Common Port Numbers: Complete Reference for Developers

What Are Port Numbers?

A port number is a 16-bit unsigned integer (0–65535) that identifies a specific process or network service on a host. When a server has multiple services running - a web server, a database, an SSH daemon - ports allow the operating system to route incoming traffic to the correct process.

Together, an IP address and a port number form a socket - the endpoint of a network connection. The combination of local IP, local port, remote IP, and remote port uniquely identifies every active TCP connection on a system.

Port Number Ranges

• 0–1023: Well Known Ports (System Ports) - Assigned by IANA. Require root/admin privileges to bind on Unix-like systems. HTTP, HTTPS, SSH, FTP, DNS, etc.
• 1024–49151: Registered Ports - Assigned by IANA for specific applications. Used by databases, middleware, and application servers.
• 49152–65535: Dynamic/Ephemeral Ports - Assigned automatically by the OS as source ports for outgoing connections.

Web and HTTP Ports

Remote Access and File Transfer

Database Ports

Email Ports

Infrastructure and Network Services

Container and Orchestration Ports

Firewall Rules: What to Block and What to Expose

As a general security principle, your firewall should block everything by default and only allow what is explicitly needed. Here are the standard rules for a web server:

# UFW rules for a typical web server
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow web traffic
sudo ufw allow 80/tcp comment 'HTTP'
sudo ufw allow 443/tcp comment 'HTTPS'

# Allow SSH from specific IP only
sudo ufw allow from 10.0.0.0/8 to any port 22 comment 'SSH internal'

# Allow database from app servers only
sudo ufw allow from 10.10.0.0/16 to any port 5432 comment 'PostgreSQL app tier'

sudo ufw enable

Ports to Always Block from the Internet

• 3306 (MySQL), 5432 (PostgreSQL), 27017 (MongoDB), 6379 (Redis) - Database ports should never be internet-accessible. Use a bastion host or VPN for remote database access.
• 2375 (Docker unencrypted) - Gives full root access to the server. Accounts for thousands of container escapes and cryptominer infections annually.
• 23 (Telnet), 21 (FTP) - Transmit credentials in plaintext. Use SSH and SFTP instead.
• 161 UDP (SNMP) - SNMPv1/v2 communities act as passwords but are often "public" or "private". Block externally and use SNMPv3 with authentication.
• 9200 (Elasticsearch), 8500 (Consul), 4001 (etcd) - Infrastructure APIs with no authentication by default. Block all external access.

Checking Open Ports on Your Server

# List all listening ports and their processes
sudo ss -tlnp        # TCP listening (modern, preferred)
sudo netstat -tlnp   # TCP listening (legacy, still common)

# Check if a specific port is open
sudo ss -tlnp | grep ':3306'

# Scan open ports from outside (run from another machine)
nmap -sV -p 80,443,22,3306 your-server-ip

# Check if a remote port is reachable
nc -zv database.example.com 5432
# or
telnet database.example.com 5432

Run sudo nmap -sV your-server-ip from an external machine periodically to verify what is actually visible to the internet. Your firewall rules may allow less than you think - or more.

FAQ

What is the difference between TCP and UDP ports?

TCP (Transmission Control Protocol) is connection-oriented: it establishes a reliable, ordered connection before sending data and guarantees delivery. UDP (User Datagram Protocol) is connectionless: it sends packets without establishing a connection, without guaranteed delivery or ordering. TCP is used for applications where reliability matters (HTTP, SSH, databases). UDP is used where speed matters more than reliability (DNS, NTP, video streaming, gaming).

Why do I need root privileges to bind to port 80 or 443?

On Linux, ports below 1024 are "privileged" and require root to bind, as a security measure. This prevents unprivileged processes from impersonating system services. The modern solution is to run your web server on a high port (e.g., 3000 or 8080) and use a reverse proxy (Nginx) running as root to forward from 80/443. Alternatively, use setcap or authbind to grant specific port binding without full root access.

How do I change my SSH port to something other than 22?

Edit /etc/ssh/sshd_config and change or add Port 2222 (or any unused port above 1024). Restart sshd: sudo systemctl restart sshd. Update your firewall to allow the new port. This does not improve security meaningfully against targeted attacks but does reduce noise from automated port-22 scanners. Always ensure the new port works in a test session before closing your existing connection.

What ports does Docker expose by default?

Docker containers do not expose any ports by default. You explicitly map ports using -p host_port:container_port when running a container. The Docker daemon itself listens on a Unix socket (/var/run/docker.sock) by default, not a TCP port. TCP port 2375/2376 must be explicitly enabled - only do so if you need remote API access, and always use TLS (2376) with mutual certificate authentication.

How do I find what process is using a specific port?

# Find the process using port 3000
sudo lsof -i :3000
# or
sudo ss -tlnp | grep ':3000'
# or (Linux)
sudo fuser 3000/tcp

These commands show the PID and process name. On macOS, lsof -i :3000 works without sudo for your own processes.

Use our free tool here → Port Lookup - instantly search any port number or service name for the official IANA assignment, protocol type, and usage notes.