Essential Network Ports: Complete TCP & UDP Reference for Sysadmins and Engineers

Open Tool →

What is a Network Port?

In computer networking, an IP address identifies a specific host machine on a network, while a port number identifies the specific service, process, or application running on that host.

Ports operate at Layer 4 (Transport Layer) of the OSI model, primarily managed by two foundational protocols:

TCP (Transmission Control Protocol): Connection-oriented, reliable, guaranteed delivery via three-way handshake (SYN -> SYN-ACK -> ACK), flow control, and packet retransmission. Used by web traffic, SSH, file transfers, and transactional databases.

UDP (User Datagram Protocol): Connectionless, lightweight, low-overhead without handshake or acknowledgement. Packets are fire-and-forget. Used by DNS queries, video streaming, VoIP, online gaming, and modern HTTP/3 (QUIC).

A port number is represented as a 16-bit unsigned integer, giving a total range from 0 to 65,535.

---

The Three Official IANA Port Ranges

The Internet Assigned Numbers Authority (IANA) partitions the 65,536 available ports into three distinct tiers:

1. Well-Known Ports (0 – 1023)

Reserved for fundamental, system-level internet services. On Unix-like operating systems (Linux, macOS, BSD), binding a socket listener to a port below 1024 requires elevated administrative privileges (root or CAP_NET_BIND_SERVICE).

2. Registered Ports (1024 – 49,151)

Assigned by IANA to specific vendors, user processes, or enterprise software upon request (such as database engines and message queues like MySQL on 3306 or Redis on 6379). Ordinary user accounts can bind to these ports without root privileges.

3. Dynamic / Private / Ephemeral Ports (49,152 – 65,535)

Never assigned to standard listening daemons. When your web browser initiates an outbound connection to an HTTPS server on port 443, your operating system kernel dynamically assigns an unused ephemeral port (e.g., 52418) as the client-side return socket.

---

Critical Port Reference Cheatsheet

Here are the most vital ports that every software engineer, sysadmin, and cloud architect must know:

Core Internet & Remote Administration

Port 22 (TCP - SSH / SFTP): Secure Shell encrypted remote terminal login and secure file copy. Replace password login with ED25519 public key authentication and fail2ban.

Port 53 (TCP/UDP - DNS): Domain Name System. UDP handles short query/response packets under 512 bytes; TCP handles zone transfers and DNSSEC payloads.

Port 80 (TCP - HTTP): Unencrypted plaintext web traffic. Modern sites use Port 80 solely to redirect visitors to HTTPS with 301 Moved Permanently.

Port 443 (TCP/UDP - HTTPS / QUIC): Encrypted web traffic secured by TLS 1.3. Also handles HTTP/3 over UDP.

Database & In-Memory Caching (High Risk if Public)

Port 3306 (TCP - MySQL / MariaDB): Relational database engine. Should never be exposed directly to public internet (0.0.0.0/0). Bind to 127.0.0.1 or private VPC subnet.

Port 5432 (TCP - PostgreSQL): PostgreSQL relational database listener.

Port 6379 (TCP - Redis): In-memory key-value cache. Historically vulnerable because default Redis configurations did not enforce passwords. Thousands of exposed Redis instances have been compromised for crypto-mining.

Port 27017 (TCP - MongoDB): MongoDB NoSQL document store.

Modern VPNs & Cloud Orchestration

Port 1194 (UDP/TCP - OpenVPN): Traditional enterprise SSL/TLS VPN gateway.

Port 51820 (UDP - WireGuard): Next-generation high-speed VPN utilizing modern state-of-the-art Noise protocol cryptography with minimal attack surface.

Port 6443 (TCP - Kubernetes API Server): The primary control plane interface for kubectl commands and cluster controllers.

---

Firewall Hardening: The Principle of Least Privilege

Unused open ports represent an unnecessary attack surface. Automated bots continuously scan IPv4 address space using high-speed scanners like Masscan and ZMap to probe for exposed ports.

Follow these four rules for firewall security:

1. Default Deny Inbound: Configure ufw (Ubuntu) or AWS Security Groups to reject all inbound traffic by default. Explicitly whitelist only required ports. 2. Move Administrative Ports Off Defaults: While security through obscurity is not absolute protection, changing your SSH port from 22 to a random port like 2222 or 58222 eliminates 99% of automated credential-stuffing noise in your server logs. 3. Use Bastion Hosts or WireGuard Tunnels: Instead of opening database ports (3306, 5432) or internal dashboards to your office IP, tunnel access through an encrypted VPN gateway. 4. Inspect Port Status with netstat / ss:

# Check listening TCP/UDP sockets on Linux
   sudo ss -tuln

Need to inspect a mystery port number or verify protocol safety? Search our interactive Network Port Directory anytime for immediate details.

Editorial Integrity & Peer Review

All technical guides on MicroTools are independently authored and peer-reviewed by software and infrastructure professionals. Content is updated periodically to ensure compliance with the latest IETF RFC specifications, IEEE standards, and cloud provider architectural recommendations.