Common Ports & Protocols
The well-known TCP/UDP ports every analyst should know, grouped by service. 🔒 marks encrypted protocols.
Secure vs insecure pairs
Telnet 23SSH 22
HTTP 80HTTPS 443
FTP 21SFTP 22
LDAP 389LDAPS 636
IMAP 143IMAPS 993
POP3 110POP3S 995
Web
| 80 | TCP | HTTP | Unencrypted web traffic |
| 443 | TCP | HTTPS🔒 | Encrypted web (TLS) |
| 8080 | TCP | HTTP (alt) | Proxies, dev servers, app servers |
| 8443 | TCP | HTTPS (alt)🔒 | Alt TLS, admin consoles |
| 25 | TCP | SMTP | Mail relay between servers |
| 587 | TCP | SMTP (submission) | Client mail submission (STARTTLS) |
| 110 | TCP | POP3 | Retrieve mail (legacy) |
| 995 | TCP | POP3S🔒 | POP3 over TLS |
| 143 | TCP | IMAP | Sync mail (unencrypted) |
| 993 | TCP | IMAPS🔒 | IMAP over TLS |
File transfer & sharing
| 20 | TCP | FTP (data) | FTP file-transfer channel |
| 21 | TCP | FTP (control) | FTP commands — cleartext |
| 69 | UDP | TFTP | Trivial FTP — no authentication |
| 139 | TCP | NetBIOS Session | Legacy Windows file sharing |
| 445 | TCP | SMB | Windows file sharing (modern) |
| 2049 | TCP/UDP | NFS | Unix/Linux network file system |
| 9418 | TCP | Git | Git protocol — unauthenticated |
Remote access
| 22 | TCP | SSH🔒 | Encrypted shell, tunneling, SFTP |
| 23 | TCP | Telnet | Legacy remote shell — cleartext |
| 135 | TCP/UDP | MS RPC | Windows RPC endpoint mapper |
| 3389 | TCP/UDP | RDP🔒 | Windows Remote Desktop |
| 5900 | TCP | VNC | Cross-platform remote desktop |
Name, directory & auth
| 53 | TCP/UDP | DNS | Name resolution (TCP for zone transfers) |
| 43 | TCP | WHOIS | Domain registration lookups |
| 389 | TCP/UDP | LDAP | Directory queries (unencrypted) |
| 636 | TCP | LDAPS🔒 | LDAP over TLS |
| 49 | TCP | TACACS+🔒 | Network device AAA (Cisco) |
Core network services
| 67 | UDP | DHCP (server) | Hands out IP leases |
| 68 | UDP | DHCP (client) | Receives IP leases |
| 123 | UDP | NTP | Time synchronization |
| 137 | UDP | NetBIOS Name | Legacy Windows name service |
| 138 | UDP | NetBIOS Datagram | Legacy Windows datagrams |
| 161 | UDP | SNMP | Device monitoring / polling |
| 162 | UDP | SNMP Trap | Asynchronous device alerts |
| 514 | UDP | Syslog | Centralized logging |
| 179 | TCP | BGP | Internet routing between AS |
| 9100 | TCP | JetDirect | Raw network printing |
Databases
| 1433 | TCP | Microsoft SQL Server | MSSQL |
| 1521 | TCP | Oracle | Oracle Database listener |
| 3306 | TCP | MySQL | MySQL / MariaDB |
| 5432 | TCP | PostgreSQL | PostgreSQL |
| 6379 | TCP | Redis | In-memory key-value store |
| 27017 | TCP | MongoDB | NoSQL document database |
| 11211 | TCP/UDP | Memcached | Distributed memory cache |
VPN & tunneling
| 500 | UDP | IKE / IPsec🔒 | IPsec key exchange (ISAKMP) |
| 1194 | TCP/UDP | OpenVPN🔒 | OpenVPN default |
| 1701 | UDP | L2TP | Tunneling (paired with IPsec) |
| 1723 | TCP | PPTP | Legacy VPN — insecure |
| 51820 | UDP | WireGuard🔒 | Modern, fast VPN |
Messaging, media & other
| 502 | TCP | Modbus | ICS / SCADA industrial control |
| 554 | TCP/UDP | RTSP | Streaming media control |
| 1883 | TCP | MQTT | IoT publish/subscribe messaging |
| 4444 | TCP | Metasploit | Common reverse-shell / C2 default |
| 5060 | TCP/UDP | SIP | VoIP call signaling |
| 6667 | TCP | IRC | Internet Relay Chat |
| 9092 | TCP | Kafka | Event-streaming broker |
Reading a list won't stick. Drill these until they're instinct in Port Scan (spot the service) and Port Recall (type them from memory).