Port List

Three ranges, three meanings

Ports 0 to 1023 are well-known and assigned by IANA; on Unix systems binding one traditionally requires root, which is why web servers start privileged and drop permissions. Ports 1024 to 49151 are registered, claimed by specific applications but not privileged. Ports 49152 to 65535 are ephemeral, handed out by the operating system for the client side of outbound connections. Seeing a connection from a high-numbered port is normal; seeing a service listening on one is worth a question.

The ones worth memorising

22 SSH, 25 SMTP, 53 DNS on both TCP and UDP, 80 HTTP, 443 HTTPS, 3306 MySQL, 5432 PostgreSQL, 6379 Redis, 27017 MongoDB, 3389 RDP, 445 SMB. Between them these cover most of what you will meet in a firewall rule or a scan result.

Databases should never be internet-facing

The single most common serious misconfiguration is a database bound to 0.0.0.0 with its port open. Redis on 6379 and MongoDB on 27017 historically shipped with no authentication at all, and internet-wide scanners find a newly exposed instance within minutes. If an application server needs the database, that is a private network or a bound loopback address with an SSH tunnel, never a public listener.

445 and 3389 are the ransomware doors

SMB on 445 carried WannaCry and NotPetya. RDP on 3389 is the most common initial access vector in ransomware incidents, generally through credential stuffing rather than any exploit. Neither belongs on the public internet under any circumstances; both belong behind a VPN.

Changing the port is not security

Moving SSH to 2222 cuts log noise from automated scanners that only try 22, which is a real operational benefit. It does not stop a targeted attacker, since a full port scan finds it in seconds and the banner identifies the service immediately. Treat it as noise reduction, not as a control, and keep key-based authentication doing the actual work.

UDP and TCP are separate namespaces

Port 53 TCP and port 53 UDP are different endpoints. DNS uses UDP for ordinary queries and TCP for zone transfers and responses too large for a single datagram, which is why blocking TCP 53 breaks DNSSEC-heavy zones in a way that looks intermittent and mystifying.