Ports & Protocols Reference

A reference of insecure ports and protocols and their modern alternatives.

Network
References & Portals
Free

Transport

Service type

Port reference

137 entries, sorted by port, ascending.

Sort by

Risky network ports and protocols with their risk level and secure alternative
Port(s)	Service	Risk	Secure alternative
7TCP/UDPSystem	EchoLegacy servicesTest service with no legitimate use; over UDP it is used for traffic reflection (loops with Chargen).	Vulnerable	Disable the service
9TCP/UDPSystem	DiscardLegacy servicesTest service with no production use. Wake-on-LAN often targets 9/UDP without needing a listening service.	Vulnerable	Disable the service
11TCP/UDPSystem	Systat (active users)Legacy servicesLists logged-in users: information leak useful for reconnaissance.	Vulnerable	Disable the service
13TCP/UDPSystem	DaytimeLegacy servicesReturns the time as text: no use today and can be abused for UDP reflection.	Vulnerable	Disable the service
17TCP/UDPSystem	Quote of the Day (QOTD)Legacy servicesTest service, a reflection and amplification vector over UDP.	Vulnerable	Disable the service
19TCP/UDPSystem	ChargenLegacy servicesGenerates a continuous character stream: a classic DDoS amplification vector over UDP.	Vulnerable	Disable the service
20, 21TCPSystem	FTPFiles and printingCredentials and files in cleartext (21: commands, 20: active mode data); check for anonymous access.	Unencrypted	SFTP (over SSH) or FTPSPorts 22 (SFTP), 21 or 990 (FTPS)
22TCPSystem	SSH version 1Remote access and administrationBroken SSH-1 protocol (insertion attack, CRC-32 weakness); removed from OpenSSH since version 7.6.	Vulnerable	SSH version 2 only, Ed25519 or ECDSA keysPorts 22
22TCPSystem	SSH version 2Remote access and administrationConstant brute-force target: key-based authentication, no root login, limited exposure (VPN, bastion host).	Acceptable	—
23TCPSystem	TelnetRemote access and administrationCredentials and sessions in cleartext; port heavily scanned by IoT botnets (Mirai).	Vulnerable	SSHPorts 22
25TCPSystem	SMTP (server-to-server relay)EmailSTARTTLS is opportunistic here: without MTA-STS or DANE an attacker can force cleartext. Ports 587 and 465 are for client submission, not relay.	Unencrypted	STARTTLS enforced through MTA-STS (RFC 8461) or DANE (RFC 7672)Ports 25
37TCP/UDPSystem	Time Protocol (RFC 868)Legacy servicesUnauthenticated, imprecise time: superseded by NTP.	Vulnerable	NTP, with NTS when possiblePorts 123/UDP, 4460/TCP (NTS-KE)
49TCPSystem	TACACS+ without TLSDirectory and authenticationThe packet body is only obfuscated with MD5 and a shared key (RFC 8907); legacy TACACS (49/UDP) is entirely cleartext.	Needs hardening	TACACS+ over TLS 1.3 (RFC 9887)Ports 300
53TCP/UDPSystem	DNSNetwork servicesQueries can be read and spoofed; an open resolver is used for DDoS amplification.	Unencrypted	DNS over TLS (DoT) or HTTPS (DoH) for clients, DNSSEC for integrityPorts 853 (DoT), 443 (DoH)
67, 68UDPSystem	DHCPv4Network servicesNo authentication: rogue server, pool exhaustion, information leak. DHCPv6 (546, 547) is no better protected in practice.	Needs hardening	DHCP snooping on switches, segmentation, rogue DHCP server detection
69UDPSystem	TFTPFiles and printingNeither authentication nor encryption: configuration files (IP phones, network devices) readable by anyone.	Vulnerable	HTTPS (iPXE, provisioning) or SFTPPorts 443, 22
70TCPSystem	GopherLegacy services1990s protocol without encryption: its presence points to a forgotten service.	Vulnerable	Disable the service
79TCPSystem	FingerLegacy servicesReveals accounts and their login habits: user enumeration.	Vulnerable	Disable the service
80TCPSystem	HTTPWeb and APIsAcceptable only to redirect to HTTPS and for ACME HTTP-01 challenges.	Unencrypted	HTTPS (TLS 1.2 or 1.3) with redirect and HSTSPorts 443
81, 3000, 3001, 8000, 8008, 8080, 8081, 8880, 8888TCPSystem, Registered	HTTP on alternative portsWeb and APIsProxies, admin consoles and development servers (Node.js, Grafana on 3000) often exposed by mistake.	Unencrypted	HTTPS behind a reverse proxy, consoles kept privatePorts 443
88TCP/UDPSystem	Kerberos with DES or RC4Directory and authenticationRC4 makes Kerberoasting and AS-REP roasting easier: watch for tickets encrypted with 0x17 (event 4769).	Needs hardening	AES only (RC4 and DES disabled), FAST armoring, long passwords for service accountsPorts 88
102TCPSystem	Siemens S7comm (ISO-TSAP, RFC 1006)Industrial (ICS/OT) and IoTS7-300 and S7-400 PLCs (Stuxnet targets) accept read, write and stop commands without strong authentication: never expose them.	Vulnerable	Zones and conduits (IEC 62443), TLS-secured PG/PC communication on recent S7-1500Ports 102 (TLS)
109TCPSystem	POP2EmailAbandoned predecessor of POP3; cleartext credentials.	Vulnerable	IMAPS or POP3SPorts 993, 995
110TCPSystem	POP3EmailCredentials and messages in cleartext; STARTTLS (STLS) that is not enforced can be stripped by an attacker.	Unencrypted	POP3S (implicit TLS)Ports 995
111TCP/UDPSystem	Portmapper (rpcbind, ONC RPC)Network servicesLists the host RPC services and is used for DDoS amplification over UDP.	Unencrypted	Filter and restrict to NFS clients; NFSv4 does not need itPorts 2049 (NFSv4)
113TCPSystem	IdentLegacy servicesReveals the account that owns each connection; still requested by some IRC servers.	Vulnerable	Disable the service
119TCPSystem	NNTP (Usenet)Messaging, chat and VoIPCredentials and articles in cleartext.	Unencrypted	NNTPSPorts 563
123UDPSystem	NTP without NTSNetwork servicesTime can be spoofed without authentication; the monlist command fueled massive amplification attacks.CVE-2013-5211	Unencrypted	NTS (RFC 8915), monitoring queries (monlist) disabledPorts 123/UDP, 4460/TCP (NTS-KE)
135TCP/UDPSystem	MS-RPC (Endpoint Mapper, DCOM)Remote access and administrationPoints to RPC services in the 49152-65535 dynamic range; encryption depends on each interface authentication level. Never expose it to the Internet (Blaster worm).CVE-2003-0352	Needs hardening	Block from outside, restrict the dynamic range, require RPC integrity and privacy
137-138/UDP, 139/TCPTCP/UDPSystem	NetBIOS (name, datagram, session)Network servicesNBT-NS poisoning (Responder) captures NTLM hashes; leaks host and domain names.	Vulnerable	NetBIOS over TCP/IP disabled; SMB 3 directly over 445Ports 445
143TCPSystem	IMAPEmailCredentials and messages in cleartext unless STARTTLS is enforced; RFC 8314 prefers implicit TLS.	Unencrypted	IMAPS (implicit TLS)Ports 993
161, 162UDPSystem	SNMP v1 and v2cNetwork servicesCleartext community strings (often "public" or "private"): read access, even configuration changes; DDoS amplification.	Vulnerable	SNMPv3 in authPriv mode (SHA-2, AES)Ports 161, 162
177UDPSystem	XDMCPRemote access and administrationCleartext X11 graphical sessions without strong authentication.	Vulnerable	X11 forwarding over SSH or an encrypted remote desktopPorts 22
323TCPSystem	RPKI-RTR (RPKI to router) over plain TCPNetwork servicesBGP origin validation data can be altered in transit: keep it on the management network.	Unencrypted	RPKI-RTR over SSH or TLS (RFC 6810)Ports 22 (SSH), 324 (TLS)
389TCPSystem	LDAPDirectory and authenticationSimple binds send the password in cleartext; without signing, NTLM relay to LDAP is possible.	Unencrypted	LDAPS or StartTLS; LDAP signing and channel binding (Active Directory)Ports 636, 389 + StartTLS
389UDPSystem	CLDAP (connectionless LDAP)Directory and authenticationLarge answer to a small query: a common DDoS amplification vector when a domain controller is exposed.	Vulnerable	389/UDP blocked at the edge, kept for domain clients
411, 412TCP/UDPSystem	Direct Connect (peer-to-peer sharing)Files and printingCleartext peer-to-peer sharing, rarely legitimate in a company.	Unencrypted	Block; corporate file sharing over HTTPS or SFTPPorts 443, 22
427TCP/UDPSystem	SLP (Service Location Protocol)Network servicesExploited by the ESXiArgs ransomware and for massive DDoS amplification (CVE-2023-29552).CVE-2021-21974	Vulnerable	Disable SLP (slpd service on VMware ESXi) and filter 427
443TCPSystem	HTTPS with SSL 3.0, TLS 1.0 or 1.1Web and APIsSSL 3.0 (POODLE), TLS 1.0 and TLS 1.1 are deprecated (RFC 8996).	Needs hardening	TLS 1.2 or 1.3, modern cipher suites, HSTSPorts 443
445TCPSystem	SMBv1 (CIFS)Files and printingExploited by EternalBlue (WannaCry, NotPetya): disable SMBv1 on every workstation and server.CVE-2017-0144	Vulnerable	SMB 3.1.1 with signing and encryptionPorts 445
445TCPSystem	SMB 2 and 3Files and printingNever expose it to the Internet; without signing, NTLM relay can replay an authentication.	Needs hardening	Required SMB signing, SMB 3 encryption, SMB over QUIC for remote accessPorts 445, 443/UDP (SMB over QUIC)
465TCPSystem	SMTPS (submission over implicit TLS)EmailRFC 8314 recommends implicit TLS for submission: 465 is preferable to 587 with STARTTLS.	Acceptable	—
500, 4500UDPSystem, Registered	IKEv1 (aggressive mode, pre-shared key)Network servicesIn aggressive mode, the pre-shared key hash is obtained without authentication (ike-scan) and cracked offline.CVE-2002-1623	Vulnerable	IKEv2 with PFS, AES-GCM and certificate authenticationPorts 500, 4500
502TCPSystem	Modbus/TCPIndustrial (ICS/OT) and IoTNo authentication: any client on the network can read and write registers and coils.	Unencrypted	Modbus/TCP Security (TLS), segmentation and industrial firewallPorts 802 (Modbus/TCP Security)
512, 513, 514TCPSystem	rexec, rlogin, rshRemote access and administrationTrust based on the source address (.rhosts) and cleartext passwords. Port 514/UDP belongs to syslog.	Vulnerable	SSHPorts 22
514UDPSystem	SyslogNetwork servicesLogs can be read and tampered with in transit; 514/TCP is often used by convention, but IANA assigns it to rsh.	Unencrypted	Syslog over TLS (RFC 5425)Ports 6514
515TCPSystem	LPD / LPR (printing)Files and printingCleartext print jobs, without authentication.	Unencrypted	IPP over TLS (IPPS)Ports 631
520UDPSystem	RIP (v1, or v2 without authentication)Network servicesRoute injection is possible without authentication. OSPF uses IP protocol 89 (not a port) and IS-IS does not run over IP.	Vulnerable	RIPv2 with HMAC-SHA authentication (RFC 4822), or authenticated OSPF and IS-ISPorts 520
548TCPSystem	AFP (Apple Filing Protocol)Files and printingApple favors SMB and has deprecated AFP; unencrypted traffic.	Unencrypted	Encrypted SMB 3Ports 445
554TCPSystem	RTSP (video streams)Messaging, chat and VoIPIP cameras are often exposed: streams and credentials (Basic authentication) in cleartext.	Unencrypted	RTSPS (RTSP over TLS) and SRTPPorts 322
563TCPSystem	NNTPSMessaging, chat and VoIPCheck TLS 1.2 or 1.3 and certificate validity.	Acceptable	—
587TCPSystem	SMTP submission with STARTTLSEmailIf STARTTLS is not mandatory, a downgrade attack (STRIPTLS) exposes credentials.	Needs hardening	STARTTLS enforced before authentication, or implicit TLS on 465 (RFC 8314)Ports 587, 465
623UDPSystem	IPMI (RMCP, RMCP+)Remote access and administrationIPMI 2.0 discloses the password hash before authentication (RAKP); "cipher 0" bypasses authentication.CVE-2013-4786	Vulnerable	Redfish over HTTPS, BMC on an isolated management networkPorts 443
631TCP/UDPSystem	IPP (printing) without TLSFiles and printingcups-browsed (631/UDP) enabled remote code execution in 2024: disable it if unused.CVE-2024-47176	Unencrypted	IPPS (IPP over TLS)Ports 631 (TLS)
636, 3269TCPSystem, Registered	LDAPS and Global Catalog over TLSDirectory and authenticationCheck the presented certificate and disable TLS 1.0 and 1.1.	Acceptable	—
860, 3260TCPSystem, Registered	iSCSIFiles and printingCleartext disk blocks; CHAP relies on MD5 and encrypts nothing.	Unencrypted	Mutual CHAP and IPsec, isolated storage networkPorts 3260 (IPsec)
873TCPSystem	rsync (daemon)Files and printingAnonymous modules often expose entire backups.	Unencrypted	rsync over SSHPorts 22
902, 903TCPSystem	VMware ESXi (authd, remote console)Remote access and administrationAccess to virtual machine consoles: keep it on the management network.	Needs hardening	TLS 1.2 or later, access limited to the management networkPorts 902, 903
989, 990TCPSystem	FTPS (implicit TLS)Files and printingCheck TLS 1.2 or 1.3; explicit FTPS uses port 21 with AUTH TLS.	Acceptable	—
992TCPSystem	Telnet over TLS (telnets)Remote access and administrationRare: encrypted, but keeps the Telnet authentication model.	Needs hardening	SSHPorts 22
993TCPSystem	IMAPSEmailImplicit TLS recommended by RFC 8314; check TLS 1.2 or 1.3.	Acceptable	—
994TCPSystem	IRCS (historical port)Messaging, chat and VoIPRarely used historical port; IRC servers over TLS listen on 6697.	Needs hardening	IRC over TLS (RFC 7194)Ports 6697
995TCPSystem	POP3SEmailImplicit TLS recommended by RFC 8314; check TLS 1.2 or 1.3.	Acceptable	—
1080TCPRegistered	SOCKSNetwork servicesAn open SOCKS proxy relays attacker traffic and bypasses filtering.	Unencrypted	SSH tunnel or authenticated HTTPS proxyPorts 22, 443
1099TCPRegistered	Java RMI (registry)Containers, cloud and monitoringDeserialization of untrusted Java objects often leads to code execution (ysoserial).	Vulnerable	Local binding, filtering, JMX over TLS with authentication
1433TCPRegistered	Microsoft SQL ServerDatabases and cachesBrute-force target on the sa account; xp_cmdshell turns access into command execution.	Unencrypted	Enforced encryption (TDS 8.0, Encrypt=Strict), Windows authenticationPorts 1433 (TLS)
1434UDPRegistered	SQL Server BrowserDatabases and cachesReveals instances, versions and ports; UDP reflection possible.	Needs hardening	Disable when ports are static, block from outside
1494, 2598TCP/UDPRegistered	Citrix ICA and CGP without TLSRemote access and administrationRemote desktop sessions: publish them only behind Citrix Gateway.	Unencrypted	Citrix Gateway (HDX over TLS)Ports 443
1521, 2483TCPRegistered	Oracle Database (TNS listener)Databases and cachesExposed listener: SID enumeration and TNS poisoning on unpatched versions.CVE-2012-1675	Unencrypted	Oracle native network encryption (NNE) or TCPSPorts 2484 (TCPS)
1701UDPRegistered	L2TP without IPsecNetwork servicesL2TP provides no encryption: it must be wrapped in IPsec.	Unencrypted	L2TP over IPsec, or native IKEv2 and WireGuardPorts 500, 4500, 51820
1723TCPRegistered	PPTPNetwork servicesMS-CHAPv2 can be cracked offline; the tunnel also uses GRE (IP protocol 47).	Vulnerable	IKEv2/IPsec, WireGuard or OpenVPNPorts 500, 4500, 51820, 1194
1812, 1813UDPRegistered	RADIUS (authentication, accounting)Directory and authenticationMD5-based protection; the BlastRADIUS attack forges responses. Legacy ports: 1645 and 1646.CVE-2024-3596	Unencrypted	RadSec (RADIUS over TLS, RFC 6614), Message-Authenticator attribute requiredPorts 2083
1883TCPRegistered	MQTTIndustrial (ICS/OT) and IoTBrokers often open without authentication: readings and commands can be read and modified.	Unencrypted	MQTT over TLS with authenticationPorts 8883
1900UDPRegistered	SSDP / UPnPNetwork servicesDDoS amplification vector; exposed UPnP can open port forwards (CallStranger).CVE-2020-12695	Vulnerable	UPnP disabled on exposed devices, 1900/UDP filtered
2049TCP/UDPRegistered	NFS v2 and v3Files and printingAUTH_SYS trusts the UID claimed by the client: a compromised host reads other users files.	Unencrypted	NFSv4 with Kerberos (sec=krb5p) or NFS over TLS (RFC 9289)Ports 2049
2375TCPRegistered	Docker API without TLSContainers, cloud and monitoringUnauthenticated API: access equals root on the host (cryptomining, container escape).	Vulnerable	Docker API over TLS with mutual authentication (mTLS)Ports 2376
2379, 2380TCPRegistered	etcd without TLSContainers, cloud and monitoringStores Kubernetes secrets: read access gives away the cluster keys.	Unencrypted	TLS and mutual authentication for clients and peersPorts 2379, 2380 (TLS)
2404TCPRegistered	IEC 60870-5-104Industrial (ICS/OT) and IoTRemote control of electrical substations without authentication, used by the Industroyer malware.	Unencrypted	IEC 62351-3 (TLS), segmentationPorts 19998 (secure IEC-104)
3128TCPRegistered	HTTP proxy (Squid)Network servicesAn open proxy relays malicious traffic and filtering bypasses.	Unencrypted	Strong authentication and client filtering, HTTPS proxyPorts 443
3268TCPRegistered	Active Directory Global Catalog (LDAP)Directory and authenticationSame risks as cleartext LDAP, across the whole forest.	Unencrypted	Global Catalog over TLSPorts 3269
3306TCPRegistered	MySQL / MariaDBDatabases and cachesBrute-force target: never expose it to the Internet.	Unencrypted	Enforced TLS (require_secure_transport), least-privilege accountsPorts 3306 (TLS)
3389TCP/UDPRegistered	RDP exposed or without NLARemote access and administrationTop ransomware entry point (brute force, stolen credentials); BlueKeep targeted RDP without NLA.CVE-2019-0708	Vulnerable	Mandatory NLA, access through Remote Desktop Gateway (HTTPS) or VPN, MFAPorts 443 (RD Gateway)
3478TCP/UDPRegistered	STUN / TURNMessaging, chat and VoIPAn open TURN relay can be used as a pivot into the internal network.	Unencrypted	TURN over TLS (turns) with short-lived credentialsPorts 5349
3632TCPRegistered	distccContainers, cloud and monitoringRemote command execution on unrestricted daemons.CVE-2004-2687	Vulnerable	Access limited to build hosts (--allow) or SSH tunnel
3702UDPRegistered	WS-DiscoveryNetwork servicesExposed printers and cameras: DDoS amplification vector.	Vulnerable	Local network use only, 3702/UDP filtered at the edge
3799UDPRegistered	RADIUS Dynamic Authorization (CoA, disconnect)Directory and authenticationCan change or terminate a session (RFC 5176): accept only authorized servers.	Unencrypted	RadSec (RADIUS over TLS) or IPsecPorts 2083
4443, 8443, 9043, 9443TCPRegistered	HTTPS on alternative portsWeb and APIsOften admin consoles: check TLS 1.2 or 1.3, the certificate and the exposure.	Acceptable	—
4786TCPRegistered	Cisco Smart InstallNetwork servicesNo authentication: configuration theft and replacement, code execution.CVE-2018-0171	Vulnerable	Disable it (no vstack)
4840TCPRegistered	OPC UA (None or Sign security mode)Industrial (ICS/OT) and IoTSecurity depends on the chosen policy: in "None" mode, data travels in cleartext.	Needs hardening	SignAndEncrypt mode, managed application certificatesPorts 4840, 4843 (TLS)
5000TCPRegistered	Web interfaces over HTTP (NAS, Flask, Docker registry)Web and APIsPort 5001 often carries the HTTPS version (Synology NAS).	Unencrypted	HTTPS with a valid certificatePorts 5001, 443
5060TCP/UDPRegistered	SIPMessaging, chat and VoIPMass scanning (SIPVicious) for toll fraud; readable signaling and credentials.	Unencrypted	SIP over TLS (SIPS) and SRTP mediaPorts 5061
5201TCP/UDPRegistered	iPerf3Containers, cloud and monitoringForgotten test server: can be used to saturate a link.	Unencrypted	Server started on demand, on a test network or over SSHPorts 22
5222, 5223, 5269TCPRegistered	XMPP (Jabber)Messaging, chat and VoIP5222: clients with STARTTLS; 5223: direct TLS; 5269: server to server. Optional STARTTLS allows a fallback to cleartext.	Needs hardening	TLS 1.2 or later enforced (mandatory STARTTLS or direct TLS)Ports 5222, 5223
5353UDPRegistered	mDNS (Bonjour, Avahi)Network servicesReveals device names and services; exposed to the Internet, it is used for amplification.	Unencrypted	Local network use only, 5353/UDP blocked at the edge
5355TCP/UDPRegistered	LLMNRNetwork servicesResponder poisoning: NTLMv2 hash capture on the local network.	Vulnerable	LLMNR and NBT-NS disabled (Group Policy), DNS onlyPorts 53
5432TCPRegistered	PostgreSQLDatabases and cachesThe pg_hba.conf file decides who connects: avoid the "trust" method and Internet exposure.	Unencrypted	Enforced TLS (hostssl) and scram-sha-256Ports 5432 (TLS)
5480TCPRegistered	VMware VAMI (appliance management)Remote access and administrationAdministration interface of vCenter and appliances: never expose it.	Needs hardening	TLS 1.2 or later, access limited to the management networkPorts 5480
5555TCPRegistered	Android Debug Bridge (ADB over TCP)Remote access and administrationUnauthenticated shell on TV boxes and IoT devices: mining botnets (ADB.Miner).	Vulnerable	Network debugging disabled; ADB over USB or local wireless pairing
5601TCPRegistered	KibanaContainers, cloud and monitoringOpen instance: access to logs and Elasticsearch indices.	Unencrypted	HTTPS and authentication (Elastic security enabled by default since version 8)Ports 5601 (TLS)
5672TCPRegistered	AMQP (RabbitMQ)Messaging, chat and VoIPMessages and credentials in cleartext; remove the guest account.	Unencrypted	AMQPS (AMQP over TLS)Ports 5671
5900-5903TCPRegistered	VNC (RFB)Remote access and administrationPort 5900 plus the display number; classic VNC authentication limits the password to 8 characters.	Unencrypted	VNC through an SSH or VPN tunnel, or VeNCrypt (TLS)Ports 22, 443
5938TCP/UDPRegistered	TeamViewerRemote access and administrationEncrypted, but heavily used by tech support scams and ransomware: watch for unexpected installations.	Needs hardening	Only the approved remote access tool, with MFA and loggingPorts 443
5984TCPRegistered	Apache CouchDBDatabases and cachesBefore version 3, an install without an admin was open to everyone; privilege escalation then code execution.CVE-2017-12635	Unencrypted	HTTPS, dedicated admin account, restricted accessPorts 6984
5985TCPRegistered	WinRM over HTTPRemote access and administrationWith Kerberos or NTLM the payload is encrypted at message level, but Basic authentication travels in cleartext; a lateral movement port (PowerShell Remoting).	Needs hardening	WinRM over HTTPSPorts 5986
6000-6063TCPRegistered	X11Remote access and administrationAn open X server allows screen capture and keylogging.	Unencrypted	X11 forwarding over SSHPorts 22
6379TCPRegistered	RedisDatabases and cachesNo authentication by default: exposed instances are abused to write SSH keys or cron jobs.	Unencrypted	TLS (tls-port), password or ACL, local bindingPorts 6380 (common use)
6443TCPRegistered	Kubernetes API (kube-apiserver)Containers, cloud and monitoringTLS and authentication by default: disable anonymous access, enforce RBAC and keep it off the Internet.	Acceptable	—
6514TCPRegistered	Syslog over TLSNetwork servicesCheck that senders authenticate with certificates.	Acceptable	—
6665-6669TCPRegistered	IRCMessaging, chat and VoIPCleartext messages; historical ports of botnet command channels.	Unencrypted	IRC over TLS (RFC 7194)Ports 6697
7001, 7002TCPRegistered	Oracle WebLogic (HTTP, T3)Web and APIsExposed console and T3 protocol: many remote code execution flaws.CVE-2020-14882	Unencrypted	HTTPS on 7002, T3 protocol filtered, up-to-date patchesPorts 7002
7070TCPRegistered	AnyDeskRemote access and administrationEncrypted, but abused for persistence and exfiltration: allow approved tools only.	Needs hardening	Only the approved remote access tool, with MFA and loggingPorts 443
7199, 9042, 9160TCPRegistered	Apache Cassandra (JMX, CQL, Thrift)Databases and caches7199: JMX; 9042: CQL; 9160: Thrift (removed in Cassandra 4.0).	Unencrypted	Client and inter-node encryption, authentication, local JMXPorts same ports (TLS)
8009TCPRegistered	AJP (Apache JServ Protocol, Tomcat)Web and APIsGhostcat: reading application files, even code execution.CVE-2020-1938	Vulnerable	AJP connector disabled, or bound to localhost with a secret (secretRequired)
8088, 9864, 9870, 50070, 50075TCPRegistered, Dynamic	Hadoop web interfaces (YARN, HDFS)Containers, cloud and monitoringHadoop 3: 9870 and 9864; Hadoop 2: 50070 and 50075. An open YARN API (8088) lets anyone launch arbitrary jobs.	Unencrypted	HTTPS, Kerberos (SPNEGO), restricted accessPorts 8090, 9865, 9871, 50470, 50475
8125UDPRegistered	StatsDContainers, cloud and monitoringMetrics can be injected without authentication.	Unencrypted	Local binding or encrypted tunnel (VPN)
8545, 8546TCPRegistered	Ethereum JSON-RPC (HTTP, WebSocket)Containers, cloud and monitoringExposed nodes with an unlocked account: automated theft of funds.	Unencrypted	Local binding, authenticated HTTPS or WSS behind a proxyPorts 443
8554TCPRegistered	RTSP on an alternative portMessaging, chat and VoIPAlternative port registered with IANA (rtsp-alt), used by many streaming servers.	Unencrypted	RTSPS (RTSP over TLS)Ports 322
8883TCPRegistered	MQTT over TLSIndustrial (ICS/OT) and IoTCheck client authentication (certificate or credentials).	Acceptable	—
9000, 9001TCPRegistered	Application services over HTTP (SonarQube, Portainer, MinIO, PHP-FPM)Containers, cloud and monitoringExposed PHP-FPM (FastCGI on 9000) allows arbitrary PHP code execution.	Unencrypted	HTTPS behind a reverse proxy, local PHP-FPMPorts 443
9090TCPRegistered	PrometheusContainers, cloud and monitoringMetrics and targets visible without authentication: infrastructure mapping.	Unencrypted	TLS and authentication (web.config.file) or reverse proxyPorts 9090 (TLS)
9092TCPRegistered	Apache Kafka (PLAINTEXT listener)Messaging, chat and VoIPMessages and SASL/PLAIN credentials in cleartext.	Unencrypted	SASL_SSL or SSL listenerPorts 9093 (common use)
9100TCPRegistered	Direct printing (JetDirect, RAW, PJL)Files and printingPrint jobs and PJL commands accepted without authentication. Note: 9100 is also the node_exporter (Prometheus) port.	Unencrypted	IPPS and printer filteringPorts 631
9200, 9300TCPRegistered	Elasticsearch (REST, transport)Databases and cachesOpen clusters behind many data leaks.	Unencrypted	Elastic security: TLS and authentication (default since version 8)Ports same ports (TLS)
9418TCPRegistered	git:// protocol (git daemon)Containers, cloud and monitoringNeither encryption nor authentication: content can be altered in transit.	Unencrypted	Git over SSH or HTTPSPorts 22, 443
9600TCPRegistered	Logstash monitoring APIContainers, cloud and monitoringExposes pipeline configuration and node status.	Unencrypted	Local binding (default) or HTTPS with authenticationPorts 9600 (TLS)
10000-20000, 16384-32767UDPRegistered	RTP (VoIP media)Messaging, chat and VoIPNo fixed port: ranges negotiated through SDP (10000-20000 for Asterisk, 16384-32767 for Cisco). Calls can be eavesdropped in cleartext.	Unencrypted	SRTP, with SIP signaling over TLSPorts same ranges (SRTP)
10250, 10255TCPRegistered	kubelet APIContainers, cloud and monitoring10250 runs commands in pods when anonymous access is allowed; 10255 (read-only, HTTP, unauthenticated) must stay closed.	Needs hardening	Anonymous access disabled, Webhook authorization, port 10255 closedPorts 10250
11211TCP/UDPRegistered	MemcachedDatabases and cachesOver UDP, record amplification during the 2018 attacks; UDP disabled by default since version 1.5.6.CVE-2018-1000115	Unencrypted	Local binding, UDP disabled, SASLPorts 11211
15672TCPRegistered	RabbitMQ management consoleMessaging, chat and VoIPThe guest account only works locally since version 3.3: review the other accounts.	Unencrypted	HTTPSPorts 15671
20000TCP/UDPRegistered	DNP3Industrial (ICS/OT) and IoTRemote control protocol (water, energy) without native authentication.	Unencrypted	DNP3 Secure Authentication (IEEE 1815) or TLS (IEC 62351-3)Ports 19999 (secure DNP3)
21115-21119TCP/UDPRegistered	RustDesk (self-hosted server)Remote access and administration21115 to 21117: ID and relay (21116 also over UDP); 21118 and 21119: web clients. Abused in tech support scams.	Needs hardening	Approved tool only, with a server and keys under your control
27017-27019TCPRegistered	MongoDBDatabases and cachesBefore version 3.6, listened on all interfaces without authentication: waves of ransom attacks on exposed databases.	Unencrypted	Enforced TLS, SCRAM authentication, restricted bindIpPorts same ports (TLS)
28017TCPRegistered	MongoDB HTTP interfaceDatabases and cachesHistorical status interface, without authentication.	Vulnerable	Disable it (removed since MongoDB 3.6)
30000-32767TCP/UDPRegistered	Kubernetes NodePort servicesContainers, cloud and monitoringDefault range: each NodePort service is open on every node, often over HTTP without authentication.	Needs hardening	Ingress or LoadBalancer with TLS, NetworkPolicy, node filteringPorts 443 (Ingress)
44818TCP/UDPRegistered	EtherNet/IP (CIP)Industrial (ICS/OT) and IoTExplicit messaging on 44818, I/O exchanges on 2222/UDP; PLC commands without authentication.	Unencrypted	CIP Security (TLS, DTLS), segmentationPorts 2221 (EtherNet/IP over TLS)
47808UDPRegistered	BACnet/IPIndustrial (ICS/OT) and IoTBuilding management (heating, ventilation, access control) that can be driven without authentication.	Unencrypted	BACnet Secure Connect (BACnet/SC, TLS over WebSocket)Ports WSS (configurable port)
61613, 61616TCPDynamic	Apache ActiveMQ (STOMP, OpenWire)Messaging, chat and VoIPOpenWire (61616): remote code execution exploited by ransomware.CVE-2023-46604	Unencrypted	TLS connectors (ssl://) with authentication, patched versionsPorts 61617 (OpenWire TLS, common use)

Reading the reference

Risk levels, IANA ranges and sources.

Risk levels

Obsolete or vulnerable: Disable, replace or block first.
Unencrypted: Data, and often credentials, readable on the network.
Hardening required: Safe only once properly configured or restricted.
Acceptable: Encrypted: check the TLS version, the certificate and the exposure.

IANA ranges (RFC 6335)

System0-1023: Standard services assigned by IANA; privileged ports on Unix.
Registered1024-49151: Ports registered with IANA (User Ports) by vendors and projects.
Dynamic49152-65535: Never assigned: ephemeral ports of outgoing connections, also used by MS-RPC.

A port number does not prove the service: check the banner or fingerprint (nmap -sV) before drawing conclusions.

Sources: IANA service name and port number registry, RFCs and vendor advisories cited in the notes. IANA registry Data reviewed in October 2026.

About

Ports & Protocols Reference

Reference of 130+ risky network ports and protocols (cleartext, obsolete, vulnerable or in need of hardening), from legacy services to industrial protocols (Modbus, S7, DNP3, BACnet). Each entry shows the TCP or UDP transport, the IANA range, a risk note, the secure alternative and its ports, with a link to the flagship CVE when there is one. Handy for interpreting an Nmap scan, preparing a hardening plan or justifying a port closure during an audit.

What it does

130+ entries: ports, TCP or UDP transport, IANA range, risk level, note, secure alternative and its ports
Search by port, range or list (1-1024, 22,80,443, 53/udp, Nmap T: and U: format) or free text
Filters by risk level, transport and service type (including ICS/OT), with counters
Shareable link to the current view (search, filters, sort) and links to the CVE database
Port list copy for Nmap (-p), CSV and JSON export, saved favorites

Frequently asked questions

Which ports are covered?

The reference focuses on protocols that are a security concern: cleartext services (Telnet, FTP, HTTP, POP3, SNMPv1/v2c…), obsolete or vulnerable protocols (SMBv1, LLMNR, Cisco Smart Install…), industrial protocols (Modbus, S7, DNP3, IEC 104, BACnet), services often exposed by mistake (Docker API, kubelet, Redis, Elasticsearch) and services acceptable only with proper encryption. It is not an exhaustive copy of the IANA registry.

How do I use this reference with Nmap?

Paste the open ports found by your scan into the search, as a list (22,80,443) or in Nmap format (T:22,U:161): each entry shows the risk level and the secure alternative. Conversely, filter by risk or service type, then Export, Copy for nmap gives you the -p argument to run again. A port number does not prove the service: confirm it with nmap -sV.

What do the risk levels mean?

Obsolete or vulnerable: disable, replace or block first. Unencrypted: data, and often credentials, readable on the network. Hardening required: safe only once properly configured or restricted. Acceptable: encrypted, provided you check the TLS version, the certificate and the exposure.

What are IANA port ranges?

RFC 6335 distinguishes system ports (0 to 1023, standard services), registered ports (1024 to 49151) and dynamic or private ports (49152 to 65535), never assigned and used as ephemeral ports. Searching for a port that is not in the reference shows its range.