Port & Protocol Lookup
MAG212 CYBER · Tools
Port & protocol lookup.
What is running on port 3389, and should it be open to the internet? Search 65 common ports for the service, the exposure risk and how to secure it.
Search ports
Risk:
| Port | Protocol | Service | Internet exposure risk | What to do |
|---|---|---|---|---|
| 20-21 | TCP | FTP (data / control) | High | Sends credentials and files in clear text. Replace with SFTP or FTPS; never expose to the internet. |
| 22 | TCP | SSH, SFTP, SCP | Medium | Secure remote admin, but constantly brute-forced. Use keys, disable root and password login, restrict by source IP or VPN. |
| 23 | TCP | Telnet | Critical if exposed | Clear-text remote login. Disable it on every device and use SSH. A favourite target of IoT botnets such as Mirai. |
| 25 | TCP | SMTP (server-to-server mail) | Medium | Needed by mail servers only. Block outbound 25 from user networks to stop spam bots; prevent open relaying. |
| 49 | TCP | TACACS+ | Medium | Network device AAA. Keep on the management network; it encrypts only the payload. |
| 53 | TCP/UDP | DNS | Medium | Only resolvers and authoritative servers should answer. Open resolvers are abused for DDoS amplification. |
| 67-68 | UDP | DHCP server / client | Low | LAN only. Protect against rogue DHCP servers with DHCP snooping. |
| 69 | UDP | TFTP | High | No authentication at all. Used for device images and IP-phone configs — restrict tightly, never internet-facing. |
| 80 | TCP | HTTP | Medium | Unencrypted web. Redirect to HTTPS. Device admin pages on port 80 should be disabled or restricted. |
| 88 | TCP/UDP | Kerberos | High | Active Directory authentication. Internal only; never expose domain controllers. |
| 110 | TCP | POP3 | High | Clear-text mailbox access. Use POP3S (995) or IMAPS (993). |
| 111 | TCP/UDP | RPCbind / portmapper | High | Reveals RPC services and is used in DDoS amplification. Block at the perimeter. |
| 123 | UDP | NTP | Medium | Time sync. Disable monlist; public NTP servers have been abused for amplification attacks. |
| 135 | TCP | Microsoft RPC endpoint mapper | Critical if exposed | Windows RPC. Never expose to the internet; heavily targeted by worms. |
| 137-139 | TCP/UDP | NetBIOS | Critical if exposed | Legacy Windows file sharing and name service. Block at the perimeter; disable where not needed. |
| 143 | TCP | IMAP | High | Clear-text mailbox access. Use IMAPS (993). |
| 161-162 | UDP | SNMP / SNMP traps | High | v1/v2c send community strings in clear text; 'public' defaults are common. Use SNMPv3 and restrict by ACL. |
| 179 | TCP | BGP | Medium | Only to configured peers. Protect with TCP-AO or MD5, GTSM (TTL security) and prefix filters. |
| 389 | TCP/UDP | LDAP | High | Directory queries, often in clear text. Use LDAPS (636) or LDAP with StartTLS and signing; never internet-facing. |
| 443 | TCP | HTTPS | Low | Encrypted web. Keep TLS 1.2+ only. VPN and firewall admin portals on 443 are prime targets — patch fast and add MFA. |
| 445 | TCP | SMB (Windows file sharing) | Critical if exposed | Exploited by WannaCry and NotPetya (EternalBlue). Never expose to the internet; disable SMBv1; require signing. |
| 465 | TCP | SMTPS (implicit TLS submission) | Low | Authenticated mail submission over TLS. |
| 500 | UDP | IKE (IPsec VPN) | Medium | VPN key exchange. Use IKEv2 with strong proposals; disable aggressive mode. |
| 502 | TCP | Modbus | Critical if exposed | Industrial control protocol with no authentication. Must never be reachable from the internet. |
| 514 | UDP | Syslog | Medium | Clear text and spoofable. Send logs over TLS (6514) where possible and restrict senders. |
| 587 | TCP | SMTP submission (STARTTLS) | Low | Authenticated client mail submission. Require TLS and MFA-capable accounts. |
| 623 | UDP | IPMI / BMC | Critical if exposed | Server out-of-band management with known authentication flaws. Isolate on a management network. |
| 636 | TCP | LDAPS | Medium | LDAP over TLS. Internal only. |
| 853 | TCP | DNS over TLS | Low | Encrypted DNS. Watch for it if you rely on DNS filtering. |
| 873 | TCP | rsync | High | Frequently left open without authentication, leaking data. Tunnel over SSH. |
| 989-990 | TCP | FTPS | Medium | FTP over TLS. Better than FTP, but SFTP is simpler to firewall. |
| 993 | TCP | IMAPS | Low | Encrypted mailbox access. Enforce MFA or modern authentication. |
| 995 | TCP | POP3S | Low | Encrypted POP3. |
| 1080 | TCP | SOCKS proxy | High | Open proxies are abused to hide attackers' traffic. Require authentication or close. |
| 1194 | UDP | OpenVPN | Medium | VPN. Keep patched and use certificate plus MFA authentication. |
| 1433 | TCP | Microsoft SQL Server | Critical if exposed | Databases must not be internet-facing. Brute-forced and exploited constantly. |
| 1521 | TCP | Oracle database listener | Critical if exposed | Internal only. |
| 1645-1646, 1812-1813 | UDP | RADIUS | Medium | AAA for VPN, Wi-Fi (802.1X) and network devices. Use strong shared secrets or RadSec. |
| 1723 | TCP | PPTP VPN | Critical if exposed | PPTP/MS-CHAPv2 is cryptographically broken. Replace with IKEv2/IPsec, WireGuard or SSL VPN. |
| 1883 | TCP | MQTT | High | IoT messaging, often without authentication. Use 8883 with TLS and credentials. |
| 2049 | TCP/UDP | NFS | High | Network file system. Internal only, with export restrictions. |
| 2375-2376 | TCP | Docker API | Critical if exposed | Port 2375 is the unauthenticated Docker API — full control of the host. Never expose; use 2376 with mutual TLS. |
| 3128 | TCP | Squid / HTTP proxy | High | Open proxies are abused. Require authentication. |
| 3306 | TCP | MySQL / MariaDB | Critical if exposed | Databases must not be internet-facing. |
| 3389 | TCP/UDP | RDP (Remote Desktop) | Critical if exposed | A leading ransomware entry point. Never expose directly; put it behind a VPN or gateway with MFA and enable NLA. |
| 4500 | UDP | IPsec NAT traversal | Medium | Part of IPsec VPNs (with UDP 500). |
| 4786 | TCP | Cisco Smart Install | Critical if exposed | Unauthenticated; abused by nation-state actors to take over switches. Disable with 'no vstack'. |
| 5060-5061 | TCP/UDP | SIP (VoIP) | High | Targeted for toll fraud. Use 5061 (TLS), strong passwords and a session border controller. |
| 5432 | TCP | PostgreSQL | Critical if exposed | Databases must not be internet-facing. |
| 5800, 5900 | TCP | VNC | Critical if exposed | Remote desktop, often with weak or no passwords. Tunnel through a VPN or SSH. |
| 5985-5986 | TCP | WinRM (PowerShell remoting) | High | Windows remote management. Internal only; prefer HTTPS (5986). |
| 6379 | TCP | Redis | Critical if exposed | Often deployed without authentication; mass-exploited for cryptomining. Bind to localhost or require auth. |
| 6514 | TCP | Syslog over TLS | Low | Encrypted log transport. |
| 8080, 8443 | TCP | Alternate HTTP / HTTPS | Medium | Often admin panels, proxies or dev servers. Inventory what is listening and restrict. |
| 8291 | TCP | MikroTik Winbox | Critical if exposed | Router management, targeted by botnets. Restrict to management networks. |
| 8883 | TCP | MQTT over TLS | Medium | Secure IoT messaging; still require client authentication. |
| 9100 | TCP | Raw printing (JetDirect) | High | Printers accept jobs and sometimes commands with no authentication. Internal only. |
| 9200 | TCP | Elasticsearch | Critical if exposed | Behind thousands of data leaks. Never expose; enable security features. |
| 10000 | TCP | Webmin / NDMP | High | Server admin panels. Restrict and patch. |
| 11211 | UDP/TCP | Memcached | Critical if exposed | Used for record-breaking DDoS amplification. Disable UDP and never expose. |
| 20000 | TCP | DNP3 | Critical if exposed | Utility/SCADA protocol. Isolate in the OT network. |
| 27017 | TCP | MongoDB | Critical if exposed | Exposed instances have been wiped and ransomed by the thousand. Require auth and bind internally. |
| 44818 | TCP/UDP | EtherNet/IP (CIP) | Critical if exposed | Industrial automation protocol. Isolate in the OT network. |
| 47808 | UDP | BACnet | Critical if exposed | Building automation (HVAC, access control). Never internet-facing. |
| 51820 | UDP | WireGuard | Low | Modern VPN. Keep keys protected and rotate when staff leave. |
How to use this
- “Critical if exposed” means the service should never be reachable from the internet. If a scan shows it open externally, treat it as an incident until proven otherwise.
- Find what’s open with the Nmap command builder (on networks you’re authorised to scan), then look each port up here.
- Default-deny inbound at the firewall and open only what has a documented business need and an owner.
- Port numbers are conventions: attackers and admins run services on non-standard ports, so use
nmap -sVto identify what is really listening.
Need expert help?
MAG212 CYBER offers network and cybersecurity consultation, plus security seminars for organisations around the world.