Common ports list: what runs on each TCP and UDP port
This page is a common ports list and port lookup, not a live port scanner. Type a port number (22, :3306 or 443/udp all work) or a service name (ssh, redis, database) and it shows what normally runs there, whether the port uses TCP, UDP or both, and whether it should face the internet. It covers 92 common services, from FTP on port 20 to WireGuard on 51820, and any number from 0 to 65535 is placed in the well-known, registered or dynamic range.
A web page cannot open raw TCP or UDP connections, and scanning other people's servers from ours would be abuse. To check a host you own, the page writes a ready-to-run nmap, netcat or PowerShell command that you run on your own computer. It runs in your browser; nothing is uploaded (you can check the Network tab in DevTools), so the host names and ports you type stay on your device.
After a lookup, pair it with the other network checks: the DNS lookup tool shows where a domain points, the SSL certificate checker shows when a domain's certificate expires and whether HTTPS answers on port 443, and the HTTP header viewer shows how a web server responds.
Table of Use: what to type and what you get
| You have | Type or set | You get |
|---|---|---|
| A port number in a firewall log | 3306, :3306 or 3306/tcp | MySQL / MariaDB, TCP, marked Keep internal, plus a one-line explanation |
| A service you want the port for | redis, ssh or postgres | Every listed service whose name or description matches |
| A kind of service | database, vpn or mail | Every entry that mentions the word, such as MySQL and PostgreSQL for database |
| A number that is not in the list | 54321 | Its range (dynamic, 49152–65535) and the lsof or netstat command to find the program using it |
| Only the ports that are fine to publish | Exposure: Safe to expose | The nine low-risk entries, including 80, 443, 587, 993 and 51820 |
| A quick check of your own server | Host 192.168.1.10, ports 22, 80, 443 | nmap -Pn -p 22,80,443 192.168.1.10, plus netcat and PowerShell versions |
| A block of ports | Ports 22, 8000-8100 | nmap -Pn -p 22,8000-8100 and one netcat line per range; PowerShell is left out for long ranges |
Features
- 92 common services with the port, the protocol (TCP, UDP or TCP/UDP) and a plain-English description. Assignments follow the IANA port number registry and each program's documented defaults.
- An exposure label on every entry: Safe to expose (9 entries), Expose with care (26) or Keep internal (57). It is guidance on whether a port belongs on the public internet, not a vulnerability scan.
- Search by number or by word. A number matches ports that start with it, so 80 also lists 8000 and 8080. Text matches the service name, the description or the protocol. Forms like 22/tcp, tcp/22 and port 22 are understood.
- A range for any port from 0 to 65535, using the RFC 6335 ranges, with notes such as Linux needing root below 1024 and the ephemeral ranges Windows (49152–65535) and Linux (32768–60999) use.
- Command builder for a host you own. It accepts a host name or an IPv4 or IPv6 address and a port list with ranges, rejects bad input with a message, and merges repeated and overlapping ports.
- Three command styles with Copy buttons: nmap, netcat and PowerShell. The PowerShell loop is offered for up to 50 ports with no range longer than 20 ports.
- Nothing is scanned or sent. The builder only writes text for you to run.
To see who runs an IP address you found in a log, try the IP address lookup; for a domain name, use the WHOIS lookup.
How to look up a port and check your own host
- Type a number or a name in Search by port number or service, for example 3306, ssh or database.
- Read the port, service, TCP or UDP, exposure label and description. Use the Exposure menu to narrow the list.
- For a port that is not listed, read the range shown above the list and run the lsof or netstat command it suggests on your own machine.
- To test a server you own, go to Check ports on a host you own and enter the Host name or IP address and the Ports, for example 22, 80, 443.
- Click Copy beside the nmap, netcat or PowerShell command and paste it into a terminal on your own computer.
- Compare the result with what you meant to publish, and firewall anything else.
Any port you must leave open should have a strong login behind it, so generate one with the password generator. To compare two scan results from before and after a change, paste them into the text diff tool.
Who can use it
- System administrators who want to confirm that only the services they meant to publish are reachable, and that databases and admin panels stay behind a firewall or VPN.
- Developers who hit a port already in use on 3000, 5000, 5173 or 8000 and want to know what normally owns it.
- Home lab and game-server hosts opening ports for Plex, Home Assistant or Minecraft, who want to know the risk first.
- Help-desk and IT staff reading a firewall log or a netstat listing, then turning log times into readable dates with the timestamp converter.
- Students learning which service sits behind which number.
FAQs
Is this a real port scanner that can scan my server?
No. A web page cannot open raw TCP or UDP connections from your browser, and scanning other people's servers from our infrastructure would be network abuse. Type your host and ports into the command builder instead and run the nmap, netcat or PowerShell command it writes on your own computer. Nothing is sent anywhere by this page.
Is port scanning legal?
Scanning systems you own or administer is normal practice. Scanning other people's systems without permission can breach computer-misuse laws and often breaks your internet or hosting provider's terms of service. Only scan hosts you own or have written permission to test. Running a scan from your own machine against your own server is the safe way to see what is exposed.
What do open, closed and filtered mean in an nmap scan?
Open means a program is listening and accepted the connection. Closed means the host answered but nothing is listening on that port. Filtered means no answer came back, usually because a firewall silently dropped the probe, so nmap cannot tell whether a service is there. A filtered result is common on well-protected servers.
What are well-known, registered and dynamic ports?
Ports 0–1023 are well-known (system) ports assigned to standard services, such as SSH on 22 and HTTPS on 443. Ports 1024–49151 are registered (user) ports that vendors can register with IANA. Ports 49152–65535 are dynamic, or ephemeral, ports that are never assigned and are used for the client side of outgoing connections. These ranges come from RFC 6335.
Which ports should never be open to the internet?
Anything marked "Keep internal" in the list: databases (MySQL 3306, PostgreSQL 5432, MongoDB 27017, Redis 6379), Windows file sharing (SMB 445), remote desktop (RDP 3389, VNC 5900), container and cluster APIs (Docker 2375, Kubernetes 6443, Kubelet 10250) and development servers. Reach them over a VPN or an SSH tunnel instead.
What is the difference between a TCP port and a UDP port?
TCP and UDP each have their own set of 65,536 port numbers. TCP sets up a connection and guarantees ordered delivery, so web pages, SSH and email use it. UDP just sends packets with no connection, which suits DNS lookups, VPNs and video calls. Some services use both: DNS is on 53 for TCP and UDP, and HTTPS on 443 uses UDP for HTTP/3.
How do I find which program is using a port, such as 5000 on a Mac?
On macOS or Linux run "sudo lsof -i :5000" (or "ss -ltnp" on Linux). On Windows run "netstat -ano | findstr :5000" and look up the process ID in Task Manager. On macOS 12 and later, port 5000 is often taken by AirPlay Receiver, which you can turn off in your Mac settings, or you can move your development server to another port.
How do I check whether a port is open on my own server?
Enter the host and the ports in the command builder, then run the command on your own machine. "nmap -Pn -p 22,80,443 host" works on Linux, macOS and Windows. "nc -vz -w 3 host 22" tests one port on Linux or macOS. In PowerShell, Test-NetConnection reports True or False for a TCP port. Test from outside your network to see what the internet sees.