Port Reference
Look up the standard service for any TCP/UDP port number (IANA registry).
Reading an Access Log Entry — Where Port Numbers Tell the Story
A server access log line shows a connection attempt from 198.51.100.42:54291 to 0.0.0.0:3389. Port 3389 is RDP — Remote Desktop Protocol. This is not a web request; it is a brute-force attempt against your Windows remote desktop service. The port number immediately identifies the service being probed without inspecting the payload. For security professionals reviewing logs, firewall rules, and intrusion detection alerts, port numbers are a primary signal — knowing what service lives on a given port is foundational network knowledge.
TCP and UDP port numbers are 16-bit unsigned integers (0–65535). IANA manages assignment across three ranges with different usage conventions. Understanding those ranges explains why some ports require root on Linux and others do not.
The Three Port Ranges
Well-known ports (0–1023), also called system ports, require root/administrator privileges to bind on Unix-like systems. This design prevents unprivileged processes from impersonating trusted services. HTTP (80), HTTPS (443), SSH (22), SMTP (25), DNS (53), and FTP (20/21) all live here. The privilege requirement is enforced by the operating system kernel — a process running as a regular user cannot open a listening socket on port 80 without capability escalation (or a reverse proxy on a high port that forwards to it).
Registered ports (1024–49151) are assigned by IANA to specific services but do not require root to bind. Applications like PostgreSQL (5432), MySQL (3306), Redis (6379), MongoDB (27017), and Elasticsearch (9200) use this range. "Registered" means IANA has officially associated the port with that service, but the assignment is advisory — nothing enforces it technically.
Dynamic/ephemeral ports (49152–65535) are reserved for temporary client-side ports. When your browser connects to port 443, your OS assigns a random port from this range as the source port for that connection. The server sends responses back to your IP and that ephemeral port. Each connection uses a different ephemeral port, allowing multiple simultaneous connections to the same destination service.
Notable Ports for Network Diagnostics
- 22 (SSH): secure remote shell. If exposed publicly, expect constant brute-force attempts — move to a non-standard port or use key-only authentication behind a VPN.
- 25 (SMTP): unencrypted mail relay. ISPs block outbound port 25 from residential connections to prevent spam. Use port 587 (SUBMISSION) for sending email from clients.
- 53 (DNS): both TCP and UDP. UDP for normal queries (<512 bytes); TCP for zone transfers and large responses (DNSSEC, large TXT records). DNS amplification attacks abuse open resolvers on port 53.
- 80/443 (HTTP/HTTPS): most firewalls allow outbound to these ports unrestricted, making them the default choice for any service that needs to reach arbitrary destinations.
- 3389 (RDP): high-value attack target. Exposed RDP is one of the most common initial access vectors in ransomware attacks — place behind VPN or restrict to specific source IPs.
- 6443 (Kubernetes API): exposed Kubernetes API servers with weak authentication are a frequent cloud misconfiguration finding.
- 8080/8443: conventional alternate HTTP/HTTPS ports for development servers, proxies, and services that cannot use the privileged ports directly.
How to Use This Tool
- Enter a port number to look up its IANA-registered service name, protocol (TCP/UDP/both), and description.
- Search by service name (e.g., "smtp", "redis", "kube") to find the associated port numbers.
- Data is derived from the IANA Service Name and Transport Protocol Port Number Registry — the authoritative assignment database.
◇ FAQ
01 Does this tool check whether a port is open on a remote host? +
No. Browsers cannot open arbitrary TCP connections to external hosts due to security restrictions (CORS and network sandboxing). This is a reference tool — it identifies which service uses a port number, not whether that port is reachable. For port scanning, use nmap from a command line or a server-side scan service.
02 What is the difference between TCP and UDP and when does it matter for port numbers? +
TCP is connection-oriented (three-way handshake, guaranteed delivery, ordered data). UDP is connectionless (fire-and-forget, lower overhead). Many services are defined on the same port number for both transports — DNS (53), NTP (123), DTLS. In practice: if you are opening a firewall rule and the tool shows "TCP and UDP," allow both unless you know the specific protocol your service uses.
03 Why do some services use both a standard port and an alternate port? +
The alternate port is usually for TLS encryption of the same service: HTTP (80) and HTTPS (443), SMTP (25) and SMTP/TLS (465 or STARTTLS on 587), IMAP (143) and IMAPS (993), POP3 (110) and POP3S (995). The unencrypted port often persists for backward compatibility or for internal traffic where encryption is handled by the network layer.
04 What happens if two services try to use the same port? +
The second service fails to bind. "Address already in use" (EADDRINUSE on Linux) is the error. On Linux, you can find which process owns a port with: ss -tlnp | grep :PORT or lsof -i :PORT. On Windows, use netstat -ano | findstr :PORT. IANA-registered ports reduce conflicts by reserving numbers for specific services, but in practice applications sometimes choose the same unregistered port — Redis defaults to 6379, and some monitoring agents also default to 6379.
