Typical context
- Input
- topic → definition → context
- Expected output
- interpretation → limits → next step
The central topic is tCP UDP Port Reference — the value is in understanding the correct interpretation, not only repeating a result.
TCP UDP Port Reference
This guide covers what really matters in tCP UDP Port Reference: concepts, context, limits and interpretations that often cause confusion.
The central topic is tCP UDP Port Reference — the value is in understanding the correct interpretation, not only repeating a result.
Interpreting an IP, domain, port or vendor without checking scope and source. The fix usually starts by cross-check the result with the source, update window and infrastructure layer..
Deliberate decision: unauthorized port scanning is an abuse vector and has legal implications in several countries. We prefer a clear, safe reference.
The main point is understanding tCP UDP Port Reference in the right context instead of treating one isolated value as a complete answer.
A typical limitation is assuming that one identifier alone explains the entire environment.
Cross-check tCP UDP Port Reference with source, conventions, freshness and practical goals before taking action.
FTP data channel (active mode). Cleartext — prefer SFTP (22) or FTPS (990).
FTP control channel. Cleartext. Prefer SFTP (22) or FTPS (990).
SSH remote shell and SFTP file transfer with end-to-end encryption.
Legacy cleartext remote shell. Replaced by SSH (22).
Mail relay between servers. Supports STARTTLS. Often blocked by ISPs for end-users.
Name resolution. UDP for normal queries, TCP for zone transfers and large answers. DoT (853) and DoH (443) encrypt.
DHCP server listens for client requests on this port.
DHCP client receives server replies on this port.
Simple unauthenticated transfer. Common in PXE boot and network appliances.
Cleartext HTTP. In production always use HTTPS (443).
Kerberos authentication (KDC). Active Directory foundation.
Mail retrieval (legacy). Cleartext. Use POP3S (995).
Usenet / newsgroups. Rarely used today. Secure variant: NNTPS (563).
Time synchronization. Often abused in amplification attacks.
Microsoft DCE/RPC endpoint mapper. Never expose to the internet.
NetBIOS name resolution. Historical worm vector (Sasser/Conficker).
SMB over NetBIOS. Replaced by direct SMB on 445.
Mailbox access. Cleartext. Use IMAPS (993).
Network device management. v1/v2c cleartext. SNMPv3 encrypts.
Receives SNMP traps/alerts.
Public-internet routing protocol. TCP sessions between ASes.
Traditional IRC. TLS variant: 6697.
Directory service (Active Directory, OpenLDAP). Use LDAPS (636) or StartTLS.
Encrypted web (TLS 1.2/1.3). Also used by HTTP/3 over QUIC (UDP 443).
Direct SMB file sharing over TCP. WannaCry vector — block at the perimeter.
Mail submission with implicit TLS. Modern alternative to 587 with STARTTLS.
Centralized logging. Unencrypted; use TLS syslog (6514) for sensitive traffic.
Authenticated mail submission from clients. STARTTLS required by modern providers.
Printing (CUPS). Frequently exposed unnecessarily.
LDAP encrypted with implicit TLS.
DNS queries encrypted with TLS.
Cleartext rsync sync. Prefer rsync over SSH.
FTPS implicit-TLS data channel.
FTPS with implicit TLS. SFTP (22) is usually simpler to operate.
Encrypted IMAP access.
Encrypted POP3.
SOCKS4/5 proxy. Used by Tor and generic proxy clients.
OpenVPN, usually UDP. Can run on TCP in restrictive networks.
SQL Server. Do not expose to the public internet.
Oracle listener. Keep behind a firewall.
PPTP VPN, considered insecure. Use OpenVPN, IKEv2 or WireGuard.
AAA authentication. Use RADSEC for encrypted transport.
RADIUS accounting.
MQTT broker without TLS. Use MQTTS (8883) in production.
Unix file sharing. NFSv4 supports Kerberos authentication.
Docker API without TLS — equivalent to remote root access. NEVER expose to the internet.
Docker API with mandatory mutual TLS.
Informal default for Node dev servers (Next.js, Express).
MySQL/MariaDB database. TLS optional; keep private.
Windows remote desktop. Always behind a VPN or gateway.
NAT traversal for WebRTC and VoIP.
Default Phoenix Framework dev port.
ngrok local tunnel inspector UI.
Default Flask dev server. Conflicts with AirPlay on macOS.
Cleartext VoIP signaling. SIP-TLS on 5061.
VoIP signaling with TLS.
Default Vite dev port (React/Vue/Svelte).
XMPP messaging. Supports StartTLS.
Server-to-server XMPP federation.
Zero-config service discovery (.local).
PostgreSQL database. TLS configurable; keep private.
AMQP brokers (RabbitMQ). TLS on 5671.
VNC web-based client.
VNC remote display. Tunnel via SSH on untrusted networks.
WinRM over HTTP. Use HTTPS (5986).
WinRM with TLS.
Redis cache/KV store. NEVER expose without auth — common cryptominer target.
Kubernetes API server with mandatory mTLS.
Alternative IRC port range.
IRC with TLS.
HTTP dev servers (Django, http.server).
Alternative HTTP. Common for proxies, dashboards and Tomcat.
Alternative HTTPS, common on admin dashboards.
MQTT with TLS.
PHP-FPM and assorted dev tooling.
Prometheus metrics endpoint.
Kafka broker. TLS/SASL configurable.
Elasticsearch/OpenSearch HTTP API. Keep private.
In-memory cache. UDP is an amplification vector — use TCP and firewall.
Minecraft Java server.
Source-engine based servers (CS:GO, TF2, etc).
MongoDB database. Do not expose without auth.
WireGuard VPN. Default port from the official docs.
Everything runs locally in your browser from an embedded catalog. This tool does not connect to IPs or ports — it is not a scanner.