Cleartext credentials. Anonymous FTP exposes files. FTP bounce attacks proxy port scans through the server. |
| 69 / UDP | TFTP | Trivial file transfer — no authentication at all. | Used to pull configs off routers and switches and to stage malware. Should not be reachable. |
| 2049 / TCP + UDP | NFS | Unix network file shares. | World-readable or no_root_squash exports let anyone read or write files as root. |
| 873 / TCP | rsync | Directory synchronisation. | Exposed rsync modules with no authentication have leaked large datasets. |
Databases — should never face the internet
| Port | Service | Purpose | Security angle |
|---|---|---|---|
| 1433 / 1434 | Microsoft SQL Server | Relational database. 1434/UDP is the browser service. | xp_cmdshell turns SQL access into OS command execution. Brute-forced on the internet. |
| 3306 / TCP | MySQL / MariaDB | Relational database. | Internet-exposed instances with weak root passwords are mass-compromised and ransomed. |
| 5432 / TCP | PostgreSQL | Relational database. | COPY ... FROM PROGRAM gives command execution with the right privileges. |
| 6379 / TCP | Redis | In-memory key-value store. | No authentication by default. Exposed Redis is used to write SSH keys or cron jobs to disk — instant RCE — and for DDoS amplification. |
| 27017 / TCP | MongoDB | Document database. | Historically bound to all interfaces with no auth. Tens of thousands of instances were wiped and held for ransom. |
| 9200 / 9300 / TCP | Elasticsearch | Search and analytics store. 9200 is the REST API, 9300 node-to-node. | Open clusters have leaked billions of records. |
| 11211 / TCP + UDP | memcached | Caching layer. | UDP memcached produced the largest amplification DDoS on record (1.3 Tbps). Never expose it. |
Other worth recognising on sight
| Port | Service | Purpose | Security angle |
|---|---|---|---|
| 4444 / TCP | Metasploit default / reverse shells | Not a real service — a common default listener for exploitation frameworks and hand-rolled shells. | Seeing 4444 in traffic is a strong indicator of compromise. So are 1337, 31337, 5555. |
| 6667 / TCP | IRC | Chat protocol. | The classic botnet C2 channel — bots join a channel and take commands. Rare in normal enterprise traffic. |
| 1080 / TCP | SOCKS proxy | Generic TCP proxy. | Used to pivot through a compromised host and to anonymise attacker traffic. |
| 2375 / 2376 / TCP | Docker API | Remote control of the Docker daemon. | An exposed unauthenticated Docker socket is full host takeover — start a privileged container that mounts the host filesystem. |
| 6443 / 10250 / TCP | Kubernetes API / kubelet | Cluster control plane and node agent. | Anonymous or over-permissive access to either is cluster-wide compromise. |
| 623 / UDP | IPMI / BMC | Out-of-band server management. | Cipher-0 skips authentication; another flaw returns password hashes. A BMC sits below the OS — game over if taken. |
How attackers use ports
The same list of ports, read as a route through an intrusion — from first scan to data leaving the building.
Reconnaissance — port scanning
Before anything else, an attacker maps what's listening.
- Tools:
nmapfor depth,masscanfor internet-wide speed. - SYN scan (half-open) — send
SYN, read the reply, never finish. Fast and quiet. - UDP scan — slow and unreliable; no reply is ambiguous.
- FIN / NULL / XMAS scans — unusual flag combinations to slip past simple filters.
-sVgrabs service banners and versions; that version is what gets matched to an exploit.- In your telemetry: one source touching many ports on one host (vertical), or one port across many hosts (horizontal sweep) — lots of
SYNwith no completed handshake.
Initial access — exploiting what's exposed
Every open port is a candidate door.
- Brute force and password spraying against 22, 3389, 445, 21, 1433, and mailbox ports.
- Exploiting a known-vulnerable version — EternalBlue on 445, BlueKeep on 3389, Log4Shell against any port that reaches a vulnerable Java app.
- Default or weak credentials on databases, SNMP, IPMI, and admin consoles.
- Exposed management interfaces — Jenkins on 8080, Kubernetes on 6443, Docker on 2375.
Command & control — outbound on ports you allow
C2 almost always leaves over a port the firewall permits.
- 443 first, then 80 and 53 — because egress rules allow them and TLS hides the content.
- DNS tunnelling on 53; ICMP tunnelling; HTTPS C2 with a domain that looks ordinary.
- Odd ports — 4444, 6667, high random — are easier to catch, so mature actors avoid them.
- The tell is behaviour, not the port: small regular callbacks to one external address, long-lived or reconnecting.
Lateral movement
Reusing internal services to spread.
- 445 (PsExec, SMB), 135 (WMI/DCOM), 5985 (WinRM), 3389 (RDP), 22 (SSH).
- 88 (Kerberos) for ticket-based attacks — pass-the-ticket, silver tickets.
- Internal port scans from a host that has no business scanning.
Exfiltration
Data leaves the same way C2 arrives.
- 443 / 80 to cloud storage or a paste site; 53 as slow tunnelled DNS; 21 / 22 for FTP/SFTP; 25 over email.
- A custom high port straight to an attacker-controlled server.
- Signature: large sustained outbound volume to an unfamiliar destination or port, often outside business hours.
What a SOC watches for
Three lists: what should never be reachable, what to alert on, and the principles underneath both.
Never expose to the internet
- 445 (SMB), 135–139 (NetBIOS / RPC), 3389 (RDP), 5900 (VNC), 23 (Telnet)
- Every database port — 1433, 3306, 5432, 6379, 27017, 9200, 11211
- 161 (SNMP), 623 (IPMI), 69 (TFTP), 2375 (Docker), 10250 (kubelet)
- Anything that isn't deliberately meant to be a public service
Alert on
- Inbound connections to management ports from outside a known admin range.
- Outbound connections on unusual ports, or a known service on the wrong port (SSH on 443).
- One internal host connecting to many ports, or many hosts, in a short window.
- Traffic on 4444, 1337, 31337, 6667 — treat as compromise until disproven.
- DNS query volume or name-length anomalies to a single domain.
- Cleartext protocols carrying credentials — 21, 23, 80 logins, 110, 143.
- A new listening port on a server that wasn't there yesterday.
The principles underneath
- Inventory every listening port on every host, and know why each one is open.
- Default-deny outbound. Allow only the ports the business needs, and force web traffic through a proxy you can inspect.
- Put remote access — RDP, SSH, management UIs — behind a VPN or bastion, never straight on the internet.
- Segment internally so a foothold on one host can't reach 445 on every other host.
Quick reference
If you see this port in an alert or a capture — the first thought it should trigger.
| Port | Think… |
|---|---|
| 21 | FTP — cleartext creds, anonymous access |
| 22 | SSH — internet-facing means brute force; also tunnels |
| 23 | Telnet — should not exist; IoT botnets |
| 25 | SMTP — spam relay, spoofing, mail exfil |
| 53 | DNS — tunnelling / exfil if the volume or names look off |
| 80 | HTTP — cleartext; malware downloads and C2 |
| 88 | Kerberos — roasting, ticket attacks |
| 135 / 139 / 445 | Windows / SMB — lateral movement, EternalBlue, ransomware |
| 389 / 636 | LDAP — AD enumeration, Log4Shell |
| 443 | HTTPS — the C2 and exfil highway; inspect at a proxy |
| 1433 / 3306 / 5432 | Databases — must never be internet-facing |
| 3389 | RDP — ransomware front door |
| 4444 | Metasploit / reverse shell — assume compromise |
| 5985 / 5986 | WinRM — remote code execution, lateral movement |
| 6379 / 27017 / 9200 | Redis / Mongo / Elastic — open means data breach or RCE |
| 6667 | IRC — legacy botnet C2 |