Common network ports: the numbers worth memorizing
An IP address gets traffic to the right machine; a port number gets it to the right program on that machine. Port 443 on a server might be a web server while port 5432 on the same box is Postgres. Every TCP or UDP connection is really a four part address: source IP, source port, destination IP, destination port.
Ports are 16 bit numbers, 0 through 65535, split by convention into three ranges:
| Range | Name | Used for |
|---|---|---|
| 0 – 1023 | Well known | Standard services; binding usually needs root/admin |
| 1024 – 49151 | Registered | Applications and databases, registered with IANA |
| 49152 – 65535 | Ephemeral | Chosen automatically by your OS for outgoing connections |
That last range answers a common confusion: when your browser connects to a server's port 443, your side of the connection uses a random high port. Thousands of connections to the same destination port stay distinguishable because each has a different source port.
The ports you actually meet
Web:
| Port | Service | Notes |
|---|---|---|
| 80 | HTTP | Plain text web traffic; today mostly redirects to 443 |
| 443 | HTTPS | HTTP over TLS; also HTTP/3 over UDP on the same number |
| 8080, 8000, 3000, 5173 | Dev servers, proxies | Conventional alternates for local development |
Port 8080 exists because 80 requires elevated privileges on Unix systems, so developers and proxies converged on "80 with something in front of it". The difference between the traffic on 80 and 443 is worth understanding fully: see HTTP vs HTTPS.
Remote access and file transfer:
| Port | Service | Notes |
|---|---|---|
| 22 | SSH | Also carries SFTP and SCP |
| 23 | Telnet | Unencrypted; if you see it open, that is a finding |
| 21 | FTP | Control channel; data flows on other ports, which is why FTP and firewalls fight |
| 3389 | RDP | Windows remote desktop; a top target for attackers when exposed |
Email:
| Port | Service | Notes |
|---|---|---|
| 25 | SMTP | Server to server delivery; residential ISPs commonly block it |
| 587 | SMTP submission | Your app or mail client sending outbound mail, with STARTTLS |
| 465 | SMTPS | Implicit TLS submission, revived as a standard in 2018 |
| 993 | IMAPS | Reading mail over TLS |
If mail is failing, the split between 25 and 587 is the first thing to check, and MX records are the second.
DNS:
| Port | Service | Notes |
|---|---|---|
| 53 | DNS | UDP for most queries, TCP for large responses and zone transfers |
| 853 | DNS over TLS | Encrypted DNS |
DNS over HTTPS hides inside 443, indistinguishable from web traffic, which is precisely its design goal.
Databases and infrastructure:
| Port | Service |
|---|---|
| 5432 | PostgreSQL |
| 3306 | MySQL / MariaDB |
| 6379 | Redis |
| 27017 | MongoDB |
| 1433 | Microsoft SQL Server |
| 9200 | Elasticsearch |
| 5672 / 15672 | RabbitMQ (AMQP / management UI) |
| 9092 | Kafka |
A hard learned rule about this table: none of these should ever be reachable from the public internet. Databases exposed on their default ports get found by scanners within minutes, and unauthenticated Redis and MongoDB instances have fed years of breach headlines. Bind them to private interfaces and reach them through a VPN or SSH tunnel.
Everything else you will recognize:
| Port | Service |
|---|---|
| 123 | NTP, time sync |
| 67 / 68 | DHCP |
| 445 | SMB, Windows file sharing |
| 5900 | VNC |
| 51820 | WireGuard (UDP) |
| 1194 | OpenVPN |
What does a port error tell you?
The failure mode tells you something:
- Connection refused, and instantly: the machine is up, but nothing is listening on that port, or a firewall actively rejected it. The port is closed.
- Timeout, after long seconds: packets are being silently dropped, almost always by a firewall configured to drop rather than reject. From outside, this is indistinguishable from the host being offline, which is intentional.
- Connects but the protocol fails: something is listening, but it is not the service you expected. Talking HTTP to a TLS port produces garbage or a reset; browsers show a cipher mismatch style error, covered in our cipher mismatch guide.
nc -zv host 443 or telnet host 443 answers "is anything listening" in one line.
Can two programs share a port?
On one IP and one protocol, no: binding a TCP port that is already bound fails with "address already in use", the error behind every "port 3000 is already taken" moment in development. But the same port number can be reused across different IPs on the same machine, and TCP 443 and UDP 443 are entirely separate, which is how HTTP/3 (UDP) and HTTP/2 (TCP) share the number.
Ports are one axis of addressing; the IP side, subnets, and what makes an address public or private are the other. For those, see public vs private IP addresses and the IP Lookup tool, which shows what the internet sees about any address, including your own.