Common network ports
Match the service and transport protocol to its configured port. A familiar port number does not establish what is running or whether exposure is safe.
PPORT ·
Quick start
- Identify the service and protocol.
- Compare the default with the actual configuration.
- Allow only the required access.
Frequently used ports
| Port | Transport | Typical use |
|---|---|---|
| 22 | TCP | SSH |
| 53 | UDP / TCP | DNS |
| 80 | TCP | HTTP |
| 443 | TCP; UDP for HTTP/3 | HTTPS |
| 3389 | TCP / UDP | Remote Desktop |
| 3306 | TCP | MySQL / MariaDB |
| 5432 | TCP | PostgreSQL |
| 25565 | TCP in a typical Java server setup | Minecraft Java |
Ports are conventions
An application can listen on a different port. Test the configured external port and correct transport. PPORT’s port checker tests TCP only.
Internet exposure
SSH, remote desktop, database, and NAS administration services need access controls and maintenance. Prefer limiting source addresses or using an appropriate private access path. A port number alone cannot determine whether a service should be public.
Verify the application
TCP OPEN means a connection succeeded. Verify the intended protocol, application behavior, authentication, and firewall policy separately.
Ports to think twice about before exposing
The ports below receive especially many connection attempts from the internet. First decide whether the service really has to be reachable from outside; if it does, restrict the source IPs that may connect.
| Port | Service | Recommendation |
|---|---|---|
| 22 | SSH | Disable password login, use key authentication and, where possible, restrict the allowed source IPs. |
| 3389 | Remote Desktop (RDP) | Do not expose it directly; connect through a VPN or a gateway. |
| 445 | SMB file sharing | Never expose it to the internet. Many ISPs block this port. |
| 3306 / 5432 | MySQL / PostgreSQL | Let the database listen on 127.0.0.1 or the internal network only, and allow only the app server to connect. |
| 6379 / 27017 | Redis / MongoDB | Instances exposed without authentication are a frequent cause of incidents. Keep them internal. |
| 5000 / 5001 | Synology DSM admin (HTTP / HTTPS defaults) | Prefer a VPN or the vendor’s remote access feature over exposing the admin page directly. |
Finding which program uses a port on your server
Checking the process that is actually listening on the port is more reliable than the port’s usual purpose.
PS> Get-NetTCPConnection -State Listen -LocalPort 3389
$ sudo ss -ltnp 'sport = :22'
$ sudo lsof -nP -iTCP:5432 -sTCP:LISTEN
$ getent services 5432getent services only shows the conventional name registered in /etc/services. Use the first three commands to see the real process.
UDP services cannot be confirmed with a TCP check
The state of UDP services such as DNS (53), HTTP/3 (443/UDP), WireGuard (commonly 51820) or Minecraft Bedrock Edition (19132) cannot be learned from a TCP connection attempt. UDP has no connection setup, so a missing reply does not prove that a port is closed either. PPORT checks TCP only, so test UDP services with a real client or look for the request in the server’s logs.