What are standard network port ranges?

Ports 0–1023 are Well-Known system ports (HTTP 80, HTTPS 443, SSH 22); 1024–49151 are IANA Registered ports; 49152–65535 are Dynamic or Private ephemeral ports.

What is the difference between TCP and UDP ports?

TCP provides connection-oriented, reliable, acknowledged data streams (web, file transfer); UDP provides lightweight connectionless transmission for real-time traffic (DNS, gaming, streaming).

Why do firewalls block unused ports?

Closing unnecessary open ports prevents automated network worms and port scanners from probing vulnerable software services running on internal machines.

What are common security risk ports?

Ports like 21 (FTP), 23 (Telnet), 135/445 (SMB/NetBIOS), and 3389 (RDP) are frequent targets of brute-force and ransomware attacks if exposed to the public internet.

Port Number Directory & Lookup — Search 1,000+ TCP/UDP Ports

The Three Official IANA Port Ranges

Well-Known Ports (0 – 1023): Assigned to foundational internet core services by the Internet Assigned Numbers Authority (IANA). Operating systems usually require root or administrative privileges to bind sockets on these ports (e.g. Port 80 HTTP, 443 HTTPS, 22 SSH, 53 DNS).
Registered Ports (1024 – 49151): Registered for designated vendor software and server daemons (e.g. Port 3306 MySQL, 5432 PostgreSQL, 3389 Microsoft RDP, 27017 MongoDB).
Dynamic & Ephemeral Ports (49152 – 65535): Used temporarily by client applications when establishing outbound TCP connections to external web servers.

Critical Ports to Block at Perimeter Firewalls

Unauthenticated exposure of management or legacy file sharing ports is the single most common cause of ransomware compromise. Network administrators should keep the following ports closed to public internet traffic:

Port 445 & 137–139 (SMB / NetBIOS): Primary propagation vector for WannaCry, EternalBlue, and automated worm attacks.
Port 3389 (RDP): Target of persistent brute-force automated password spraying campaigns. Use a VPN or SSH tunnel instead of direct port forwarding.
Port 23 (Telnet): Completely unencrypted legacy protocol where passwords pass over the network in cleartext.

Transport Layer Port Number Architecture & IANA Protocol Directory

In computer networking, a port is a 16-bit logical communication endpoint defined at the Transport Layer (Layer 4) of the Internet Protocol suite. Bound to specific operating system processes or network daemon services, port numbers enable multiplexed, concurrent bidirectional data streams across a single physical network interface card.

1. IANA Port Allocation Ranges (RFC 6335)

The Internet Assigned Numbers Authority (IANA) partitions the 65,536 available port numbers (ranging from 0 to 65535) into three distinct tiers:

Well-Known System Ports (0 – 1023): Reserved for privileged core operating system network services. Binding to these ports on Unix/Linux systems requires root administrative privileges. Examples: HTTP (80), HTTPS (443), SSH (22), DNS (53), SMTP (25), NTP (123).
Registered User Ports (1024 – 49151): Listed by IANA upon application by software vendors for commercial applications and database servers. Examples: MySQL (3306), PostgreSQL (5432), Redis (6379), Microsoft RDP (3389), MongoDB (27017).
Dynamic / Private / Ephemeral Ports (49152 – 65535): Allocated dynamically by operating system kernels as temporary outbound source ports during client connection establishment.

2. Transmission Protocols: TCP vs. UDP

Network services bind to specific transport protocol implementations depending on data delivery requirements:

Transmission Control Protocol (TCP): Connection-oriented protocol providing full error checking, guaranteed sequence delivery, and congestion flow control via a 3-Way Handshake (SYN, SYN-ACK, ACK). Used where data loss is intolerable (web browsing, transactional APIs, file transfers).
User Datagram Protocol (UDP): Lightweight, connectionless, stateless protocol with zero connection handshake overhead. Packets (datagrams) are transmitted without guaranteed delivery confirmation, optimizing performance for real-time applications (VoIP, DNS lookups, video teleconferencing, online gaming).

3. Network Security & Firewall Hardening

Exposing unmonitored listening ports to the public internet creates significant attack surfaces for automated port scanning (via tools like Nmap or Masscan), brute-force password cracking, and zero-day remote code execution exploits. Enterprise firewalls enforce the Principle of Least Privilege by dropping all inbound connections by default and permitting only explicitly vetted ports through Stateful Packet Inspection (SPI) rules.

TCP & UDP Port Number Directory