Port reference

TCP ports are numbered endpoints on a networked device, ranging from 0 to 65,535. Each port is associated with a specific service or protocol. When a port is open, a program is actively listening for incoming connections on the port number. Knowing which ports are open on a system helps identify running services and spot unintended exposure.

portscan.com checks TCP ports from outside the network to show what is reachable from the internet. The fast scan covers 30 common ports. The deep scan covers all 65,535.

Understanding port states

A port scan reports each port in one of three states.

Open. A service is listening and accepting connections. Expected for intentional services like a web server on port 443. Worth investigating when a database port or remote access port is unexpectedly exposed.

Closed. No service is listening. The host sent back an active rejection (TCP RST). Not a security concern.

Filtered. No response at all. A firewall or router silently dropped the connection attempt. Normal for residential connections behind a router or corporate firewall.

Well-known ports (0–1023)

Ports in this range are assigned by IANA to widely used protocols and services. The portscan.com fast scan includes 15 ports from this range, marked with • below.

Port	Service	Description	Fast
7	Echo	Echoes received data back to sender Disable if not needed. Used in amplification attacks.
20	FTP Data	FTP data transfer channel
21	FTP	File Transfer Protocol (control) Credentials transmitted in plaintext. Use SFTP on port 22 instead.	•
22	SSH	Secure Shell remote access Ensure key-based authentication is enabled and password login is disabled.	•
23	Telnet	Unencrypted remote terminal access All traffic including passwords sent in plaintext. Replace with SSH.	•
25	SMTP	Simple Mail Transfer Protocol Verify the server is not configured as an open relay.	•
37	Time	Time Protocol
42	WINS	Windows Internet Name Service
43	WHOIS	WHOIS directory lookups
49	TACACS	Terminal Access Controller Access-Control System
53	DNS	Domain Name System Open resolvers are used in amplification attacks. Restrict recursive queries.	•
67	DHCP	Dynamic Host Configuration Protocol (server)
68	DHCP	Dynamic Host Configuration Protocol (client)
69	TFTP	Trivial File Transfer Protocol No authentication mechanism. Restrict network access.
70	Gopher	Gopher protocol
79	Finger	User information lookup Discloses user information. Disable on public systems.
80	HTTP	Hypertext Transfer Protocol	•
88	Kerberos	Kerberos authentication
102	ISO-TSAP	ISO Transport Service Access Point
110	POP3	Post Office Protocol v3 Credentials sent in plaintext. Use POP3S on port 995.	•
111	RPCbind	Sun Remote Procedure Call Frequently targeted for exploitation. Restrict access.
113	Ident	Identification Protocol
119	NNTP	Network News Transfer Protocol
123	NTP	Network Time Protocol Misconfigured NTP servers are used in amplification attacks.
135	MSRPC	Microsoft Remote Procedure Call Common target. Block at the perimeter.	•
137	NetBIOS-NS	NetBIOS Name Service Do not expose to the internet.
138	NetBIOS-DGM	NetBIOS Datagram Service Do not expose to the internet.
139	NetBIOS-SSN	NetBIOS Session Service Do not expose to the internet.	•
143	IMAP	Internet Message Access Protocol Credentials sent in plaintext. Use IMAPS on port 993.	•
161	SNMP	Simple Network Management Protocol Default community strings (“public”, “private”) are a widespread vulnerability.
162	SNMP Trap	SNMP notifications
179	BGP	Border Gateway Protocol
194	IRC	Internet Relay Chat
199	SMUX	SNMP Unix Multiplexer
389	LDAP	Lightweight Directory Access Protocol Use LDAPS on port 636 for encrypted connections.
443	HTTPS	HTTP over TLS (encrypted web traffic)	•
445	SMB	Server Message Block (file sharing) Common vector for ransomware and worms. Block at the perimeter unless required.	•
464	Kpasswd	Kerberos password change
465	SMTPS	SMTP over implicit TLS Originally assigned to SMTPS, briefly reassigned, now restored for submissions over TLS.
497	Retrospect	Dantz Retrospect backup
500	IKE	Internet Key Exchange for IPsec VPN
502	Modbus	Modbus industrial protocol Industrial control protocol. Never expose to the public internet.
512	rexec	Remote execution
513	rlogin	Remote login Unencrypted. Replace with SSH.
514	Syslog	BSD Syslog Protocol No authentication by default.
515	LPD	Line Printer Daemon
520	RIP	Routing Information Protocol
548	AFP	Apple Filing Protocol
554	RTSP	Real Time Streaming Protocol
587	Submission	Email message submission (authenticated SMTP) Preferred port for email clients sending mail with authentication.	•
593	HTTP RPC	Microsoft DCOM services over HTTP
623	IPMI	Intelligent Platform Management Interface Remote management interface. Frequently targeted. Restrict access.
636	LDAPS	LDAP over TLS
873	rsync	rsync file synchronization Verify access controls if exposed publicly.
902	VMware	VMware ESXi authentication
993	IMAPS	IMAP over TLS	•
995	POP3S	POP3 over TLS	•

Registered ports (1024–49151)

Registered ports are assigned by IANA to specific applications and services. This range includes databases, application servers, development tools, and container platforms. The fast scan includes 15 ports from this range, marked with • below.

Port	Service	Description	Fast
1080	SOCKS	SOCKS proxy server Open proxies are frequently abused for traffic laundering.
1099	RMI	Java RMI Registry Deserialization vulnerabilities are common.
1194	OpenVPN	OpenVPN tunnel
1433	MSSQL	Microsoft SQL Server Database port exposed to the internet. This is almost never appropriate.	•
1434	MSSQL Browser	SQL Server Browser Service
1521	Oracle	Oracle Database listener Database port exposed. Restrict to application servers only.
1723	PPTP	Point-to-Point Tunneling Protocol Considered cryptographically broken. Use modern VPN protocols.
1883	MQTT	Message Queuing Telemetry Transport Often deployed without authentication.
1900	SSDP	Simple Service Discovery (UPnP) Used in amplification attacks. Disable UPnP on public interfaces.
2049	NFS	Network File System Do not expose to the internet. Restrict to trusted internal networks.
2082	cPanel	cPanel web hosting control panel (HTTP)
2083	cPanel	cPanel web hosting control panel (HTTPS)
2181	ZooKeeper	Apache ZooKeeper coordination service No authentication by default. Restrict to internal networks.
2375	Docker	Docker daemon API (unencrypted) Unauthenticated remote root access by default. Never expose publicly.	•
2376	Docker TLS	Docker daemon API (encrypted)
3000	Dev / Grafana	Grafana dashboards, Node.js development servers Verify whether public exposure is intentional.
3128	Squid	Squid HTTP proxy
3268	LDAP GC	Active Directory Global Catalog
3269	LDAP GC TLS	Active Directory Global Catalog over TLS
3306	MySQL	MySQL / MariaDB database Database port exposed to the internet. This is almost never appropriate.	•
3389	RDP	Remote Desktop Protocol Frequent target for brute-force and credential stuffing attacks. Use VPN or gateway instead.	•
3690	SVN	Apache Subversion
4443	HTTPS Alt	Common alternative HTTPS port
4848	GlassFish	GlassFish application server admin
5000	UPnP / Dev	Docker Registry, Flask, Synology DSM Verify whether public exposure is intentional.	•
5060	SIP	Session Initiation Protocol (unencrypted)
5061	SIP TLS	Session Initiation Protocol (encrypted)
5222	XMPP	XMPP / Jabber client connections
5432	PostgreSQL	PostgreSQL database Database port exposed to the internet. This is almost never appropriate.	•
5601	Kibana	Kibana log analytics dashboard Restrict access. Exposes potentially sensitive log data.
5672	AMQP	RabbitMQ and AMQP message broker
5900	VNC	Virtual Network Computing (remote desktop) Often lacks encryption and strong authentication. Tunnel through SSH or VPN.	•
5984	CouchDB	Apache CouchDB Default configuration allows unauthenticated access.
5985	WinRM HTTP	Windows Remote Management (HTTP)
5986	WinRM HTTPS	Windows Remote Management (HTTPS)
6379	Redis	Redis in-memory data store No authentication by default. Has been widely exploited when exposed publicly.	•
6443	Kubernetes	Kubernetes API server	•
6660–6669	IRC	Internet Relay Chat (common port range)
6697	IRC TLS	IRC over TLS
7001	WebLogic	Oracle WebLogic Server
7474	Neo4j	Neo4j graph database HTTP interface
8000	HTTP Alt	Alternative HTTP port, Python dev servers
8008	HTTP Alt	Alternative HTTP port
8080	HTTP Proxy	HTTP proxy, Apache Tomcat, development servers Common for management interfaces. Verify access controls.	•
8081	HTTP Alt	Alternative HTTP, management and admin interfaces
8443	HTTPS Alt	Alternative HTTPS port	•
8500	Consul	HashiCorp Consul service mesh
8834	Nessus	Nessus vulnerability scanner web UI
8888	HTTP Alt	Alternative HTTP, Jupyter Notebook Verify whether public exposure is intentional.
9000	SonarQube	SonarQube code analysis, PHP-FPM
9042	Cassandra	Apache Cassandra CQL native transport
9090	Prometheus	Prometheus monitoring metrics endpoint Restrict access. Exposes internal infrastructure metrics.	•
9100	JetDirect	HP JetDirect network printing Printers and print servers are not intended for internet access.
9200	Elasticsearch	Elasticsearch REST API Restrict access. Often contains sensitive indexed data.	•
9300	Elasticsearch	Elasticsearch node-to-node transport
9418	Git	Git protocol (unauthenticated)
9443	HTTPS Alt	Alternative HTTPS port
10000	Webmin	Webmin system administration panel
11211	Memcached	Memcached distributed cache No authentication. Widely abused in amplification attacks.	•
11371	HKP	OpenPGP HTTP Keyserver Protocol
15672	RabbitMQ	RabbitMQ management web interface
25565	Minecraft	Minecraft game server
27017	MongoDB	MongoDB database Verify authentication is enabled. Thousands of exposed MongoDB instances have been compromised due to default configurations.	•
27018	MongoDB	MongoDB shard server
28017	MongoDB	MongoDB HTTP status interface (deprecated)
32400	Plex	Plex Media Server

Dynamic and ephemeral ports (49152–65535)

Ports 49152 through 65535 are not assigned to any specific service. Operating systems use this range for temporary outbound connections. A client opening a web page, for example, uses a random port from this range for the local side of the connection.

Open ports in this range rarely appear in scan results. When they do, the cause is typically custom software, a development server, or a misconfigured application listening on a non-standard port. The deep scan on portscan.com covers all ports in this range.

Frequently asked questions

How many TCP ports are there?

There are 65,535 TCP ports, numbered 1 through 65,535 (port 0 is reserved). These are divided into three ranges defined by IANA: well-known ports (0–1023) for established protocols like HTTP and SSH, registered ports (1024–49151) for applications and services like databases and game servers, and dynamic ports (49152–65535) used by operating systems for temporary connections.

Are open ports a security risk?

An open port is not inherently dangerous. Port 443 open on a web server is expected and necessary. The risk comes from ports open unintentionally, running outdated software, or exposed without authentication. Database ports like MySQL (3306), PostgreSQL (5432), and MongoDB (27017) are common examples of services frequently exposed by accident. Redis (6379) has no password protection by default and has been widely exploited when reachable from the internet.

What ports are dangerous to leave open?

No port is dangerous by itself. The risk depends on the service behind the port and how the service is configured. Ports frequently involved in security incidents include: RDP (3389) due to brute-force attacks, SMB (445) as a ransomware vector, database ports (1433, 3306, 5432, 27017) when exposed without authentication, Docker API (2375) which grants unauthenticated root access by default, and Redis (6379) which lacks authentication in default configurations. Telnet (23) and FTP (21) transmit credentials in plaintext and are best replaced with SSH.

What is the difference between closed and filtered?

A closed port actively rejected the connection by sending back a TCP RST packet. This means the host is reachable, a network path exists, but no service is listening on the port. A filtered port gave no response at all because a firewall or router silently dropped the packet. Both states mean the port is not usable from the outside. The distinction matters for troubleshooting: filtered suggests a firewall rule is blocking traffic, while closed suggests the service is simply not running.

What if all ports show as filtered?

All ports showing as filtered is normal for a residential internet connection. A home router or ISP-provided gateway typically blocks all unsolicited inbound traffic by default. Corporate firewalls do the same. This result means the firewall is working as intended. The device behind the router is not directly reachable on any port from the internet.

Is port 80 typically blocked?

ISPs sometimes block port 80 on residential connections to discourage running web servers from home. This is an ISP-level policy, not a universal rule. Business and hosting connections generally leave port 80 open. Running a port scan from portscan.com reveals whether port 80 is reachable from the outside, regardless of local configuration.

What is port 445 used for?

Port 445 is used by SMB (Server Message Block), the protocol for file and printer sharing on Windows networks. SMB is designed for internal network use. Exposing port 445 to the internet is a well-known security risk. The WannaCry ransomware outbreak in 2017 spread through exposed SMB ports using the EternalBlue exploit. Port 445 found open on a public IP warrants immediate investigation.

← Back to portscan.com