Common Ports Cheat Sheet: TCP & UDP Reference
The ports you keep meeting, in one place. Not the full IANA list of 65,535 — the few dozen that actually turn up on a scan, what runs on them, and which ones make an attacker sit up. Bookmark it, or pair it with the Nmap cheat sheet and scan for them yourself.
Authorized use only. Scanning ports on hosts you don't own or haven't been given written permission to test can be illegal. Everything here is for your own lab, gear you administer, or an engagement with a signed scope.
The ports you'll actually see
Sorted by number. If a scan comes back with something not on this list, it's either a high random port (often a database, dev server, or C2) or something niche worth googling by service name.
| Port | Proto | Service | What it's for |
|---|---|---|---|
| 20 / 21 | TCP | FTP | File transfer. Plaintext — creds fly in the clear. Rare in production, common on old kit. |
| 22 | TCP | SSH | Encrypted remote shell and SFTP/SCP. The default admin door on Linux. |
| 23 | TCP | Telnet | Plaintext remote shell. Deprecated. If it's open, that's usually a finding. |
| 25 | TCP | SMTP | Mail transfer between servers. Often filtered by ISPs. |
| 53 | TCP/UDP | DNS | Name resolution. UDP for queries, TCP for zone transfers and big responses. |
| 67 / 68 | UDP | DHCP | Hands out IP addresses on a LAN. |
| 69 | UDP | TFTP | Trivial FTP — no auth. Used by network gear for firmware and configs. |
| 80 | TCP | HTTP | Unencrypted web. Still everywhere behind load balancers and on internal apps. |
| 110 | TCP | POP3 | Legacy mail retrieval. Downloads and deletes from the server. |
| 123 | UDP | NTP | Time sync. Also abused for reflection/amplification DDoS. |
| 135 | TCP | MSRPC | Windows RPC endpoint mapper. Gateway to a lot of Windows services. |
| 137-139 | TCP/UDP | NetBIOS | Legacy Windows name/session service. Loud, leaky, still around. |
| 143 | TCP | IMAP | Mail retrieval that keeps messages on the server. The modern POP3. |
| 161 / 162 | UDP | SNMP | Device monitoring. Default community strings (public/private) are a classic win. |
| 389 | TCP/UDP | LDAP | Directory lookups — usually Active Directory. Plaintext unless it's LDAPS. |
| 443 | TCP | HTTPS | Encrypted web. The single most common port on the internet. |
| 445 | TCP | SMB | Windows file sharing. The port behind EternalBlue and endless lateral movement. |
| 465 / 587 | TCP | SMTPS / Submission | Sending mail over TLS. 587 is the modern submission port. |
| 636 | TCP | LDAPS | LDAP wrapped in TLS. |
| 993 | TCP | IMAPS | IMAP over TLS. |
| 995 | TCP | POP3S | POP3 over TLS. |
| 1433 | TCP | MSSQL | Microsoft SQL Server. Prime target if exposed. |
| 1521 | TCP | Oracle DB | Oracle database listener. |
| 3306 | TCP | MySQL | MySQL / MariaDB. Should never face the internet. |
| 3389 | TCP | RDP | Windows Remote Desktop. A top-three ransomware entry point when exposed. |
| 5432 | TCP | PostgreSQL | PostgreSQL database. |
| 5900 | TCP | VNC | Remote desktop. Often no password, or a weak one. |
| 5985 / 5986 | TCP | WinRM | Windows Remote Management. 5986 is the TLS variant. Heavy lateral-movement use. |
| 6379 | TCP | Redis | In-memory data store. Frequently unauthenticated and internet-facing. |
| 8080 / 8443 | TCP | HTTP(S) alt | Web apps, proxies, admin panels, dev servers. Always worth a look. |
| 27017 | TCP | MongoDB | NoSQL database. A long history of open, unauthenticated instances. |
Ports an attacker probes first
Same ports, different lens. When these are exposed to a network they shouldn't be, they're where the quick wins live — and where a defender should look first.
| Port | Service | Why it's a target |
|---|---|---|
| 21 | FTP | Anonymous login, plaintext creds, writable dirs. |
| 22 | SSH | Weak passwords, exposed keys, old versions with known CVEs. |
| 23 | Telnet | Plaintext — one packet capture and you have the password. |
| 139 / 445 | SMB | Null sessions, share enumeration, EternalBlue-class bugs, relay attacks. |
| 161 | SNMP | Default community strings dump the whole device config. |
| 1433 / 3306 / 5432 | Databases | Default or reused creds, dumping tables, code execution via SQL features. |
| 3389 | RDP | Password spraying, BlueKeep, a favourite ransomware front door. |
| 5900 | VNC | No-auth desktops handed straight to you. |
| 6379 / 27017 | Redis / Mongo | Unauthenticated by default — data theft and, for Redis, RCE. |
TCP or UDP?
TCP sets up a connection (the handshake) before sending data, so a closed TCP port answers clearly and scans are reliable. UDP is fire-and-forget: no handshake, so a scanner often can't tell "closed" from "no reply", which is why UDP scans are slow and noisy. DNS, DHCP, SNMP, NTP and TFTP are the UDP services you'll meet most.
See what's listening on a box you own
Before you scan the network, know your own machine. These read the local socket table — no target, no permission questions.
ss -tulpn
Linux. Every TCP and UDP port in a listening state, with the process and numeric ports (no DNS lag). The modern replacement for netstat.
netstat -ano
Windows. All connections and listeners with the owning PID. Match the PID in Task Manager's Details tab to name the process.
nmap --top-ports 100 -sV 127.0.0.1
Scan the 100 most common ports on your own loopback and fingerprint the versions. Swap the target for a host you're authorized to test. Full flag rundown in the Nmap cheat sheet.
Where to go next
- Nmap cheat sheet — find these ports on a target and identify what's behind them.
- Reverse shell cheat sheet — once a service hands you code execution.
- Hands-on labs — practice against real, legal targets.
Port assignments follow the IANA Service Name and Transport Protocol Port Number Registry; the security notes are drawn from common pentest and blue-team practice. Spot something out of date? Tell me and I'll fix it.