Common Ports Reference

Sends back whatever it receives. A legacy diagnostic service, normally disabled today.

IANA: echo · RFC 862

Silently throws away anything sent to it. UDP 9 is also a common destination for Wake-on-LAN magic packets.

IANA: discard · RFC 863

Character Generator service for network testing and debugging. Over TCP it sends a continuous stream of characters while the connection is open; over UDP it answers each datagram with one datagram of characters. Rarely used today.

Caution: UDP CHARGEN has been widely abused for reflection and amplification DDoS; keep it disabled.

IANA: chargen · RFC 864

Default FTP data channel in active mode; file contents and directory listings flow here. Passive mode uses a port chosen by the server instead.

Caution: Plaintext: credentials and data are not encrypted.

IANA: ftp-data · RFC 959

FTP control connection: login and commands such as listing, uploading and downloading files. Explicit FTPS (AUTH TLS) also starts here.

Caution: Plaintext: credentials and data are not encrypted.

IANA: ftp · RFC 959 · RFC 4217

Encrypted remote login and command execution. SFTP and SCP file transfers and port forwarding also run over SSH.

IANA: ssh · RFC 4251 · RFC 4253

Unencrypted remote terminal login. Still found on older network devices; SSH is the replacement.

Caution: Plaintext: credentials and data are not encrypted.

IANA: telnet · RFC 854

Mail transfer between mail servers (MTA to MTA). Mail clients should submit on 587 or 465 instead.

IANA: smtp · RFC 5321

Looks up registration records for domain names and IP address blocks. RDAP over HTTPS is its modern successor.

IANA: nicname · RFC 3912

Centralized authentication, authorization and accounting (AAA) for administrator logins to network devices. TACACS+ over TLS uses TCP 300.

Caution: Classic TACACS+ only obfuscates packet bodies; it is not real encryption.

IANA: tacacs · RFC 8907 · RFC 9887

Name resolution: turns domain names into IP addresses and other records. Most queries use UDP. TCP is also a standard transport and is used for zone transfers and when a response cannot be carried successfully over UDP.

IANA: domain · RFC 1035 · RFC 7766

DHCP servers listen here for address requests from clients; DHCP relay agents forward requests to this port too.

IANA: bootps · RFC 2131 · RFC 951

DHCP clients receive server replies (offers and acknowledgements) on this port.

IANA: bootpc · RFC 2131 · RFC 951

Simple file transfer with no login, often used for network boot (PXE) and for loading firmware or configs onto network devices.

Caution: No authentication or encryption.

IANA: tftp · RFC 1350

Returns information about the users of a host. Legacy and rarely enabled today.

IANA: finger · RFC 1288

Unencrypted web traffic. Today it mostly redirects browsers to HTTPS on 443.

Caution: Plaintext: credentials and data are not encrypted.

IANA: http · RFC 9110 · RFC 9112

Ticket-based network authentication; the core of Active Directory domain logons.

IANA: kerberos · RFC 4120

Carries the OSI transport service over TCP. Used by Siemens S7 PLC communication and by IEC 61850 MMS in substations.

IANA: iso-tsap · RFC 1006

Mail clients download messages from a mailbox. Without STARTTLS the login travels in cleartext, so POP3S on 995 is preferred.

IANA: pop3 · RFC 1939

Tells clients which port an ONC RPC service, such as NFS mountd or NIS, is using.

Caution: rpcbind exposed on UDP has been abused for DDoS amplification.

IANA: sunrpc · RFC 1833

Identification Protocol: lets a remote server ask which user owns a TCP connection. Some IRC and mail servers still query it.

IANA: auth / ident · RFC 1413

Reading and distributing Usenet news articles.

IANA: nntp · RFC 3977

Synchronizes the clocks of computers and network devices.

IANA: ntp · RFC 5905

Windows clients ask the RPC endpoint mapper which dynamic port a DCOM/RPC service, such as WMI or Active Directory replication, is using.

IANA: epmap · MS-RPCE

NetBIOS name registration and lookup of NetBIOS computer names. The NetBIOS standard (STD 19) defines the name service on both UDP and TCP 137; modern Windows mainly uses UDP.

IANA: netbios-ns · RFC 1001 · RFC 1002 · Microsoft Learn: Service overview and network port requirements for Windows

Legacy connectionless NetBIOS messages, used by the Windows Computer Browser (network neighborhood) service.

IANA: netbios-dgm · RFC 1001 · RFC 1002

Legacy transport for SMB file and printer sharing over NetBIOS. Modern Windows runs SMB directly on 445.

IANA: netbios-ssn · RFC 1001 · RFC 1002

Mail clients read and manage messages kept on the server, with folders synced across devices. IMAPS on 993 is preferred.

IANA: imap · RFC 9051

Monitoring systems poll network devices here to read or change status and counters (MIB objects).

Caution: SNMPv1 and v2c send the community string in cleartext; prefer SNMPv3.

IANA: snmp · RFC 3411 · RFC 3417

Devices send unsolicited alerts (traps and informs) to the monitoring station here.

IANA: snmptrap · RFC 3417

Used by routers to exchange routing information between autonomous systems (ASes); the protocol that routes the Internet.

IANA: bgp · RFC 4271

The IANA-registered port for Internet Relay Chat. Most IRC networks actually use 6667, or 6697 for TLS.

IANA: irc · RFC 2810

TACACS+ device-administration AAA protected by TLS 1.3; the secure counterpart of TCP 49.

IANA: tacacss · RFC 9887

Precision Time Protocol messages that are timestamped in hardware (such as Sync and Delay_Req) for sub-microsecond clock synchronization.

IANA: ptp-event · IEEE 1588-2019

Precision Time Protocol messages that need no precise timestamp, such as Announce and Follow_Up.

IANA: ptp-general · IEEE 1588-2019

Routers fetch validated prefix-origin information (VRPs, derived from ROAs that the cache has validated) from a local RPKI validator/cache to perform BGP Route Origin Validation (ROV).

IANA: rpki-rtr · RFC 6810 · RFC 8210

The RPKI-to-Router protocol protected by TLS.

IANA: rpki-rtr-tls · RFC 6810 · RFC 8210

Directory searches and authentication against Active Directory, OpenLDAP and other directory services.

IANA: ldap · RFC 4511

Connectionless LDAP over UDP, used by Windows clients to find and choose an Active Directory domain controller (the "LDAP ping" of the DC locator). This is Microsoft's protocol profile, not part of standard LDAP.

IANA: ldap · MS-ADTS: LDAP Ping · Microsoft Learn: Service overview and network port requirements for Windows

Encrypted web traffic. HTTP/1.1 and HTTP/2 run over TLS on TCP; HTTP/3 runs over QUIC on UDP.

IANA: https · RFC 9110 · RFC 9114

Windows file and printer sharing (SMB) directly over TCP; also used by Active Directory and Samba.

Caution: Should not be exposed to the Internet.

IANA: microsoft-ds · MS-SMB2

Kerberos password change and reset requests.

IANA: kpasswd · RFC 3244

Mail clients submit outgoing mail over implicit TLS (TLS from the first byte). Often still called SMTPS.

IANA: submissions · RFC 8314

IPsec VPN key exchange (IKEv1 and IKEv2): peers negotiate keys and security associations here.

IANA: isakmp · RFC 7296

Modbus over TCP: controllers read and write registers and coils on PLCs, meters and sensors.

Caution: No authentication or encryption.

IANA: mbap · Modbus Messaging on TCP/IP Implementation Guide V1.0b

Devices and servers send log messages to a syslog collector.

IANA: syslog · RFC 5424 · RFC 5426

BSD remote shell: runs commands on another host based on host trust.

Caution: Unencrypted and weakly authenticated; replaced by SSH.

IANA: shell

Legacy Line Printer Daemon print jobs; many network printers still accept them.

IANA: printer · RFC 1179

RIP (v1 and v2) routers exchange distance-vector routing updates.

IANA: router · RFC 2453

RIP for IPv6 routing updates.

IANA: ripng · RFC 2080

Reserved for the Db2 Administration Server (DAS), which was deprecated in earlier Db2 releases (such as 11.5) and is discontinued in current Db2 12.1. Database connections do not use this port; they use the instance service configured by SVCENAME.

IANA: ibm-db2 · IBM Docs, Db2 12.1: Discontinued functionality (DAS discontinued) · IBM Docs, Db2 11.5: Configuring the Db2 administration server (TCP 523; DAS deprecated)

DHCPv6 clients receive server replies on this port.

IANA: dhcpv6-client · RFC 9915

DHCPv6 servers and relay agents listen here for client requests.

IANA: dhcpv6-server · RFC 9915

Apple Filing Protocol file sharing, found on older Macs and NAS devices. macOS file sharing now uses SMB.

IANA: afpovertcp

Controls streaming media sessions (play, pause, stop) over a TCP or TLS connection; widely used by IP cameras. The media itself usually flows separately, for example as RTP on ports negotiated in the session.

Note: IANA also registers UDP 554. RTSP 1.0 (RFC 2326, now obsolete) sketched RTSP over UDP, but it was never specified well enough to interoperate, and RTSP 2.0 defines no UDP transport.

IANA: rtsp · RFC 7826

Mail clients submit outgoing mail with authentication, upgrading to TLS with STARTTLS.

IANA: submission · RFC 6409 · RFC 8314

Endpoint mapper for Microsoft DCE/RPC carried over HTTP (ncacn_http).

IANA: http-rpc-epmap · MS-RPCE

Out-of-band server management through the BMC (IPMI over LAN): power control and hardware monitoring.

Caution: Keep it on an isolated management network.

IANA: asf-rmcp · DMTF DSP0136 (ASF 2.0)

Internet Printing Protocol over HTTP for sending and managing print jobs; the basis of CUPS and driverless printing such as AirPrint. IPPS (IPP over HTTPS) uses the same port.

Note: IANA also registers UDP 631, but IPP itself does not use UDP. UDP 631 was used by the legacy CUPS browsing protocol, a separate CUPS mechanism for announcing printers.

IANA: ipp / ipps · RFC 8010 · RFC 8011

LDAP over implicit TLS: encrypted directory searches and binds.

IANA: ldaps

MPLS routers distribute labels to each other: UDP for neighbor discovery (hello), TCP for the session.

IANA: ldp · RFC 5036

Modbus/TCP Security: Modbus protected by TLS, with certificate-based authorization.

IANA: mbap-s · Modbus/TCP Security Protocol Specification

Automates network-device configuration and state retrieval with NETCONF (XML/YANG) over SSH.

IANA: netconf-ssh · RFC 6242

Encrypted DNS: DNS over TLS (DoT) on TCP and DNS over QUIC (DoQ) on UDP.

Note: UDP 853 is also registered for DNS over DTLS (RFC 8094), an Experimental RFC that is rarely deployed.

IANA: domain-s · RFC 7858 · RFC 9250 · RFC 8094

Sets up TWAMP sessions that measure round-trip delay, jitter and packet loss between two network points.

IANA: twamp-control · RFC 5357

Well-known receiver port for TWAMP test packets; sessions set up through TWAMP-Control usually negotiate their own port.

IANA: twamp-test · RFC 8545

rsync daemon for file synchronization and mirroring (rsync:// URLs). rsync over SSH uses port 22 instead.

IANA: rsync

BIND 9 remote control (rndc): reloads zones and manages the name server.

IANA: rndc · BIND 9 manual pages: rndc

FTP data channel over implicit TLS (FTPS).

IANA: ftps-data

FTP control channel over implicit TLS. Explicit FTPS (AUTH TLS) uses port 21 instead.

IANA: ftps

Telnet over implicit TLS. Rare, since SSH is the usual replacement.

IANA: telnets

IMAP over implicit TLS; the recommended way for mail clients to read mail on the server.

IANA: imaps · RFC 8314 · RFC 9051

POP3 over implicit TLS for downloading mail securely.

IANA: pop3s · RFC 8314

SOCKS proxy that relays arbitrary TCP connections (SOCKS5 can also relay UDP).

IANA: socks · RFC 1928

OpenVPN tunnels; UDP by default, TCP as an alternative through restrictive firewalls.

IANA: openvpn · OpenVPN 2.6 reference manual

Microsoft SQL Server database engine, default instance.

IANA: ms-sql-s · Microsoft Learn: Configure the Windows Firewall for SQL Server

SQL Server Browser: tells clients which TCP port a named instance is using.

IANA: ms-sql-m · Microsoft Learn: SQL Server Browser service

Citrix virtual app and desktop sessions (ICA/HDX) without Session Reliability. TCP is the classic transport; UDP carries the EDT adaptive transport.

IANA: ica · Citrix docs: Adaptive transport

Default port of the Oracle Database listener (Oracle Net / TNS). IANA assigns 1521 to another service and registers 2483 and 2484 (TLS) for Oracle instead.

Vendor default · Search-only numbers: 2483, 2484 · Oracle Net Services Reference: listener.ora parameters

Pre-standard RADIUS authentication port from early implementations; some equipment still defaults to it. The standard port is 1812.

De facto · RFC 2865

Pre-standard RADIUS accounting port from early implementations. The standard port is 1813.

De facto · RFC 2866

Windows and Office volume activation: clients contact the Key Management Service (KMS) host on this port by default. The port is configurable, and IANA assigns 1688 to another service.

Vendor default · Microsoft Learn: Configure a KMS host

Layer 2 tunnels, typically L2TP/IPsec remote-access VPNs in which IPsec provides the encryption.

IANA: l2tp · RFC 2661 · RFC 3931

H.323 call setup signaling (H.225.0 / Q.931) for VoIP and video conferencing systems.

IANA: h323hostcall · ITU-T H.225.0

PPTP VPN control channel; the tunneled data travels in GRE (IP protocol 47).

Caution: Considered insecure by current standards (MS-CHAPv2); use a modern VPN.

IANA: pptp · RFC 2637

Network access authentication and authorization, such as Wi-Fi 802.1X (WPA-Enterprise), VPN and device logins, against a RADIUS server.

IANA: radius · RFC 2865

RADIUS accounting: session start and stop records and usage data.

IANA: radius-acct · RFC 2866

MQTT publish/subscribe messaging for IoT devices, without TLS.

IANA: mqtt · OASIS MQTT 5.0

UPnP device discovery by multicast: routers, media servers, smart TVs and similar devices announce themselves here.

Caution: SSDP exposed to the Internet has been abused for DDoS amplification.

IANA: ssdp · OCF: UPnP specifications

Cisco Skinny (SCCP) signaling between IP phones and Cisco call control.

IANA: cisco-sccp

Network File System file sharing, common on Linux/UNIX and NAS. NFSv4 uses TCP on port 2049. NFSv3 supports both TCP and UDP on port 2049, although modern Linux normally leaves the NFS server's UDP listener disabled.

IANA: nfs · RFC 1813 · RFC 7530 · RFC 8881 · rpc.nfsd(8) (nfs-utils): -u / --udp

Commonly used collector port for NetFlow exports. Not an IANA assignment: set it to match the collector.

De facto

RADIUS carried over TLS (TCP) or DTLS (UDP), used to transport RADIUS securely across untrusted networks, for example between organizations or to cloud RADIUS services.

IANA: radsec · RFC 6614 · RFC 7360 · RFC 9765

ZooKeeper client connections (coordination service used by older Kafka, Hadoop and others).

Vendor default · ZooKeeper Getting Started (clientPort)

EtherNet/IP secured with TLS (TCP) or DTLS (UDP).

IANA: ethernet-ip-s · ODVA: CIP Security

EtherNet/IP implicit messaging: cyclic I/O data exchanged between PLCs and field devices.

IANA: EtherNet-IP-1 · ODVA PUB00213: EtherNet/IP Quick Start for Vendors

Docker Engine remote API without TLS.

Caution: Anyone who can reach it controls the host with no authentication; never expose it to untrusted networks.

IANA: docker · Docker docs: Configure remote access for Docker daemon

Docker Engine remote API protected with TLS and client certificates.

IANA: docker-s · Docker docs: Configure remote access for Docker daemon

etcd client API; Kubernetes stores its cluster state in etcd.

IANA: etcd-client

etcd member-to-member (peer) traffic for replication and leader election.

IANA: etcd-server

Telecontrol (SCADA) of power grids and substations using IEC 60870-5-104.

IANA: iec-104 · IEC 60870-5-104

Citrix sessions with Session Reliability, which wraps ICA in the Common Gateway Protocol (CGP) so a session survives brief network drops. In current Citrix documentation, TCP 2598 is the default port for incoming Session Reliability connections, and UDP 2598 is used when the EDT adaptive transport is used with Session Reliability enabled. IANA also registers TCP/UDP 2598 under the service name "citriximaclient".

Vendor default · Citrix docs: Session reliability policy settings (TCP port, default 2598) · Citrix docs: Adaptive transport

Default listening port of the Squid caching web proxy.

Vendor default · Squid configuration: http_port

iSCSI block storage: servers attach disks from a storage array over the network.

IANA: iscsi-target · RFC 7143

LDAP searches of the Active Directory global catalog, which covers every domain in a forest.

IANA: msft-gc · Microsoft Learn: Service overview and network port requirements for Windows

Active Directory global catalog searches over implicit TLS.

IANA: msft-gc-ssl · Microsoft Learn: Service overview and network port requirements for Windows

MySQL and MariaDB database server.

IANA: mysql

Windows Remote Desktop. TCP is always used; UDP is added for better performance on lossy or high-latency links.

Caution: A common brute-force target; avoid exposing it directly to the Internet.

IANA: ms-wbt-server · Microsoft Learn: Service overview and network port requirements for Windows · MS-RDPBCGR · MS-RDPEUDP

NAT traversal for WebRTC and VoIP: STUN discovers the public address, and TURN relays media when a direct path fails.

IANA: stun / turn · RFC 8489 · RFC 8656

Apache Subversion's own svn:// protocol (svnserve).

IANA: svn

Multicast discovery of devices and services on the local network, used by Windows network discovery, network printers and ONVIF cameras.

IANA: ws-discovery · OASIS WS-Discovery 1.1

Single-hop BFD control packets: detect link or neighbor failure in well under a second for routing protocols.

IANA: bfd-control · RFC 5880 · RFC 5881

BFD echo packets, looped back by the neighbor's forwarding plane to test the data path.

IANA: bfd-echo · RFC 5881

RADIUS Change of Authorization (CoA) and Disconnect messages, which let the server change or end an active session.

IANA: radius-dynauth · RFC 5176

PC-over-IP remote desktop (HP Anyware / Teradici, VMware Horizon): TCP for session setup, UDP for the display and media stream.

IANA: pcoip · HP Anyware: Required TCP/UDP ports for PCoIP

OpenTelemetry Protocol over gRPC: applications and agents send traces, metrics and logs to a collector.

IANA: opentelemetry · OpenTelemetry OTLP specification

OpenTelemetry Protocol over HTTP (protobuf or JSON). This is the OTLP specification's default port, not an IANA assignment.

Spec default · OpenTelemetry OTLP specification

Erlang Port Mapper Daemon: nodes of RabbitMQ and other Erlang/Elixir clusters look up each other's distribution ports.

IANA: epmd

Network Time Security key establishment: a TLS handshake that gives NTP clients keys to authenticate time responses.

IANA: ntske · RFC 8915

IPsec through NAT: IKE and ESP are encapsulated in UDP 4500 when a NAT is detected. RFC 9329 also defines TCP 4500 for networks that block UDP.

IANA: ipsec-nat-t · RFC 3948 · RFC 9329

Default collector port for IPFIX flow records, the IETF standard derived from NetFlow v9. Exporters may use SCTP, TCP or UDP.

IANA: ipfix · RFC 7011

BFD control packets for multihop sessions, for example between eBGP multihop or loopback-to-loopback peers.

IANA: bfd-multi-ctl · RFC 5883

VXLAN overlay: carries Layer 2 Ethernet frames across a routed IP network (data center fabrics, EVPN). The standard, IANA-assigned VXLAN port is UDP 4789. Linux historically uses UDP 8472 for VXLAN when no destination port is configured; 8472 is not the IANA-assigned VXLAN port and is currently assigned by IANA to another service.

IANA: vxlan · Search-only numbers: 8472 · RFC 7348 · Linux kernel: drivers/net/vxlan/vxlan_core.c (default port)

OPC UA binary protocol (opc.tcp) and discovery servers for industrial automation data exchange.

IANA: opcua-tcp · OPC 10000-6 (IEC 62541-6): Transport protocols

OPC UA PubSub datagrams (UADP) sent by UDP multicast.

IANA: opcua-udp · OPC 10000-14 (IEC 62541-14): UDP multicast

SIP call signaling for VoIP phones and PBXs, without encryption.

IANA: sip · RFC 3261

SIP signaling protected by TLS.

IANA: sips · RFC 3261

XMPP (Jabber) chat clients connect to their server.

IANA: xmpp-client · RFC 6120

Used for control traffic between wireless access points and a wireless LAN controller: joining, configuration and firmware updates.

IANA: capwap-control · RFC 5415

Data traffic between access points and a wireless LAN controller, carrying tunneled client frames.

IANA: capwap-data · RFC 5415

XMPP server-to-server federation.

IANA: xmpp-server · RFC 6120

STUN and TURN over TLS (TCP) or DTLS (UDP), often used to get WebRTC media through strict firewalls.

IANA: stuns / turns · RFC 8489 · RFC 8656 · RFC 7350

Multicast DNS: resolves .local names on the local link and underpins Bonjour and Avahi service discovery.

IANA: mdns · RFC 6762 · RFC 6763

Link-Local Multicast Name Resolution: Windows falls back to it when DNS cannot resolve a name.

Caution: Responses can be spoofed to capture credentials, so hardened networks often disable it.

IANA: llmnr · RFC 4795

Web Services on Devices over HTTP: after WS-Discovery, Windows talks to network printers, scanners and PCs here.

IANA: wsdapi · Microsoft Learn: WS-Discovery in WSDAPI

Web Services on Devices over HTTPS.

IANA: wsdapi-s · Microsoft Learn: WS-Discovery in WSDAPI

PostgreSQL database server.

IANA: postgresql

Kibana web UI for exploring and visualizing Elasticsearch data. IANA assigns 5601 to another service.

Vendor default · Kibana settings: server.port

AMQP messaging protected by TLS, for example with RabbitMQ.

IANA: amqps

AMQP message queuing; RabbitMQ's default listener.

IANA: amqp

Constrained Application Protocol, a lightweight web-style protocol for constrained IoT devices. UDP natively; TCP is also defined.

IANA: coap · RFC 7252 · RFC 8323

Secure CoAP: DTLS over UDP or TLS over TCP.

IANA: coaps · RFC 7252 · RFC 8323

VNC remote desktop (RFB protocol) for display :0; display :1 uses 5901, and so on.

IANA: rfb · RFC 6143

Windows Remote Management (WS-Management) over HTTP, used by PowerShell Remoting and Ansible.

IANA: wsman · Microsoft Learn: Installation and configuration for WinRM

Windows Remote Management (WS-Management) over HTTPS.

IANA: wsmans · Microsoft Learn: Installation and configuration for WinRM

X Window System display server for display :0 (displays :0 to :63 use 6000 to 6063). Usually tunneled through SSH instead of exposed.

IANA: x11

Geneve overlay encapsulation with extensible metadata, used for network virtualization (for example OVN, VMware NSX and AWS Gateway Load Balancer).

IANA: geneve · RFC 8926

Switches and routers export sampled packet headers and interface counters to an sFlow collector for traffic monitoring.

IANA: sflow · sFlow Version 5

Redis in-memory data store, used for caching, sessions and queues.

IANA: redis

Kubernetes API server (HTTPS), used by kubectl and cluster components. IANA assigns 6443 to another service.

Vendor default · Kubernetes: Ports and Protocols

Encrypted syslog: TLS over TCP, or DTLS over UDP.

IANA: syslog-tls · RFC 5425 · RFC 6012 · RFC 9662

OpenFlow switches connect to their SDN controller. The current, IANA-assigned OpenFlow port is TCP 6653.

Note: Older switches and controllers used 6633 before OpenFlow received its IANA assignment; the OpenFlow specification says uses of 6633 (and 976) should be discontinued. 6633 is not an OpenFlow assignment: IANA lists TCP 6633 as reserved and UDP 6633 for another service.

IANA: openflow · Search-only numbers: 6633 · ONF OpenFlow Switch Specification 1.5.1

The traditional plaintext Internet Relay Chat port (IANA registers 6665 to 6669 as ircu).

IANA: ircu · RFC 7194

Default port for Internet Relay Chat over TLS.

IANA: ircs-u · RFC 7194

Windows Delivery Optimization: PCs share Windows Update and Microsoft Store content with each other peer to peer.

IANA: ms-do · Microsoft Learn: Delivery Optimization workflow

Common alternate HTTP port for development servers and web consoles. IANA assigns 8000 to another service.

De facto

Registered alternate HTTP port, common for proxies, Apache Tomcat and other application servers.

IANA: http-alt

InfluxDB HTTP API for writing and querying time series data. IANA assigns 8086 to another service.

Vendor default · InfluxDB v2 configuration options (http-bind-address)

Common alternate HTTPS port for web consoles, appliances and application servers such as Tomcat. IANA assigns 8443 to another service.

De facto

MQTT publish/subscribe messaging protected by TLS.

IANA: secure-mqtt · OASIS MQTT 5.0

Cassandra CQL native transport for client queries.

Vendor default · Cassandra configuration: native_transport_port

Prometheus server web UI and query API. IANA assigns 9090 to another service.

Vendor default · Prometheus wiki: Default port allocations

Kafka broker listener for producers and consumers. IANA assigns 9092 to another service.

Vendor default · Apache Kafka quickstart

Raw print jobs sent straight to a network printer (HP JetDirect / AppSocket).

IANA: pdl-datastream

Default port where Prometheus node_exporter publishes host metrics.

Vendor default · Prometheus wiki: Default port allocations

Elasticsearch and OpenSearch HTTP REST API for indexing and search. Both use the default HTTP port range 9200-9300; a typical single-node deployment listens on 9200. IANA assigns 9200 to another service.

Vendor default · Elasticsearch networking settings · OpenSearch documentation: Network settings (http.port)

Elasticsearch node-to-node transport; a node binds the first free port from 9300 to 9400 by default.

Vendor default · Elasticsearch networking settings

Active Directory Web Services, used by the Active Directory PowerShell module and Active Directory Administrative Center.

IANA: adws · Microsoft Learn: Service overview and network port requirements for Windows

Git's native git:// protocol: unauthenticated and in practice read-only. Most hosting uses HTTPS or SSH instead.

IANA: git

Zabbix agent: the Zabbix server or proxy connects here for passive checks.

IANA: zabbix-agent · Zabbix agent configuration: ListenPort

Zabbix server or proxy trapper: active agents and zabbix_sender send data here.

IANA: zabbix-trapper · Zabbix server configuration: ListenPort

kubelet HTTPS API used by the control plane for logs, exec and metrics.

Vendor default · Kubernetes: Ports and Protocols

memcached in-memory cache. TCP is enabled normally; UDP is also supported (the -U option) but has been disabled by default since memcached 1.5.6.

Caution: UDP memcached exposed to the Internet was abused for massive DDoS amplification; keep UDP disabled unless you need it.

IANA: memcache · memcached docs: Configuring (TCP / UDP) · memcached(1) manual: -U, --udp-port · memcached 1.5.6 release notes

DNP3 SCADA protocol used by utilities (electricity, water) between control centers and outstations. TCP is typical; UDP is also allowed.

IANA: dnp · IEEE 1815-2012 (DNP3)

MongoDB database server.

IANA: mongodb

EtherNet/IP explicit messaging over TCP for configuration and on-demand data. UDP 44818 carries unconnected messages such as List Identity device discovery.

IANA: EtherNet-IP-2 · ODVA PUB00213: EtherNet/IP Quick Start for Vendors

BACnet/IP building automation for HVAC, lighting and access control. 47808 is 0xBAC0 in hexadecimal.

IANA: bacnet · ASHRAE: BACnet (Standard 135)

WireGuard VPN. WireGuard has no fixed port; 51820 comes from the official examples and is widely used by convention.

De facto · WireGuard quick start