How to use the Port Number Lookup tool
- Type a port number (3389) or a service (postgres, vpn, mail).
- Filter by well-known or registered ports if needed.
- Read the protocol and notes for each match.
How port numbers are organised
A port number identifies a service on a host, from 0 to 65535. IANA divides the space into three ranges: well-known ports (0 to 1023) for core services such as HTTP and SSH, registered ports (1024 to 49151) assigned to specific applications, and dynamic or ephemeral ports (49152 to 65535) that operating systems pick for the client side of a connection.
A port number is only a convention. Nothing stops someone from running SSH on 443 or a web server on 22, so a firewall rule based on ports alone does not tell you which application is really talking.
Ports that should not face the internet
- 3389 (RDP), 5900 (VNC), 23 (Telnet): constant brute-force targets. Use a VPN or a bastion.
- 445 (SMB), 135/139 (RPC/NetBIOS): behind several large ransomware outbreaks.
- 3306, 5432, 1433, 27017, 6379, 9200: databases and caches. Bind them to localhost or a private network.
- 2375 (Docker API): an open Docker API is equal to root on the server.
When reviewing a server, compare the ports that are listening (ss -tulpn on Linux, Get-NetTCPConnection -State Listen on Windows) with the ports you actually intend to expose.
Privacy
Everything runs in your browser. Nothing you type is sent to our server or stored.
Frequently asked questions
What is the difference between TCP and UDP ports?
They are separate number spaces. TCP 53 and UDP 53 are different ports; DNS happens to use both.
Which port does HTTPS use?
TCP 443, and UDP 443 for HTTP/3 (QUIC).
Why does my port check show a port in the 50000s?
That is an ephemeral port used for the client side of a connection. It changes every time.
Is changing the SSH port a security measure?
It reduces log noise from bots but is not real protection. Use key-based authentication and disable password login.