Common TCP/UDP Ports List: 50 Ports and What They Do
Interactive reference for 80+ TCP/UDP ports — search by number or service, filter by transport / category / risk, and read the security advisory for every port.
Interactive port explorer
FTP data channel in active mode.
Security advisory
Credentials and file contents travel in cleartext.
Recommended mitigation
Replace with SFTP (22) or FTPS with TLS.
Common config
vsftpd.confSpecification
RFC 959FTP control channel — protocol commands.
Security advisory
All commands and credentials visible on the wire.
Recommended mitigation
Use SFTP (port 22) or FTPS Explicit/Implicit.
Common config
vsftpd.confSpecification
RFC 959Secure Shell — encrypted remote access and SFTP.
Security advisory
Top brute-force target. Open 22 = constant attack stream.
Recommended mitigation
Keys only (PasswordAuthentication no), fail2ban, non-default port, IP allowlist.
Common config
/etc/ssh/sshd_configSpecification
RFC 4253Legacy unencrypted remote shell.
Security advisory
Cleartext traffic — passwords and commands sniffable.
Recommended mitigation
Uninstall package, use SSH (22). Never expose Telnet to internet.
Common config
inetd.confSpecification
RFC 854Primary SMTP port for server-to-server mail delivery.
Security advisory
Open relays get abused by spammers; without TLS credentials leak.
Recommended mitigation
Require STARTTLS, smtpd_relay_restrictions, configure SPF/DKIM/DMARC.
Common config
postfix main.cf / exim.confSpecification
RFC 5321DNS — name resolution. UDP for queries, TCP for large responses and AXFR.
Security advisory
Open recursive resolver = DDoS amplification weapon (×50 multiplier).
Recommended mitigation
Disable recursion from outside, enable rate-limit, consider DoH/DoT (853).
Common config
/etc/named.conf / unbound.confSpecification
RFC 1035DHCP server hands out IP addresses to LAN clients.
Security advisory
Never expose externally — rogue DHCP hijacks LAN traffic trivially.
Recommended mitigation
Bind to LAN interfaces only, enable DHCP snooping on switches.
Common config
dhcpd.confSpecification
RFC 2131DHCP client listens for server replies.
Security advisory
Should be reachable only from the LAN.
Recommended mitigation
No action required — standard client configuration.
Common config
dhclient.confSpecification
RFC 2131Simple UDP protocol for firmware/PXE boot.
Security advisory
No auth whatsoever; trivially abused to write arbitrary files.
Recommended mitigation
Internal PXE only, readonly chroot, never expose externally.
Common config
tftpd-hpaSpecification
RFC 1350Unencrypted HTTP. Should only 301-redirect to 443 and serve ACME challenges.
Security advisory
All traffic readable and modifiable on the wire (MITM).
Recommended mitigation
301 redirect to HTTPS only, HSTS preload in production.
Common config
nginx.conf / httpd.confSpecification
RFC 9110Mail retrieval over unencrypted POP3.
Security advisory
Logins and passwords sniffable.
Recommended mitigation
Migrate to POP3S (995) or IMAPS (993).
Common config
dovecot.confSpecification
RFC 1939Usenet news — barely used on the modern web.
Security advisory
Low — few targets, few servers.
Recommended mitigation
Use NNTPS (563) if NNTP is needed at all.
Common config
INN / DiabloSpecification
RFC 3977Time synchronisation with NTP servers.
Security advisory
Open NTP with monlist enables amplification attacks (×500).
Recommended mitigation
noquery + nomodify, disable monlist, tighten restrict default.
Common config
ntp.conf / chrony.confSpecification
RFC 5905Read mail from server. Typically wraps STARTTLS.
Security advisory
Without STARTTLS — credentials in plaintext.
Recommended mitigation
Require STARTTLS or use IMAPS (993).
Common config
dovecot.confSpecification
RFC 9051Monitoring of network devices (routers, switches, servers).
Security advisory
Default "public" community leaks configs at scale.
Recommended mitigation
SNMPv3 with auth+priv only, never expose externally.
Common config
snmpd.confSpecification
RFC 3411Incoming SNMP traps — device-initiated alerts.
Security advisory
Spoofed traps can mislead monitoring systems.
Recommended mitigation
Restrict to trusted IPs, SNMPv3 + USM.
Common config
snmptrapd.confSpecification
RFC 3411Border Gateway Protocol — inter-AS routing on the internet.
Security advisory
BGP hijacks without RPKI cause global route leaks.
Recommended mitigation
MD5/TCP-AO between peers, BGPsec/RPKI for prefix validation.
Common config
bird.conf / frr.confSpecification
RFC 4271User and group directory — Active Directory, OpenLDAP.
Security advisory
LDAP without StartTLS — bind passwords in plaintext; critical enterprise service.
Recommended mitigation
LDAPS (636) or StartTLS, never expose externally, tight ACL.
Common config
slapd.confSpecification
RFC 4510Encrypted HTTP traffic (HTTP/1.1, HTTP/2, HTTP/3-QUIC).
Security advisory
Low risk with up-to-date TLS configuration.
Recommended mitigation
TLS 1.2+, HSTS preload, strict CSP, modern ciphers (Mozilla intermediate).
Common config
nginx.conf ssl_certificateSpecification
RFC 9110File sharing on Windows networks.
Security advisory
Historic target for wormable RCE (WannaCry, EternalBlue, BlueKeep).
Recommended mitigation
Never expose to public internet. SMB 3.1.1+, disable SMBv1.
Common config
smb.confSpecification
RFC 1001Submission with TLS from client to server (implicit TLS).
Security advisory
Safer than 25 but requires mandatory authentication.
Recommended mitigation
Mandatory SASL auth, smtpd_tls_security_level=encrypt.
Common config
postfix submissionSpecification
RFC 8314IKE — key exchange for IPSec VPN.
Security advisory
Weak PSKs + Aggressive Mode = offline key brute-force.
Recommended mitigation
IKEv2 with certificates, no PSKs in production.
Common config
ipsec.conf / strongSwanSpecification
RFC 7296Centralised log collection from devices and servers.
Security advisory
UDP drops packets and accepts spoofed messages.
Recommended mitigation
Use RELP or TCP-syslog+TLS (port 6514).
Common config
rsyslog.confSpecification
RFC 5424Standard port for client mail submission via SMTP+STARTTLS.
Security advisory
Without STARTTLS enforcement — credentials leak.
Recommended mitigation
smtpd_tls_security_level=encrypt, mandatory SASL auth.
Common config
postfix submissionSpecification
RFC 6409LDAP over TLS for secure directory access.
Security advisory
Expired/weak certificate completely negates protection.
Recommended mitigation
Valid certificate, TLS 1.2+, do not expose externally.
Common config
slapd.conf TLSCertificateFileSpecification
RFC 4513DNS-over-TLS — privacy for DNS queries.
Security advisory
Low risk; certificate validity matters.
Recommended mitigation
Valid TLS certificate, modern ciphers.
Common config
unbound.confSpecification
RFC 7858IMAP over TLS — primary port for modern mail clients.
Security advisory
Low risk with correct TLS configuration.
Recommended mitigation
TLS 1.2+, valid certificate, throttle login attempts.
Common config
dovecot.confSpecification
RFC 8314POP3 over TLS.
Security advisory
Low risk, but IMAPS is usually preferred.
Recommended mitigation
TLS 1.2+; for multi-device use IMAPS (993).
Common config
dovecot.confSpecification
RFC 8314Microsoft SQL Server — default port.
Security advisory
Open MSSQL = frequent ransomware incidents + data leaks.
Recommended mitigation
Bind to localhost / VPC, force_encryption=on, disable sa account.
Common config
mssql-confSpecification
https://learn.microsoft.com/en-us/sql/sql-server/Oracle Database listener.
Security advisory
Common pentest target; TNS poisoning, listener attacks.
Recommended mitigation
Firewall, VALID_NODE_CHECKING_REGISTRATION_LISTENER, secure listener pwd.
Common config
listener.oraSpecification
https://docs.oracle.com/en/database/Default port for MySQL/MariaDB.
Security advisory
Open MySQL = mass DB exfiltration and cryptominer installation.
Recommended mitigation
bind-address=127.0.0.1, require_secure_transport=ON, strong root pwd.
Common config
my.cnfSpecification
https://dev.mysql.com/doc/Default PostgreSQL port.
Security advisory
Open Postgres = mass DB leaks, common shotgun-scan target.
Recommended mitigation
listen_addresses=localhost, hostssl in pg_hba.conf, SCRAM-SHA-256.
Common config
pg_hba.confSpecification
https://www.postgresql.org/docs/In-memory key-value DB / cache.
Security advisory
Open Redis = cryptominer/ransomware within the hour (CONFIG SET dir).
Recommended mitigation
bind 127.0.0.1, requirepass, protocol 6/7 ACL, rename-command CONFIG "".
Common config
redis.confSpecification
https://redis.io/docs/Elasticsearch HTTP API.
Security advisory
Open ES has been a top cause of mass data leaks for years.
Recommended mitigation
xpack.security.enabled=true, TLS required, network.host=127.0.0.1.
Common config
elasticsearch.ymlSpecification
https://www.elastic.co/guide/Memcached — in-memory cache.
Security advisory
UDP memcached powered the 1.7 Tbps GitHub DDoS (2018).
Recommended mitigation
-U 0 to disable UDP, -l 127.0.0.1, SASL auth.
Common config
/etc/memcached.confSpecification
https://memcached.org/Default MongoDB port.
Security advisory
Historic cause of mass leaks under default no-auth configuration.
Recommended mitigation
authorization=enabled, net.bindIp=127.0.0.1, TLS required.
Common config
mongod.confSpecification
https://www.mongodb.com/docs/CouchDB HTTP API.
Security advisory
"Admin Party" was the default — tens of thousands of DBs leaked publicly.
Recommended mitigation
admin user required, bind_address=127.0.0.1, TLS.
Common config
local.iniSpecification
https://docs.couchdb.org/NATS — high-performance messaging bus.
Security advisory
Default no-auth — anonymous publish/subscribe to others’ subjects.
Recommended mitigation
Enable TLS + authentication (user/pass/token/nkeys).
Common config
nats-server.confSpecification
https://docs.nats.io/RabbitMQ / AMQP — message queues.
Security advisory
Default user "guest"/"guest" works from localhost; on server = risk.
Recommended mitigation
Delete guest, enable TLS, restrict listeners.
Common config
rabbitmq.confSpecification
https://www.rabbitmq.com/docsApache Kafka — distributed streaming.
Security advisory
Default PLAINTEXT listener — all messages and offsets in plaintext.
Recommended mitigation
SASL_SSL listener, mTLS between brokers, ACLs.
Common config
server.propertiesSpecification
https://kafka.apache.org/documentation/Default port for Node.js / Next.js / Express dev server.
Security advisory
Dev servers left exposed = source map leak, secrets, RCE via HMR.
Recommended mitigation
Bind to localhost only (host: "127.0.0.1"); production = reverse proxy.
Common config
package.json scripts.startSpecification
https://nodejs.org/Default Flask dev server.
Security advisory
Werkzeug debugger exposed = remote Python execution.
Recommended mitigation
app.run(host="127.0.0.1"); production via gunicorn + nginx.
Common config
flask runSpecification
https://flask.palletsprojects.com/Default Django dev server.
Security advisory
DEBUG=True + 0.0.0.0 = tracebacks with secrets to the internet.
Recommended mitigation
manage.py runserver 127.0.0.1:8000; production — gunicorn/uwsgi + nginx.
Common config
manage.py runserverSpecification
https://docs.djangoproject.com/Often used for dev servers and reverse proxies.
Security advisory
Never leave dev server exposed. Tomcat manager is a common RCE target.
Recommended mitigation
Reverse proxy (nginx/Caddy) in front of app server, disable Tomcat manager.
Common config
tomcat / jenkins / proxySpecification
https://datatracker.ietf.org/doc/html/rfc9110Alternate HTTPS port for admin panels (cPanel, DirectAdmin, Plesk).
Security advisory
Hosting panels = frequent brute-force and CVE-exploit target.
Recommended mitigation
Hide behind VPN or IP allowlist, enable MFA, keep panel up-to-date.
Common config
cPanel / DirectAdmin / PleskSpecification
https://datatracker.ietf.org/doc/html/rfc9110OpenVPN — encrypted VPN tunnel.
Security advisory
Weak ciphers or static key = VPN perimeter compromise.
Recommended mitigation
AES-256-GCM / ChaCha20-Poly1305, tls-auth, tls-crypt, certificate revocation.
Common config
openvpn server.confSpecification
https://openvpn.net/community-resources/Legacy VPN protocol. MS-CHAPv2 cryptography is fully broken.
Security advisory
All VPN traffic can be decrypted within a day on ASIC/cloud.
Recommended mitigation
Remove PPTP. Replace with OpenVPN (1194) or WireGuard (51820).
Common config
pptpd.confSpecification
RFC 2637IPSec NAT-Traversal — UDP wrapper for IPSec across NAT.
Security advisory
Same risks as IKE (500) — weak PSKs = key leakage.
Recommended mitigation
IKEv2 + certificates, no aggressive-mode PSK.
Common config
ipsec.conf / strongSwanSpecification
RFC 3947WireGuard — modern, fast, minimal VPN.
Security advisory
Low risk; silent-by-design (no response without correct packets).
Recommended mitigation
Default configuration is secure. PreSharedKey adds another layer.
Common config
/etc/wireguard/wg0.confSpecification
https://www.wireguard.com/papers/wireguard.pdfRemote Desktop Protocol — Windows remote desktop.
Security advisory
Top ransomware vector (Conti, REvil). BlueKeep CVE-2019-0708 = wormable RCE.
Recommended mitigation
Behind VPN only, NLA mandatory, MFA, Account Lockout Policy.
Common config
Group Policy: Remote DesktopVirtual Network Computing — remote desktop.
Security advisory
Classic VNC = weak auth (8 chars) + cleartext.
Recommended mitigation
Tunnel through SSH/VPN, use VNC over TLS (TigerVNC).
Common config
tightvncserver / x11vncSpecification
https://datatracker.ietf.org/doc/html/rfc6143Default Minecraft Java Edition server port.
Security advisory
DDoS is the main threat, plus Log4Shell RCE (2021).
Recommended mitigation
Anti-DDoS proxy (BungeeCord/Velocity), keep plugins patched.
Common config
server.propertiesSpecification
https://minecraft.wiki/w/ServerSource engine dedicated server (CS:GO, TF2, etc).
Security advisory
UDP amplification via A2S_INFO; RCE in old Source builds.
Recommended mitigation
sv_rcon_minfailures=1, disable anonymous A2S_INFO, keep patches current.
Common config
srcds_runApple Push Notification Service (APNS).
Security advisory
Low risk — outbound to gateway.push.apple.com.
Recommended mitigation
Allow outbound, use JWT tokens for authentication.
Common config
(outbound)Google Firebase Cloud Messaging (FCM/GCM).
Security advisory
Low risk — outbound to Google.
Recommended mitigation
Allow outbound 5228-5230 in corporate firewalls.
Common config
(outbound)Specification
https://firebase.google.com/docs/cloud-messagingInternet Relay Chat — classic chat protocol.
Security advisory
Unencrypted; IRC networks are common botnet C&C infrastructure.
Recommended mitigation
IRC-over-TLS (6697) or modern messengers.
Common config
unrealircd / inspircdSpecification
RFC 1459Encrypted IRC.
Security advisory
Low risk; certificate validity matters.
Recommended mitigation
TLS 1.2+, valid certificate, SASL EXTERNAL.
Common config
unrealircd ssl blockSpecification
https://datatracker.ietf.org/doc/html/rfc7194SOCKS proxy — tunneling arbitrary TCP.
Security advisory
Open SOCKS = parasitic traffic, abuse reports, botnet membership.
Recommended mitigation
Mandatory authentication, per-IP ACL, monitor bandwidth.
Common config
dante / 3proxySpecification
RFC 1928Network File System — shared filesystem on *nix.
Security advisory
NFSv3 without Kerberos = client-side UID trust; UID 0 escapeable.
Recommended mitigation
NFSv4 + Kerberos krb5p, no_root_squash → root_squash, ACL exports.
Common config
/etc/exportsSpecification
RFC 7530Default port for Squid caching proxy.
Security advisory
Open Squid = bandwidth abuse + IP reputation hit.
Recommended mitigation
http_access deny all + allow only for your subnet, auth helpers.
Common config
squid.confSpecification
http://www.squid-cache.org/Doc/STUN/TURN — NAT traversal for WebRTC, voice, video.
Security advisory
Open TURN without auth = free anonymous relay for attackers.
Recommended mitigation
coturn with long-term credentials or REST-API ephemeral secrets.
Common config
turnserver.confSpecification
RFC 5389SVN server.
Security advisory
Git replaced SVN for most workflows; legacy repos often hold secrets.
Recommended mitigation
Migrate to Git. If SVN required — tunnel over SSH or HTTPS.
Common config
svnserve.confSpecification
https://subversion.apache.org/docs/Session Initiation Protocol — signalling for VoIP.
Security advisory
Common toll-fraud scan target (sipvicious). Mistake = a $$ bill.
Recommended mitigation
SIPS (5061), fail2ban on sip-failed-auth, country allow-list.
Common config
asterisk sip.confSpecification
RFC 3261SIP over TLS.
Security advisory
Safer than 5060 but still a brute-force target.
Recommended mitigation
Certificates with mTLS, fail2ban, disable anonymous SIP.
Common config
asterisk pjsip.confSpecification
RFC 3261Default Prometheus port.
Security advisory
Public /metrics endpoint = leaks internal architecture + software versions.
Recommended mitigation
Reverse proxy + basic auth, or bind 127.0.0.1 + Grafana proxy.
Common config
prometheus.ymlSpecification
https://prometheus.io/docs/Docker API without TLS — instant root via POST /containers/create.
Security advisory
Anyone can spawn a privileged container mounting /:/host = host RCE.
Recommended mitigation
Never expose 2375. Use unix socket or 2376 + mTLS.
Common config
/etc/docker/daemon.jsonSpecification
https://docs.docker.com/engine/api/Docker API over TLS with mTLS authentication.
Security advisory
Weak client CA = root on host. Certificates rarely get revoked.
Recommended mitigation
Mandatory mTLS, dedicated CA for Docker, certificate rotation.
Common config
/etc/docker/daemon.jsonKubernetes API server.
Security advisory
Anonymous roles + open 6443 = cluster takeover in seconds.
Recommended mitigation
--anonymous-auth=false, RBAC, audit log, IP allowlist on LB.
Common config
kube-apiserver flagsetcd client port — Kubernetes secrets store.
Security advisory
Open etcd = the entire Kubernetes secret store + full read/write.
Recommended mitigation
Mandatory mTLS, encryption-at-rest, never expose externally.
Common config
etcd.confSpecification
https://etcd.io/docs/latest/op-guide/security/InfluxDB HTTP API.
Security advisory
Public InfluxDB v1 = anonymous read/write across all metric DBs.
Recommended mitigation
auth-enabled=true, HTTPS, bind-address=127.0.0.1.
Common config
/etc/influxdb/influxdb.confSpecification
https://docs.influxdata.com/influxdb/Often Jupyter Notebook / alternate HTTP.
Security advisory
Jupyter without token = arbitrary Python execution for the entire internet.
Recommended mitigation
NotebookApp.token=strong_token, password_required, --ip=127.0.0.1.
Common config
jupyter_notebook_config.pySyncthing — P2P file synchronisation.
Security advisory
Low risk — device IDs are required for peering.
Recommended mitigation
Default configuration is safe; protect the GUI (8384) separately.
Common config
config.xmlSpecification
https://docs.syncthing.net/Syncthing web GUI.
Security advisory
Default — no auth on 127.0.0.1; if exposed = data exfiltration.
Recommended mitigation
GUI username+password, TLS, access only from VPN / 127.0.0.1.
Common config
config.xml gui addressSpecification
https://docs.syncthing.net/Quote of the Day — ancient service; used for UDP amplification.
Security advisory
Open QOTD UDP = bot for DDoS attacks.
Recommended mitigation
Disable xinetd qotd; never needed in production.
Common config
xinetd qotdSpecification
RFC 865SSDP/UPnP — device discovery on LAN. Used for amplification.
Security advisory
Open 1900 = ×30 DDoS amplification + internal structure leak.
Recommended mitigation
Disable UPnP on router, drop 1900 at edge firewall.
Common config
router admin UIMulticast DNS — service discovery on LAN (Bonjour, Avahi).
Security advisory
Open mDNS externally = leaks hostname/service-info + ×100 amplification.
Recommended mitigation
Drop 5353 at WAN firewall, avahi-daemon on LAN interface only.
Common config
avahi-daemon.confSpecification
RFC 6762MQTT — IoT messaging without TLS.
Security advisory
Thousands of open MQTT brokers leak IoT telemetry + control commands.
Recommended mitigation
allow_anonymous=false, mTLS on 8883, ACL per topic pattern.
Common config
mosquitto.confSpecification
https://mqtt.org/MQTT over TLS.
Security advisory
Safer than 1883, but without auth still anyone-subscribe.
Recommended mitigation
mTLS or username/password, ACL per topic.
Common config
mosquitto.confSpecification
https://mqtt.org/Kibana — UI for Elasticsearch.
Security advisory
Public Kibana = browse logs/indices, often contain PII / secrets.
Recommended mitigation
xpack.security.enabled=true, HTTPS, reverse proxy + IP allowlist.
Common config
/etc/kibana/kibana.ymlSpecification
https://www.elastic.co/guide/en/kibana/Often Portainer (Docker UI) or SonarQube. Any admin panel = high risk if exposed.
Security advisory
Portainer without MFA = full Docker control; SonarQube — source-code leak.
Recommended mitigation
Mandatory TLS, MFA, reverse proxy + IP allowlist.
Common config
portainer / sonar.propertiesSpecification
https://docs.portainer.io/Eco Global Survival — game server.
Security advisory
DDoS + RCE through mod vulnerabilities in plugins.
Recommended mitigation
Anti-DDoS, whitelist plugins, regular server updates.
Common config
EcoServer.cfgSpecification
https://wiki.play.eco/en/ServerMinecraft Bedrock dedicated server.
Security advisory
UDP amplification via RakNet handshake; DDoS target.
Recommended mitigation
Anti-DDoS proxy (e.g. GeyserMC), keep server patched.
Common config
server.propertiesSpecification
https://minecraft.wiki/w/Bedrock_Dedicated_ServerTerraria — game server.
Security advisory
Old TShock versions — RCE via chat commands.
Recommended mitigation
Update TShock, require server password, plugin allowlist.
Common config
TShock config.jsonSpecification
https://github.com/Pryaxis/TShockQuakeWorld — legacy game protocol.
Security advisory
Low risk (few servers), but UDP amplification possible.
Recommended mitigation
Enable only if actually needed; modern forks are safer.
Common config
qwsv.cfgSpecification
https://github.com/QW-Group