Port List
A searchable reference of well-known TCP and UDP ports, what runs on them, and which ones should never face the internet.
Last reviewed by the Radiatus Cloud team
Port List
Searchable list of common TCP/UDP ports.
| Port | Protocol | Service |
|---|
Need this built for your product?
We design, build & host secure software & APIs.
Three ranges, three meanings
Ports 0 to 1023 are well-known and assigned by IANA; on Unix systems binding one traditionally requires root, which is why web servers start privileged and drop permissions. Ports 1024 to 49151 are registered, claimed by specific applications but not privileged. Ports 49152 to 65535 are ephemeral, handed out by the operating system for the client side of outbound connections. Seeing a connection from a high-numbered port is normal; seeing a service listening on one is worth a question.
The ones worth memorising
22 SSH, 25 SMTP, 53 DNS on both TCP and UDP, 80 HTTP, 443 HTTPS, 3306 MySQL, 5432 PostgreSQL, 6379 Redis, 27017 MongoDB, 3389 RDP, 445 SMB. Between them these cover most of what you will meet in a firewall rule or a scan result.
Databases should never be internet-facing
The single most common serious misconfiguration is a database bound to 0.0.0.0 with its port open. Redis on 6379 and MongoDB on 27017 historically shipped with no authentication at all, and internet-wide scanners find a newly exposed instance within minutes. If an application server needs the database, that is a private network or a bound loopback address with an SSH tunnel, never a public listener.
445 and 3389 are the ransomware doors
SMB on 445 carried WannaCry and NotPetya. RDP on 3389 is the most common initial access vector in ransomware incidents, generally through credential stuffing rather than any exploit. Neither belongs on the public internet under any circumstances; both belong behind a VPN.
Changing the port is not security
Moving SSH to 2222 cuts log noise from automated scanners that only try 22, which is a real operational benefit. It does not stop a targeted attacker, since a full port scan finds it in seconds and the banner identifies the service immediately. Treat it as noise reduction, not as a control, and keep key-based authentication doing the actual work.
UDP and TCP are separate namespaces
Port 53 TCP and port 53 UDP are different endpoints. DNS uses UDP for ordinary queries and TCP for zone transfers and responses too large for a single datagram, which is why blocking TCP 53 breaks DNSSEC-heavy zones in a way that looks intermittent and mystifying.
Related tools
- JSON Formatter — Format and beautify JSON in your browser. Pinpoints syntax errors by line and column, flags unsafe integers, and never uploads your data to a server.
- JSON Validator — Validate JSON syntax with precise line and column errors, and check documents against a JSON Schema. Runs locally in your browser, nothing uploaded.
- Regex Tester — Test regular expressions against sample text with live match highlighting, capture groups and flag control. Runs entirely in your browser.
- HTML Minifier — Minify HTML by removing comments and redundant whitespace, without breaking inline elements or pre blocks. Runs entirely in your browser.
Frequently Asked Questions
What are the three port ranges?
0 to 1023 well-known and privileged, 1024 to 49151 registered, 49152 to 65535 ephemeral for outbound client connections. A service listening on an ephemeral port deserves a question.
Which ports should never be exposed to the internet?
Database ports such as 3306, 5432, 6379 and 27017, plus SMB on 445 and RDP on 3389. Redis and MongoDB historically shipped with no authentication and are found by scanners within minutes.
Does changing the SSH port improve security?
It cuts scanner log noise, which is a real operational benefit, but it stops nothing targeted since a port scan finds it in seconds. Key-based authentication does the actual work.
Are TCP and UDP ports the same?
No, they are separate namespaces. Port 53 TCP and 53 UDP are different endpoints, which is why blocking TCP 53 breaks large DNS responses in ways that look intermittent.
Why do web servers need root to start?
Because binding a port below 1024 traditionally requires privilege on Unix. Servers start as root to bind 80 and 443, then drop to an unprivileged user for the actual work.
Privacy & Security
Local processing.
About This Tool
This tool runs entirely in your browser. No data is sent to any server, ensuring complete privacy. Simply use the interface above to get started — no registration or login required.
Disclaimer: This tool is provided "as is" without warranty of any kind. Results are for educational and utility purposes.
Related Tools
JSON Formatter
DeveloperFormat and beautify JSON in your browser. Pinpoints syntax errors by line and column, flags unsafe integers, and never uploads your data to a server.
JSON Validator
DeveloperValidate JSON syntax with precise line and column errors, and check documents against a JSON Schema. Runs locally in your browser, nothing uploaded.
Regex Tester
DeveloperTest regular expressions against sample text with live match highlighting, capture groups and flag control. Runs entirely in your browser.