The ports looked up most are 22 (SSH), 53 (DNS, UDP and TCP), 80 and 443 (HTTP and HTTPS), 25, 587 and 465 (sending mail), 993 and 995 (reading mail over TLS), 445 (Windows file sharing), 3389 (Remote Desktop) and 3306 (MySQL). Port numbers run from 0 to 65535: 0–1023 are System (well-known) ports, 1024–49151 User (registered) ports and 49152–65535 Dynamic (ephemeral) ports that IANA never assigns (RFC 6335). Below, 53 common ports with the transport the protocol actually uses, the service name in the IANA registry (updated 2026-09-30) and the RFC section or vendor document that names the port. To test whether a TCP port is reachable from the internet, use the Open Port Checker.
Common ports by number
| Port | Transport | Protocol / service | IANA service name | Defined in |
|---|---|---|---|---|
| 20 | TCP | FTP data (active mode) | ftp-data | RFC 959 §3.2 |
| 21 | TCP | FTP control | ftp | RFC 959 §8 |
| 22 | TCP | SSH, SFTP, SCP | ssh | RFC 4253 §4.1 |
| 23 | TCP | Telnet | telnet | RFC 854 |
| 25 | TCP | SMTP (server-to-server mail) | smtp | RFC 5321 §4.5.4.2 |
| 53 | UDP, TCP | DNS | domain | RFC 1035 §4.2, RFC 7766 §5 |
| 67 | UDP | DHCP / BOOTP server | bootps | RFC 2131 §4.1 |
| 68 | UDP | DHCP / BOOTP client | bootpc | RFC 2131 §4.1 |
| 69 | UDP | TFTP | tftp | RFC 1350 §4 |
| 80 | TCP | HTTP | http | RFC 9110 §4.2.1 |
| 88 | UDP, TCP | Kerberos | kerberos | RFC 4120 §7.2 |
| 110 | TCP | POP3 | pop3 | RFC 1939 §3 |
| 123 | UDP | NTP (time sync) | ntp | RFC 5905 §9.1 |
| 137 | UDP, TCP | NetBIOS name service | netbios-ns | RFC 1002 §6 |
| 138 | UDP | NetBIOS datagram service | netbios-dgm | RFC 1002 §6 |
| 139 | TCP | NetBIOS session service | netbios-ssn | RFC 1002 §6 |
| 143 | TCP | IMAP | imap | RFC 9051 §2.1 |
| 161 | UDP | SNMP (agent) | snmp | RFC 3417 §3.2 |
| 162 | UDP | SNMP traps / notifications | snmptrap | RFC 3417 §3.2 |
| 179 | TCP | BGP | bgp | RFC 4271 §3 |
| 389 | TCP | LDAP | ldap | RFC 4511 §5.2 |
| 443 | TCP | HTTPS (HTTP over TLS) | https | RFC 9110 §4.2.2 |
| 445 | TCP | SMB (Windows file sharing) | microsoft-ds | Microsoft SMB docs |
| 465 | TCP | SMTP submission over implicit TLS | submissions | RFC 8314 §3.3 |
| 500 | UDP | IKE (IPsec key exchange) | isakmp | RFC 7296 §2 |
| 514 | UDP | Syslog | syslog | RFC 5426 §3.3 |
| 587 | TCP | Mail submission | submission | RFC 6409 §3.1 |
| 636 | TCP | LDAPS (LDAP over TLS) | ldaps | IANA only |
| 853 | TCP | DNS over TLS (DoT) | domain-s | RFC 7858 §3.1 |
| 993 | TCP | IMAP over TLS | imaps | RFC 8314 §3.2, RFC 9051 §2.1 |
| 995 | TCP | POP3 over TLS | pop3s | RFC 8314 §3.1 |
| 1194 | UDP, TCP | OpenVPN | openvpn | OpenVPN manual |
| 1433 | TCP | Microsoft SQL Server | ms-sql-s | Microsoft SQL Server docs |
| 1434 | UDP | SQL Server Browser | ms-sql-m | Microsoft SQL Server docs |
| 1521 | TCP | Oracle Database listener | ncube-lm | Oracle Net docs |
| 1723 | TCP | PPTP (VPN control) | pptp | RFC 2637 §1.4 |
| 1812 | UDP | RADIUS authentication | radius | RFC 2865 §3 |
| 1813 | UDP | RADIUS accounting | radius-acct | RFC 2866 §3 |
| 1883 | TCP | MQTT | mqtt | OASIS MQTT 5.0 §4.2 |
| 3306 | TCP | MySQL | mysql | MySQL 8.4 manual |
| 3389 | TCP | Remote Desktop (RDP) | ms-wbt-server | Microsoft RDP docs |
| 3478 | UDP, TCP | STUN / TURN (NAT traversal) | stun | RFC 8489 §8.1 |
| 4500 | UDP | IPsec NAT traversal | ipsec-nat-t | RFC 3948, RFC 7296 §2 |
| 5060 | UDP, TCP | SIP (VoIP signalling) | sip | RFC 3261 §18.1.1 |
| 5061 | TCP | SIP over TLS | sips | RFC 3261 §18.1.1 |
| 5353 | UDP | Multicast DNS (.local names) | mdns | RFC 6762 §2 |
| 5432 | TCP | PostgreSQL | postgresql | PostgreSQL docs |
| 5900 | TCP | VNC (Remote Framebuffer) | rfb | RFC 6143 §2 |
| 6379 | TCP | Redis | redis | redis.conf |
| 8080 | TCP | Alternate HTTP | http-alt | IANA only |
| 8443 | TCP | Alternate HTTPS | pcsync-https | Apache Tomcat docs |
| 8883 | TCP | MQTT over TLS | secure-mqtt | OASIS MQTT 5.0 §4.2 |
| 27017 | TCP | MongoDB | mongodb | MongoDB manual |
How to read the table
- Transport is what the defining RFC or vendor documentation uses. IANA often registers more: before RFC 6335 (2011), IANA assigned ports for both TCP and UDP even when a protocol used only one; since then it assigns only the transports requested and marks the others Reserved (which is why 6379/udp and 27017/udp are Reserved).
- IANA service name is the registry's name for the assignment. Where it differs from everyday use (1521 "ncube-lm" for Oracle, 3389 "ms-wbt-server" for RDP, 8443 "pcsync-https") the note below explains.
- Defined in links the RFC section or vendor page that states the port. "IANA only" means no RFC or vendor page was found that defines it; the registration itself is the reference.
- IANA's own caution: assignment of a port "does not in any way imply an endorsement of an application or product", and traffic on a registered port does not necessarily correspond to the assigned service. Any program can listen on any port.
Ports by job
| File transfer | 20 FTP data (active mode), 21 FTP control, 69 TFTP |
|---|---|
| Remote access | 22 SSH, SFTP, SCP, 23 Telnet, 3389 Remote Desktop (RDP), 5900 VNC (Remote Framebuffer) |
| 25 SMTP (server-to-server mail), 110 POP3, 143 IMAP, 465 SMTP submission over implicit TLS, 587 Mail submission, 993 IMAP over TLS, 995 POP3 over TLS | |
| Network services | 53 DNS, 67 DHCP / BOOTP server, 68 DHCP / BOOTP client, 123 NTP (time sync), 853 DNS over TLS (DoT), 5353 Multicast DNS (.local names) |
| Web | 80 HTTP, 443 HTTPS (HTTP over TLS), 8080 Alternate HTTP, 8443 Alternate HTTPS |
| Directory & auth | 88 Kerberos, 389 LDAP, 636 LDAPS (LDAP over TLS), 1812 RADIUS authentication, 1813 RADIUS accounting |
| Windows & file sharing | 137 NetBIOS name service, 138 NetBIOS datagram service, 139 NetBIOS session service, 445 SMB (Windows file sharing) |
| Network management | 161 SNMP (agent), 162 SNMP traps / notifications, 514 Syslog |
| Routing | 179 BGP |
| VPN | 500 IKE (IPsec key exchange), 1194 OpenVPN, 1723 PPTP (VPN control), 4500 IPsec NAT traversal |
| Databases | 1433 Microsoft SQL Server, 1434 SQL Server Browser, 1521 Oracle Database listener, 3306 MySQL, 5432 PostgreSQL, 6379 Redis, 27017 MongoDB |
| IoT & messaging | 1883 MQTT, 8883 MQTT over TLS |
| Voice & video | 3478 STUN / TURN (NAT traversal), 5060 SIP (VoIP signalling), 5061 SIP over TLS |
Notes on specific ports
- 20 (FTP data (active mode)): RFC 959: the server's default data port is the one next to the control port (L-1 = 20). Passive-mode FTP uses a port the server announces instead.
- 21 (FTP control): Commands and replies only; files move on a separate data connection. Plain FTP sends passwords unencrypted.
- 22 (SSH, SFTP, SCP): RFC 4253: "the server normally listens for connections on port 22." SFTP and SCP run inside SSH on the same port.
- 23 (Telnet): Unencrypted remote terminal; RFC 854 assigns it server port 23.
- 25 (SMTP (server-to-server mail)): Mail relay between servers. Some providers block outbound port 25 from customer networks (RFC 5068); mail programs submit on 587 or 465 instead.
- 53 (DNS): RFC 1035 serves DNS on UDP and TCP port 53; RFC 7766 requires every general-purpose DNS implementation to support TCP as well as UDP.
- 67 (DHCP / BOOTP server): Clients send to the server on 67; servers answer on 68 (RFC 2131).
- 69 (TFTP): No login or encryption. Only the first request goes to 69; the transfer continues between other ports (RFC 1350).
- 80 (HTTP): Default for http:// URLs (RFC 9110).
- 88 (Kerberos): Key distribution centres (KDCs) accept requests on both UDP and TCP 88 (RFC 4120).
- 110 (POP3): Plain POP3; the TLS form is 995.
- 123 (NTP (time sync)): NTP packets are UDP datagrams (RFC 5905).
- 137 (NetBIOS name service): Microsoft: shares made with SMB2 or later don't use NetBIOS ports 137-139; only SMB1 servers need them.
- 143 (IMAP): RFC 9051 calls 143 the cleartext port and 993 the implicit-TLS port.
- 161 (SNMP (agent)): Agents (command responders) listen on UDP 161.
- 162 (SNMP traps / notifications): Notification receivers listen on UDP 162.
- 179 (BGP): RFC 4271: "BGP listens on TCP port 179."
- 389 (LDAP): The IETF way to encrypt LDAP is the StartTLS operation on the same connection (RFC 4513).
- 443 (HTTPS (HTTP over TLS)): Default for https:// URLs (RFC 9110). IANA also registers 443/udp; Microsoft's SMB over QUIC, for example, uses UDP 443.
- 445 (SMB (Windows file sharing)): Microsoft recommends blocking TCP 445 inbound from the internet and outbound to the internet at the corporate firewall.
- 465 (SMTP submission over implicit TLS): Two registrations share 465 (urd and submissions). RFC 8314 (2018) made it the implicit-TLS submission port and says clients and servers should support both 465 and STARTTLS on 587.
- 500 (IKE (IPsec key exchange)): IKE normally listens and sends on UDP 500; with NAT it can also use UDP 4500 (RFC 7296).
- 514 (Syslog): Syslog is registered on UDP only. TCP 514 is registered to "shell" (rsh), not syslog.
- 587 (Mail submission): RFC 6409: "Port 587 is reserved for email message submission." Mail programs send outgoing mail here, usually with STARTTLS.
- 636 (LDAPS (LDAP over TLS)): Registered by IANA ("ldap protocol over TLS/SSL (was sldap)") with no defining RFC.
- 853 (DNS over TLS (DoT)): IANA also assigns 853/udp for DNS over DTLS or QUIC (RFC 8094, RFC 9250).
- 1194 (OpenVPN): The OpenVPN manual calls 1194 "the official IANA port number assignment for OpenVPN"; it runs over UDP or TCP.
- 1433 (Microsoft SQL Server): Default instance; the SQL Server Browser service answers on UDP 1434.
- 1521 (Oracle Database listener): IANA registers 1521 to "nCube License Manager", but Oracle's documentation gives 1521 as the default listener port.
- 1723 (PPTP (VPN control)): Control connection only; the tunnelled data travels in GRE packets (RFC 2637).
- 1812 (RADIUS authentication): Early RADIUS used 1645, which clashes with another registration; 1812 is the assigned port (RFC 2865).
- 1813 (RADIUS accounting): Early deployments used 1646 (RFC 2866).
- 1883 (MQTT): OASIS: "TCP ports 8883 and 1883 are registered with IANA for MQTT TLS and non-TLS communication respectively."
- 3389 (Remote Desktop (RDP)): Microsoft: Remote Desktop listens "on port 3389 by default".
- 3478 (STUN / TURN (NAT traversal)): Default STUN port for both UDP and TCP; STUN over TLS uses 5349 (RFC 8489).
- 5060 (SIP (VoIP signalling)): RFC 3261: the default is 5060 for UDP, TCP and SCTP, and 5061 for TLS.
- 5432 (PostgreSQL): PostgreSQL: "The TCP port the server listens on; 5432 by default."
- 5900 (VNC (Remote Framebuffer)): Server number N typically listens on 5900+N; only 5900 is assigned by IANA (RFC 6143).
- 6379 (Redis): redis.conf: "default is 6379".
- 8080 (Alternate HTTP): IANA: "HTTP Alternate (see port 80)".
- 8443 (Alternate HTTPS): IANA registers 8443 to "PCsync HTTPS"; Apache Tomcat's documentation configures its HTTPS connector on 8443.
- 27017 (MongoDB): Default port for mongod and mongos (MongoDB).
Port number ranges (RFC 6335)
| Range (RFC 6335 name) | Port numbers | Count (ports) | How IANA assigns them |
|---|---|---|---|
| System Ports (Well Known Ports) | 0–1023 | 1,024 | Assigned by IANA through IETF Review or IESG Approval |
| User Ports (Registered Ports) | 1024–49151 | 48,128 | Assigned by IANA through IETF Review, IESG Approval or Expert Review |
| Dynamic Ports (Private or Ephemeral Ports) | 49152–65535 | 16,384 | Never assigned |
Ranges in practice
- Port numbers are 16-bit, so there are 65,536 of them (0–65535) per transport protocol. TCP, UDP, SCTP and DCCP each have their own registry using the same three ranges (RFC 6335).
- Port 0 is Reserved. Ports 1021 and 1022 (exp1, exp2) are assigned for experiments (RFC 6335 §6.1, RFC 4727).
- A client's source port is an ephemeral port picked by its operating system. IANA's Dynamic range is 49152–65535, but RFC 6056 recommends choosing from the whole range 1024–65535 to make ports harder to guess; its survey found, for example, NetBSD 5.0.1 using 49152–65535 and OpenBSD 4.2 using 1024–49151.
- Assigned System and User ports "SHOULD NOT be used without or prior to IANA registration" (IANA registry preamble).
Checking a port
- The Open Port Checker asks probes around the world to complete a TCP handshake with a host and port; UDP ports cannot be checked that way, because UDP has no handshake.
- The PCAP Analyzer reads .pcap and .pcapng files in your browser and lists the conversations, DNS lookups, HTTP requests and TLS handshakes in a capture, so you can see which ports were actually in use.
- A port that does not answer may be closed (no program listening), filtered by a firewall, or unreachable because the connection sits behind carrier-grade NAT. Test only systems you run or have permission to test.
Sources
- IANA, Service Name and Transport Protocol Port Number Registry, last updated 2026-09-30 (iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml). Used for: every service name, description and registered transport, and the assignment procedure per range.
- IETF, RFC 6335 (BCP 165), IANA Procedures for the Management of the Service Name and Transport Protocol Port Number Registry, 2011 (rfc-editor.org/rfc/rfc6335). Used for: the three port ranges and their names.
- IETF, RFC 6056, Recommendations for Transport-Protocol Port Randomization, 2011 (rfc-editor.org/rfc/rfc6056). Used for: ephemeral (client) port range advice.
- IETF RFCs, read at rfc-editor.org on 2026-10-06; each port is stated in the section cited in the table: RFC 854 (23); RFC 959 (20, 21); RFC 1002 (137, 138, 139); RFC 1035 (53); RFC 1350 (69); RFC 1939 (110); RFC 2131 (67, 68); RFC 2637 (1723); RFC 2865 (1812); RFC 2866 (1813); RFC 3261 (5060, 5061); RFC 3417 (161, 162); RFC 3948 (4500); RFC 4120 (88); RFC 4253 (22); RFC 4271 (179); RFC 4511 (389); RFC 5321 (25); RFC 5426 (514); RFC 5905 (123); RFC 6143 (5900); RFC 6409 (587); RFC 6762 (5353); RFC 7296 (500, 4500); RFC 7766 (53); RFC 7858 (853); RFC 8314 (465, 993, 995); RFC 8489 (3478); RFC 9051 (143, 993); RFC 9110 (80, 443).
- Microsoft Learn: Secure SMB traffic in Windows Server (learn.microsoft.com/en-us/windows-server/storage/file-server/smb-secure-traffic), read 2026-10-06. Used for port 445.
- OpenVPN 2.6 reference manual (--port) (openvpn.net/community-resources/reference-manual-for-openvpn-2-6/), read 2026-10-06. Used for port 1194.
- Microsoft Learn: Configure the Windows Firewall to allow SQL Server access (learn.microsoft.com/en-us/sql/sql-server/install/configure-the-windows-firewall-to-allow-sql-server-access), read 2026-10-06. Used for port 1433, 1434.
- Oracle Database 19c Net Services Administrator's Guide: Oracle Net Listener (docs.oracle.com/en/database/oracle/oracle-database/19/netag/configuring-and-administering-oracle-net-listener.html), read 2026-10-06. Used for port 1521.
- OASIS MQTT Version 5.0 §4.2 (docs.oasis-open.org/mqtt/mqtt/v5.0/os/mqtt-v5.0-os.html), read 2026-10-06. Used for port 1883, 8883.
- MySQL 8.4 Reference Manual: Connecting to the MySQL Server (dev.mysql.com/doc/refman/8.4/en/connecting.html), read 2026-10-06. Used for port 3306.
- Microsoft Learn: Change the listening port for Remote Desktop (learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/change-listening-port), read 2026-10-06. Used for port 3389.
- PostgreSQL documentation: Connections and Authentication (postgresql.org/docs/current/runtime-config-connection.html), read 2026-10-06. Used for port 5432.
- Redis: redis.conf (default configuration file) (raw.githubusercontent.com/redis/redis/unstable/redis.conf), read 2026-10-06. Used for port 6379.
- Apache Tomcat 10.1 SSL/TLS Configuration How-To (tomcat.apache.org/tomcat-10.1-doc/ssl-howto.html), read 2026-10-06. Used for port 8443.
- MongoDB Manual: Default MongoDB Port (mongodb.com/docs/manual/reference/default-mongodb-port/), read 2026-10-06. Used for port 27017.
Frequently asked questions
What port does HTTPS use?
HTTPS uses TCP port 443 and plain HTTP uses TCP port 80; RFC 9110 makes them the defaults when a URL gives no port. Port 8080 is registered as "HTTP Alternate", and 8443 is commonly used for alternate HTTPS (Apache Tomcat's documentation uses it) although IANA registers 8443 to "PCsync HTTPS".
What are ports 22 and 3389 used for?
Port 22 (TCP) is SSH, which also carries SFTP and SCP (RFC 4253). Port 3389 (TCP) is Windows Remote Desktop: Microsoft documents RDP as listening on 3389 by default; IANA registers it as "ms-wbt-server".
Which port should I use to send email: 25, 465 or 587?
Mail programs submit outgoing mail on 587 (STARTTLS, RFC 6409) or 465 (TLS from the first byte, RFC 8314); RFC 8314 says to support both. Port 25 is for server-to-server relay (RFC 5321), and some providers block outbound 25 from home connections. Reading mail uses 993 (IMAP over TLS) or 995 (POP3 over TLS).
What are well-known, registered and dynamic ports?
RFC 6335 splits the 65,536 port numbers into System (well-known) ports 0–1023 and User (registered) ports 1024–49151, both assigned by IANA, and Dynamic (private or ephemeral) ports 49152–65535, which are never assigned. RFC 6056 recommends that systems pick client ports from the whole range 1024–65535.
Does DNS use TCP or UDP?
Both, on port 53. Ordinary queries normally go over UDP, but RFC 1035 also defines TCP on port 53 and RFC 7766 requires every general-purpose DNS implementation to support TCP. Encrypted DNS over TLS uses TCP 853 (RFC 7858).
Was this article helpful?