TCP and UDP ports
Every network service listens on a port, a number from 0 to 65535 that separates traffic within the same IP address. That whole range is split into three tiers by IANA, and knowing which tier a number falls into already tells you much of what to expect from it.
The same port 443 also carries HTTP/3 over QUIC, which runs over UDP instead of TCP, so "port 443" no longer implies a single transport protocol.
A well-known-range port (below 1024), so on Unix servers listening on it requires root privilege or an equivalent capability.
The registered secure alternative for the same service is port 587, meant for client mail submission instead of server-to-server relay.
Deliberate decision: unauthorized port scanning is an abuse vector and has legal implications in several countries. We prefer a clear, safe reference.
TCP performs a handshake before sending data and guarantees delivery and packet order. UDP sends directly, with no handshake and no order guarantee, which costs less overhead but leaves packet loss handling up to the application.
Because that range is reserved by IANA as "well-known" and historically tied to system services; the Unix kernel blocks unprivileged processes from listening on it by default.
Yes, they are independent numbering spaces. Port 53 is the classic example: DNS uses UDP/53 for normal queries and TCP/53 for zone transfers and large responses.
Because unrestricted SMTP on port 25 became a common spam vector from compromised machines; many ISPs block outbound traffic on it for residential clients and recommend 587, which requires authentication, for sending mail instead.
FTP data channel (active mode). Cleartext, prefer SFTP (22) or FTPS (990).
FTP control channel. Cleartext. Prefer SFTP (22) or FTPS (990).
SSH remote shell and SFTP file transfer with end-to-end encryption.
Legacy cleartext remote shell. Replaced by SSH (22).
Mail relay between servers. Supports STARTTLS. Often blocked by ISPs for end-users.
Name resolution. UDP for normal queries, TCP for zone transfers and large answers. DoT (853) and DoH (443) encrypt.
DHCP server listens for client requests on this port.
DHCP client receives server replies on this port.
Simple unauthenticated transfer. Common in PXE boot and network appliances.
Cleartext HTTP. In production always use HTTPS (443).
Kerberos authentication (KDC). Active Directory foundation.
Mail retrieval (legacy). Cleartext. Use POP3S (995).
Usenet / newsgroups. Rarely used today. Secure variant: NNTPS (563).
Time synchronization. Often abused in amplification attacks.
Microsoft DCE/RPC endpoint mapper. Never expose to the internet.
NetBIOS name resolution. Historical worm vector (Sasser/Conficker).
SMB over NetBIOS. Replaced by direct SMB on 445.
Mailbox access. Cleartext. Use IMAPS (993).
Network device management. v1/v2c cleartext. SNMPv3 encrypts.
Receives SNMP traps/alerts.
Public-internet routing protocol. TCP sessions between ASes.
Traditional IRC. TLS variant: 6697.
Directory service (Active Directory, OpenLDAP). Use LDAPS (636) or StartTLS.
Encrypted web (TLS 1.2/1.3). Also used by HTTP/3 over QUIC (UDP 443).
Direct SMB file sharing over TCP. WannaCry vector, block at the perimeter.
Mail submission with implicit TLS. Modern alternative to 587 with STARTTLS.
Centralized logging. Unencrypted; use TLS syslog (6514) for sensitive traffic.
Authenticated mail submission from clients. STARTTLS required by modern providers.
Printing (CUPS). Frequently exposed unnecessarily.
LDAP encrypted with implicit TLS.
DNS queries encrypted with TLS.
Cleartext rsync sync. Prefer rsync over SSH.
FTPS implicit-TLS data channel.
FTPS with implicit TLS. SFTP (22) is usually simpler to operate.
Encrypted IMAP access.
Encrypted POP3.
SOCKS4/5 proxy. Used by Tor and generic proxy clients.
OpenVPN, usually UDP. Can run on TCP in restrictive networks.
SQL Server. Do not expose to the public internet.
Oracle listener. Keep behind a firewall.
PPTP VPN, considered insecure. Use OpenVPN, IKEv2 or WireGuard.
AAA authentication. Use RADSEC for encrypted transport.
RADIUS accounting.
MQTT broker without TLS. Use MQTTS (8883) in production.
Unix file sharing. NFSv4 supports Kerberos authentication.
Docker API without TLS, equivalent to remote root access. NEVER expose to the internet.
Docker API with mandatory mutual TLS.
Informal default for Node dev servers (Next.js, Express).
MySQL/MariaDB database. TLS optional; keep private.
Windows remote desktop. Always behind a VPN or gateway.
NAT traversal for WebRTC and VoIP.
Default Phoenix Framework dev port.
ngrok local tunnel inspector UI.
Default Flask dev server. Conflicts with AirPlay on macOS.
Cleartext VoIP signaling. SIP-TLS on 5061.
VoIP signaling with TLS.
Default Vite dev port (React/Vue/Svelte).
XMPP messaging. Supports StartTLS.
Server-to-server XMPP federation.
Zero-config service discovery (.local).
PostgreSQL database. TLS configurable; keep private.
AMQP brokers (RabbitMQ). TLS on 5671.
VNC web-based client.
VNC remote display (RFB protocol). Tunnel via SSH on untrusted networks.
WinRM over HTTP. Use HTTPS (5986).
WinRM with TLS.
Redis cache/KV store. NEVER expose without auth, common cryptominer target.
Kubernetes API server with mandatory mTLS.
Alternative IRC port range.
IRC with TLS.
HTTP dev servers (Django, http.server).
Alternative HTTP. Common for proxies, dashboards and Tomcat.
Alternative HTTPS, common on admin dashboards.
MQTT with TLS.
PHP-FPM and assorted dev tooling.
Prometheus metrics endpoint.
Kafka broker. TLS/SASL configurable.
Elasticsearch/OpenSearch HTTP API. Keep private.
In-memory cache. UDP is an amplification vector, use TCP and firewall.
Minecraft Java server.
Source-engine based servers (CS:GO, TF2, etc).
MongoDB database. Do not expose without auth.
WireGuard VPN. Default port from the official docs.
Everything runs locally in your browser from an embedded catalog. This tool does not connect to IPs or ports, it is not a scanner.