Common port numbers
Search well-known TCP and UDP ports by number, service or purpose: Windows, AD, email, VPN, databases and VMware.
92 ports
File transfer
- 20TCPFTP dataFile transfer data channel (active mode)
- 21TCPFTPFile transfer control channel
- 69UDPTFTPTrivial file transfer, PXE boot and network device firmware
- 989TCPFTPS dataFTP over TLS, data channel
- 990TCPFTPS controlFTP over TLS, control channel
Remote access
- 22TCPSSH, SFTP, SCPSecure shell, secure file copy, Linux and network device management
- 23TCPTelnetUnencrypted remote terminal. Replace with SSH
- 3389TCP/UDPRDPRemote Desktop. Never expose to the internet; use a VPN, RD Gateway or Azure Bastion
- 5900TCPVNCRemote desktop for Linux and appliances
- 5985TCPWinRM (HTTP)PowerShell remoting and Windows Admin Center
- 5986TCPWinRM (HTTPS)PowerShell remoting over TLS
- 25TCPSMTPMail transfer between mail servers, and Exchange Online inbound mail
- 110TCPPOP3Mail download, unencrypted
- 143TCPIMAPMail access, unencrypted
- 465TCPSMTPSMail submission with implicit TLS
- 587TCPSMTP submissionMail submission with STARTTLS, for example devices and apps sending through Microsoft 365
- 993TCPIMAPSIMAP over TLS
- 995TCPPOP3SPOP3 over TLS
Network services
- 53TCP/UDPDNSName resolution. UDP for most queries, TCP for zone transfers and large replies
- 67UDPDHCP serverDHCP and BOOTP server, receives client requests
- 68UDPDHCP clientDHCP and BOOTP client, receives server offers
- 123UDPNTPTime synchronisation. Kerberos fails when clocks drift more than five minutes
- 546UDPDHCPv6 clientIPv6 address assignment, client side
- 547UDPDHCPv6 serverIPv6 address assignment, server side
- 853TCPDNS over TLSEncrypted DNS queries
- 5353UDPmDNSMulticast DNS on the local network
- 5355UDPLLMNRLocal name resolution. Often disabled for security
Web
- 80TCPHTTPWeb traffic, redirects to HTTPS, certificate revocation (CRL) checks
- 443TCPHTTPSSecure web, Microsoft 365, Azure portal and APIs, SSTP VPN, Azure Arc, Entra Connect, vCenter
- 443UDPHTTP/3 (QUIC)Newer browsers and services use QUIC over UDP 443
- 8080TCPHTTP alternateWeb proxies, application servers and admin consoles
- 8443TCPHTTPS alternateAdmin consoles and application servers
Windows and Active Directory
- 88TCP/UDPKerberosActive Directory authentication
- 135TCPRPC endpoint mapperWindows RPC, WMI, DCOM, AD replication and Exchange. Works with the dynamic RPC range
- 137UDPNetBIOS name serviceLegacy Windows name resolution
- 138UDPNetBIOS datagramLegacy Windows browsing
- 139TCPNetBIOS sessionLegacy SMB over NetBIOS
- 389TCP/UDPLDAPDirectory queries to domain controllers. UDP is used for domain controller location
- 445TCPSMBWindows file sharing, Group Policy (SYSVOL), Azure Files. Do not expose to the internet
- 464TCP/UDPKerberos password changePassword changes through domain controllers
- 593TCPRPC over HTTPRPC over HTTP endpoint mapper
- 636TCPLDAPSLDAP over TLS to domain controllers
- 1688TCPKMSWindows and Office volume activation
- 3268TCPGlobal CatalogForest-wide directory searches
- 3269TCPGlobal Catalog over TLSGlobal Catalog searches over TLS
- 3343UDPFailover ClusteringWindows cluster heartbeat and communication (also TCP 3343)
- 8530TCPWSUS (HTTP)Windows Server Update Services
- 8531TCPWSUS (HTTPS)Windows Server Update Services over TLS
- 9389TCPAD Web ServicesActive Directory PowerShell module and Administrative Center
- 10123TCPConfiguration Manager notificationConfigMgr client notification
- 49152-65535TCPRPC dynamic portsWindows dynamic RPC range for AD replication, DFS-R, WMI and more
Monitoring and management
- 161UDPSNMPMonitoring queries to network devices and servers
- 162UDPSNMP trapAlerts sent from devices to the monitoring system
- 514UDPSyslogLog forwarding from network devices and Linux servers
- 623UDPIPMIOut-of-band server management (BMC). Keep on a management network only
- 6514TCPSyslog over TLSEncrypted log forwarding
VPN and security
- 500UDPIKE (IPsec)Key exchange for site-to-site VPNs, including Azure VPN Gateway
- 1194UDPOpenVPNOpenVPN tunnels (TCP 1194 is also possible)
- 1701UDPL2TPL2TP VPN, used with IPsec
- 1723TCPPPTPLegacy PPTP VPN. Not secure, replace it
- 1812UDPRADIUS authenticationVPN, Wi-Fi and RD Gateway sign-in through NPS
- 1813UDPRADIUS accountingRADIUS session accounting
- 4500UDPIPsec NAT traversalIPsec VPNs through NAT, used with UDP 500
- 51820UDPWireGuardWireGuard VPN tunnels
Printing
- 515TCPLPDLine printer daemon printing
- 631TCPIPPInternet printing protocol
- 9100TCPRAW printingDirect printing to network printers (JetDirect)
Virtualisation
- 902TCP/UDPVMware ESXi hostvCenter to ESXi management and heartbeats, VM remote console
- 2179TCPHyper-V VM ConnectHyper-V virtual machine console
- 2233TCPvSAN transportVMware vSAN storage traffic between hosts
- 4789UDPVXLANOverlay networking (VXLAN)
- 5480TCPvCenter appliance managementvCenter Server Appliance management interface (VAMI)
- 6081UDPGeneveVMware NSX overlay networking
- 6600TCPHyper-V live migrationMoving running VMs between Hyper-V hosts
- 8000TCPvMotionVMware vMotion between ESXi hosts
Database
- 1433TCPSQL ServerDefault SQL Server instance and Azure SQL Database
- 1434UDPSQL Server BrowserFinds the port of named SQL Server instances
- 1521TCPOracle listenerOracle database connections
- 3306TCPMySQLMySQL and MariaDB, including Azure Database for MySQL
- 5022TCPSQL Server endpointAlways On availability group and mirroring endpoint (default)
- 5432TCPPostgreSQLPostgreSQL, including Azure Database for PostgreSQL
- 6379TCPRedisRedis cache, including Azure Cache for Redis without TLS
- 27017TCPMongoDBMongoDB, including the Azure Cosmos DB for MongoDB endpoint
Storage
- 2049TCP/UDPNFSNetwork file system, NFS datastores and Azure Files NFS shares
- 3260TCPiSCSIBlock storage over IP for hosts and SANs
Messaging and collaboration
- 3478-3481UDPTeams mediaMicrosoft Teams audio, video and screen sharing (STUN and TURN)
- 5060TCP/UDPSIPVoIP call signalling
- 5061TCPSIP over TLSSecure call signalling, Teams Direct Routing
- 5671TCPAMQP over TLSAzure Service Bus and Event Hubs
- 5672TCPAMQPMessage queues such as RabbitMQ
Containers
- 6443TCPKubernetes APIKubernetes API server
- 10250TCPKubeletKubernetes node agent API
No port matches that search. Try a number, or a service name such as LDAP.
Runs in your browser. Nothing you type is sent to the server.
About this tool
A quick reference for firewall rules, change requests and troubleshooting. Search by port number (3389), by service (Kerberos) or by what it is for (replication). Ranges such as the Windows dynamic RPC range match any number inside them. Ports can be changed from their defaults, so always confirm what a particular system uses.