{"id":3463,"date":"2026-10-28T09:02:06","date_gmt":"2026-10-28T16:02:06","guid":{"rendered":"https:\/\/cyber.mag212.com\/tools\/port-lookup\/"},"modified":"2026-10-28T09:02:06","modified_gmt":"2026-10-28T16:02:06","slug":"port-lookup","status":"publish","type":"page","link":"https:\/\/cyber.mag212.com\/fr\/tools\/port-lookup\/","title":{"rendered":"Recherche de port et de protocole"},"content":{"rendered":"\n<div class=\"m212x\" id=\"m212-port-lookup\">\n<style>\n.m212x{--bg:#0a0f15;--panel:#0f1720;--panel2:#121c27;--line:#1f2d3a;--line2:#2a3b4b;--ink:#e6edf3;--mute:#9fb0c0;--green:#3ee6a0;--red:#ff5468;--cyan:#3cc8f0;--amber:#f6b544;--violet:#a98bff;\n font-family:Inter,system-ui,-apple-system,\"Segoe UI\",sans-serif;color:var(--ink);line-height:1.6;font-size:16px}\n.m212x *{box-sizing:border-box}\n.m212x h2,.m212x h3,.m212x h4,.m212x p,.m212x ul,.m212x ol{margin:0}\n.m212x a{color:var(--cyan)}\n.m212x .hero{position:relative;background:radial-gradient(ellipse at 90% 0%,rgba(60,200,240,.14),transparent 60%),var(--bg);border:1px solid var(--line);border-radius:14px;padding:34px 30px;overflow:hidden;margin-bottom:22px}\n.m212x .hero::before{content:\"\";position:absolute;left:0;right:0;top:0;height:4px;background:linear-gradient(90deg,var(--green),var(--cyan) 60%,var(--red))}\n.m212x .kick{font-size:12px;font-weight:800;letter-spacing:.2em;text-transform:uppercase;color:var(--cyan);margin-bottom:8px}\n.m212x .hero h2{font-size:clamp(26px,4.6vw,40px);line-height:1.1;font-weight:800;margin-bottom:10px}\n.m212x .hero h2 span{color:var(--green)}\n.m212x .hero p{color:var(--mute);font-size:17px;max-width:680px}\n.m212x .sec{background:var(--panel);border:1px solid var(--line);border-radius:14px;padding:24px;margin-bottom:22px;scroll-margin-top:110px}\n.m212x .sec h3{font-size:22px;font-weight:800;margin-bottom:8px}\n.m212x .sec h4{font-size:16px;font-weight:800;margin:16px 0 6px}\n.m212x .sec p{color:#cdd8e2;margin-bottom:10px}\n.m212x .lead{color:var(--mute) !important;margin-bottom:16px !important}\n.m212x .grid{display:grid;gap:14px;grid-template-columns:repeat(auto-fit,minmax(230px,1fr))}\n.m212x .card{display:block;background:var(--panel2);border:1px solid var(--line2);border-radius:10px;padding:18px;text-decoration:none;color:var(--ink)}\n.m212x a.card:hover{border-color:var(--green)}\n.m212x .card b{display:block;font-size:17px;margin-bottom:6px}\n.m212x .card p{color:var(--mute);font-size:14.5px;margin:0}\n.m212x .card .go{display:inline-block;margin-top:10px;font-size:13px;font-weight:800;letter-spacing:.06em;color:var(--green)}\n.m212x .ic{font-size:26px;display:block;margin-bottom:8px}\n.m212x ul.l,.m212x ol.l{padding-left:22px;color:#cdd8e2;margin-bottom:10px}\n.m212x ul.l li,.m212x ol.l li{margin-bottom:6px}\n.m212x table{width:100%;border-collapse:collapse;font-size:14.5px;margin:6px 0 12px}\n.m212x th{text-align:left;font-size:12px;letter-spacing:.12em;text-transform:uppercase;color:var(--mute);border-bottom:1px solid var(--line2);padding:8px}\n.m212x td{border-bottom:1px solid var(--line);padding:8px;vertical-align:top;color:#d3dde6}\n.m212x code,.m212x .mono{font-family:\"JetBrains Mono\",\"DejaVu Sans Mono\",Consolas,monospace;font-size:.9em}\n.m212x code{background:rgba(60,200,240,.1);color:#bfe9ff;padding:1px 5px;border-radius:4px}\n.m212x pre{font-family:\"JetBrains Mono\",\"DejaVu Sans Mono\",Consolas,monospace;font-size:13.5px;background:#060a0f;border:1px solid var(--line);border-left:3px solid var(--green);border-radius:6px;padding:12px 14px;overflow-x:auto;color:#cfe8d9;margin:6px 0 12px;white-space:pre}\n.m212x .callout{border:1px solid rgba(246,181,68,.4);background:rgba(246,181,68,.08);border-radius:10px;padding:14px 16px;margin:12px 0}\n.m212x .callout b{color:var(--amber)}\n.m212x .pill{display:inline-block;font-size:12px;font-weight:800;letter-spacing:.06em;padding:2px 9px;border-radius:999px;border:1px solid}\n.m212x .p-n{color:#9fb0c0;border-color:#3a4b5b}\n.m212x .p-l{color:var(--green);border-color:rgba(62,230,160,.5);background:rgba(62,230,160,.08)}\n.m212x .p-m{color:var(--amber);border-color:rgba(246,181,68,.5);background:rgba(246,181,68,.08)}\n.m212x .p-h{color:#ff8a5c;border-color:rgba(255,138,92,.5);background:rgba(255,138,92,.08)}\n.m212x .p-c{color:var(--red);border-color:rgba(255,84,104,.5);background:rgba(255,84,104,.08)}\n.m212x .toc{display:flex;flex-wrap:wrap;gap:8px;margin-top:18px}\n.m212x .toc a{font-size:14px;font-weight:700;text-decoration:none;color:var(--ink);background:var(--panel2);border:1px solid var(--line2);border-radius:999px;padding:7px 13px}\n.m212x .toc a:hover{border-color:var(--green);color:var(--green)}\n.m212x input[type=text],.m212x input[type=search],.m212x input[type=url]{width:100%;background:#060a0f;color:var(--ink);border:1px solid var(--line2);border-radius:8px;padding:12px 14px;font-size:16px;font-family:inherit}\n.m212x input:focus{outline:2px solid var(--cyan);outline-offset:1px}\n.m212x button{font-family:inherit;font-size:15px;font-weight:700;cursor:pointer;border-radius:8px;padding:11px 16px;border:1px solid var(--line2);background:var(--panel2);color:var(--ink)}\n.m212x button.pri{background:var(--green);color:#04130c;border-color:var(--green)}\n.m212x .help{display:flex;gap:18px;align-items:center;flex-wrap:wrap;background:linear-gradient(90deg,rgba(60,200,240,.12),rgba(62,230,160,.05));border:1px solid rgba(60,200,240,.35);border-radius:14px;padding:20px 24px}\n.m212x .help div{flex:1;min-width:240px}\n.m212x .help a.cta{display:inline-block;background:var(--cyan);color:#03141b;font-weight:800;text-decoration:none;border-radius:8px;padding:12px 18px}\n.m212x .small{font-size:13.5px;color:var(--mute)}\n<\/style>\n<section class=\"hero\"><div class=\"kick\">MAG212 CYBER \u00b7 Tools<\/div><h2>Port &amp; protocol <span>lookup.<\/span><\/h2><p>What is running on port 3389, and should it be open to the internet? Search 65 common ports for the service, the exposure risk and how to secure it.<\/p><div class=\"toc\"><a href=\"#m212pl-tool\">Search ports<\/a><a href=\"#m212pl-how\">How to use this<\/a><\/div><\/section><style>.m212x .sn-row{display:flex;gap:8px;flex-wrap:wrap}\n.m212x .sn-ex{display:flex;gap:6px;flex-wrap:wrap;margin:10px 0 2px}.m212x .sn-ex button{padding:5px 10px;font-size:13px;font-family:\"JetBrains Mono\",\"DejaVu Sans Mono\",monospace}\n.m212x .sn-kv{display:grid;grid-template-columns:repeat(auto-fit,minmax(min(100%,230px),1fr));gap:10px;margin:14px 0}\n.m212x .sn-kv div{background:#060a0f;border:1px solid var(--line2);border-radius:10px;padding:10px 12px;min-width:0}\n.m212x .sn-kv span{display:block;font-size:11.5px;letter-spacing:.12em;text-transform:uppercase;color:var(--mute)}\n.m212x .sn-kv b{font-family:\"JetBrains Mono\",\"DejaVu Sans Mono\",monospace;font-size:15px;color:#e6edf3;word-break:break-all}\n.m212x .sn-err{color:var(--red);display:none;margin-top:8px}\n.m212x .sn-tw{overflow-x:auto;-webkit-overflow-scrolling:touch}.m212x .sn-tw table{min-width:560px}\n.m212x .sn-head{display:flex;justify-content:space-between;align-items:center;gap:10px;flex-wrap:wrap}\n.m212x textarea{width:100%;min-height:150px;background:#060a0f;color:var(--ink);border:1px solid var(--line2);border-radius:8px;padding:12px 14px;font:14px\/1.5 \"JetBrains Mono\",\"DejaVu Sans Mono\",monospace}\n.m212x select{background:#060a0f;color:var(--ink);border:1px solid var(--line2);border-radius:8px;padding:10px 12px;font-size:15px;font-family:inherit}\n.m212x .verdict{display:flex;gap:16px;align-items:center;flex-wrap:wrap;background:#060a0f;border:1px solid var(--line2);border-radius:12px;padding:16px 18px;margin:16px 0 12px}\n.m212x .big{font-size:52px;font-weight:800;line-height:1;min-width:80px}\n.m212x .fl{padding:10px 2px;border-bottom:1px solid var(--line);display:flex;gap:10px}.m212x .fl span{flex:none}\n.m212x .rec{background:#060a0f;border:1px solid var(--line2);border-radius:10px;padding:12px 14px;margin:8px 0}\n.m212x .rec b{display:block;margin-bottom:4px}.m212x .rec pre{margin:6px 0 0;white-space:pre-wrap;word-break:break-all}\n.m212x .meter{height:10px;border-radius:99px;background:#1a2733;overflow:hidden;margin:8px 0}.m212x .meter i{display:block;height:100%;width:0;border-radius:99px;transition:width .25s}\n<\/style>\n<style>.m212x #m212pltab td{vertical-align:top}.m212x #m212pltab tr.hid{display:none}.m212x .sn-tw table{min-width:720px}\n.m212x .pl-f{display:flex;gap:6px;flex-wrap:wrap;margin:10px 0}.m212x .pl-f button{padding:6px 12px;font-size:13.5px}.m212x .pl-f button.on{background:rgba(60,200,240,.15);border-color:var(--cyan);color:#bfe9ff}<\/style>\n<section class=\"sec\" id=\"m212pl-tool\"><h3>Search ports<\/h3>\n<input type=\"search\" id=\"m212plq\" placeholder=\"Search by port number or name, e.g. 3389, smb, database, vpn\" aria-label=\"Search ports\" spellcheck=\"false\" autocomplete=\"off\">\n<div class=\"pl-f\"><span class=\"small\" style=\"align-self:center\">Risk:<\/span><button type=\"button\" data-f=\"\" class=\"on\">All<\/button><button type=\"button\" data-f=\"c\">Critical<\/button><button type=\"button\" data-f=\"h\">High<\/button><button type=\"button\" data-f=\"m\">Medium<\/button><button type=\"button\" data-f=\"l\">Low<\/button><\/div>\n<p class=\"small\" id=\"m212plcount\"><\/p>\n<div class=\"sn-tw\"><table id=\"m212pltab\"><tr><th>Port<\/th><th>Protocol<\/th><th>Service<\/th><th>Internet exposure risk<\/th><th>What to do<\/th><\/tr><tr data-s=\"20-21 tcp ftp (data \/ control) sends credentials and files in clear text. replace with sftp or ftps; never expose to the internet.\" data-r=\"h\"><td class=\"mono\"><b>20-21<\/b><\/td><td>TCP<\/td><td><b>FTP (data \/ control)<\/b><\/td><td><span class=\"pill p-h\">High<\/span><\/td><td>Sends credentials and files in clear text. Replace with SFTP or FTPS; never expose to the internet.<\/td><\/tr><tr data-s=\"22 tcp ssh, sftp, scp secure remote admin, but constantly brute-forced. use keys, disable root and password login, restrict by source ip or vpn.\" data-r=\"m\"><td class=\"mono\"><b>22<\/b><\/td><td>TCP<\/td><td><b>SSH, SFTP, SCP<\/b><\/td><td><span class=\"pill p-m\">Medium<\/span><\/td><td>Secure remote admin, but constantly brute-forced. Use keys, disable root and password login, restrict by source IP or VPN.<\/td><\/tr><tr data-s=\"23 tcp telnet clear-text remote login. disable it on every device and use ssh. a favourite target of iot botnets such as mirai.\" data-r=\"c\"><td class=\"mono\"><b>23<\/b><\/td><td>TCP<\/td><td><b>Telnet<\/b><\/td><td><span class=\"pill p-c\">Critical if exposed<\/span><\/td><td>Clear-text remote login. Disable it on every device and use SSH. A favourite target of IoT botnets such as Mirai.<\/td><\/tr><tr data-s=\"25 tcp smtp (server-to-server mail) needed by mail servers only. block outbound 25 from user networks to stop spam bots; prevent open relaying.\" data-r=\"m\"><td class=\"mono\"><b>25<\/b><\/td><td>TCP<\/td><td><b>SMTP (server-to-server mail)<\/b><\/td><td><span class=\"pill p-m\">Medium<\/span><\/td><td>Needed by mail servers only. Block outbound 25 from user networks to stop spam bots; prevent open relaying.<\/td><\/tr><tr data-s=\"49 tcp tacacs+ network device aaa. keep on the management network; it encrypts only the payload.\" data-r=\"m\"><td class=\"mono\"><b>49<\/b><\/td><td>TCP<\/td><td><b>TACACS+<\/b><\/td><td><span class=\"pill p-m\">Medium<\/span><\/td><td>Network device AAA. Keep on the management network; it encrypts only the payload.<\/td><\/tr><tr data-s=\"53 tcp\/udp dns only resolvers and authoritative servers should answer. open resolvers are abused for ddos amplification.\" data-r=\"m\"><td class=\"mono\"><b>53<\/b><\/td><td>TCP\/UDP<\/td><td><b>DNS<\/b><\/td><td><span class=\"pill p-m\">Medium<\/span><\/td><td>Only resolvers and authoritative servers should answer. Open resolvers are abused for DDoS amplification.<\/td><\/tr><tr data-s=\"67-68 udp dhcp server \/ client lan only. protect against rogue dhcp servers with dhcp snooping.\" data-r=\"l\"><td class=\"mono\"><b>67-68<\/b><\/td><td>UDP<\/td><td><b>DHCP server \/ client<\/b><\/td><td><span class=\"pill p-l\">Low<\/span><\/td><td>LAN only. Protect against rogue DHCP servers with DHCP snooping.<\/td><\/tr><tr data-s=\"69 udp tftp no authentication at all. used for device images and ip-phone configs \u2014 restrict tightly, never internet-facing.\" data-r=\"h\"><td class=\"mono\"><b>69<\/b><\/td><td>UDP<\/td><td><b>TFTP<\/b><\/td><td><span class=\"pill p-h\">High<\/span><\/td><td>No authentication at all. Used for device images and IP-phone configs \u2014 restrict tightly, never internet-facing.<\/td><\/tr><tr data-s=\"80 tcp http unencrypted web. redirect to https. device admin pages on port 80 should be disabled or restricted.\" data-r=\"m\"><td class=\"mono\"><b>80<\/b><\/td><td>TCP<\/td><td><b>HTTP<\/b><\/td><td><span class=\"pill p-m\">Medium<\/span><\/td><td>Unencrypted web. Redirect to HTTPS. Device admin pages on port 80 should be disabled or restricted.<\/td><\/tr><tr data-s=\"88 tcp\/udp kerberos active directory authentication. internal only; never expose domain controllers.\" data-r=\"h\"><td class=\"mono\"><b>88<\/b><\/td><td>TCP\/UDP<\/td><td><b>Kerberos<\/b><\/td><td><span class=\"pill p-h\">High<\/span><\/td><td>Active Directory authentication. Internal only; never expose domain controllers.<\/td><\/tr><tr data-s=\"110 tcp pop3 clear-text mailbox access. use pop3s (995) or imaps (993).\" data-r=\"h\"><td class=\"mono\"><b>110<\/b><\/td><td>TCP<\/td><td><b>POP3<\/b><\/td><td><span class=\"pill p-h\">High<\/span><\/td><td>Clear-text mailbox access. Use POP3S (995) or IMAPS (993).<\/td><\/tr><tr data-s=\"111 tcp\/udp rpcbind \/ portmapper reveals rpc services and is used in ddos amplification. block at the perimeter.\" data-r=\"h\"><td class=\"mono\"><b>111<\/b><\/td><td>TCP\/UDP<\/td><td><b>RPCbind \/ portmapper<\/b><\/td><td><span class=\"pill p-h\">High<\/span><\/td><td>Reveals RPC services and is used in DDoS amplification. Block at the perimeter.<\/td><\/tr><tr data-s=\"123 udp ntp time sync. disable monlist; public ntp servers have been abused for amplification attacks.\" data-r=\"m\"><td class=\"mono\"><b>123<\/b><\/td><td>UDP<\/td><td><b>NTP<\/b><\/td><td><span class=\"pill p-m\">Medium<\/span><\/td><td>Time sync. Disable monlist; public NTP servers have been abused for amplification attacks.<\/td><\/tr><tr data-s=\"135 tcp microsoft rpc endpoint mapper windows rpc. never expose to the internet; heavily targeted by worms.\" data-r=\"c\"><td class=\"mono\"><b>135<\/b><\/td><td>TCP<\/td><td><b>Microsoft RPC endpoint mapper<\/b><\/td><td><span class=\"pill p-c\">Critical if exposed<\/span><\/td><td>Windows RPC. Never expose to the internet; heavily targeted by worms.<\/td><\/tr><tr data-s=\"137-139 tcp\/udp netbios legacy windows file sharing and name service. block at the perimeter; disable where not needed.\" data-r=\"c\"><td class=\"mono\"><b>137-139<\/b><\/td><td>TCP\/UDP<\/td><td><b>NetBIOS<\/b><\/td><td><span class=\"pill p-c\">Critical if exposed<\/span><\/td><td>Legacy Windows file sharing and name service. Block at the perimeter; disable where not needed.<\/td><\/tr><tr data-s=\"143 tcp imap clear-text mailbox access. use imaps (993).\" data-r=\"h\"><td class=\"mono\"><b>143<\/b><\/td><td>TCP<\/td><td><b>IMAP<\/b><\/td><td><span class=\"pill p-h\">High<\/span><\/td><td>Clear-text mailbox access. Use IMAPS (993).<\/td><\/tr><tr data-s=\"161-162 udp snmp \/ snmp traps v1\/v2c send community strings in clear text; &#x27;public&#x27; defaults are common. use snmpv3 and restrict by acl.\" data-r=\"h\"><td class=\"mono\"><b>161-162<\/b><\/td><td>UDP<\/td><td><b>SNMP \/ SNMP traps<\/b><\/td><td><span class=\"pill p-h\">High<\/span><\/td><td>v1\/v2c send community strings in clear text; &#x27;public&#x27; defaults are common. Use SNMPv3 and restrict by ACL.<\/td><\/tr><tr data-s=\"179 tcp bgp only to configured peers. protect with tcp-ao or md5, gtsm (ttl security) and prefix filters.\" data-r=\"m\"><td class=\"mono\"><b>179<\/b><\/td><td>TCP<\/td><td><b>BGP<\/b><\/td><td><span class=\"pill p-m\">Medium<\/span><\/td><td>Only to configured peers. Protect with TCP-AO or MD5, GTSM (TTL security) and prefix filters.<\/td><\/tr><tr data-s=\"389 tcp\/udp ldap directory queries, often in clear text. use ldaps (636) or ldap with starttls and signing; never internet-facing.\" data-r=\"h\"><td class=\"mono\"><b>389<\/b><\/td><td>TCP\/UDP<\/td><td><b>LDAP<\/b><\/td><td><span class=\"pill p-h\">High<\/span><\/td><td>Directory queries, often in clear text. Use LDAPS (636) or LDAP with StartTLS and signing; never internet-facing.<\/td><\/tr><tr data-s=\"443 tcp https encrypted web. keep tls 1.2+ only. vpn and firewall admin portals on 443 are prime targets \u2014 patch fast and add mfa.\" data-r=\"l\"><td class=\"mono\"><b>443<\/b><\/td><td>TCP<\/td><td><b>HTTPS<\/b><\/td><td><span class=\"pill p-l\">Low<\/span><\/td><td>Encrypted web. Keep TLS 1.2+ only. VPN and firewall admin portals on 443 are prime targets \u2014 patch fast and add MFA.<\/td><\/tr><tr data-s=\"445 tcp smb (windows file sharing) exploited by wannacry and notpetya (eternalblue). never expose to the internet; disable smbv1; require signing.\" data-r=\"c\"><td class=\"mono\"><b>445<\/b><\/td><td>TCP<\/td><td><b>SMB (Windows file sharing)<\/b><\/td><td><span class=\"pill p-c\">Critical if exposed<\/span><\/td><td>Exploited by WannaCry and NotPetya (EternalBlue). Never expose to the internet; disable SMBv1; require signing.<\/td><\/tr><tr data-s=\"465 tcp smtps (implicit tls submission) authenticated mail submission over tls.\" data-r=\"l\"><td class=\"mono\"><b>465<\/b><\/td><td>TCP<\/td><td><b>SMTPS (implicit TLS submission)<\/b><\/td><td><span class=\"pill p-l\">Low<\/span><\/td><td>Authenticated mail submission over TLS.<\/td><\/tr><tr data-s=\"500 udp ike (ipsec vpn) vpn key exchange. use ikev2 with strong proposals; disable aggressive mode.\" data-r=\"m\"><td class=\"mono\"><b>500<\/b><\/td><td>UDP<\/td><td><b>IKE (IPsec VPN)<\/b><\/td><td><span class=\"pill p-m\">Medium<\/span><\/td><td>VPN key exchange. Use IKEv2 with strong proposals; disable aggressive mode.<\/td><\/tr><tr data-s=\"502 tcp modbus industrial control protocol with no authentication. must never be reachable from the internet.\" data-r=\"c\"><td class=\"mono\"><b>502<\/b><\/td><td>TCP<\/td><td><b>Modbus<\/b><\/td><td><span class=\"pill p-c\">Critical if exposed<\/span><\/td><td>Industrial control protocol with no authentication. Must never be reachable from the internet.<\/td><\/tr><tr data-s=\"514 udp syslog clear text and spoofable. send logs over tls (6514) where possible and restrict senders.\" data-r=\"m\"><td class=\"mono\"><b>514<\/b><\/td><td>UDP<\/td><td><b>Syslog<\/b><\/td><td><span class=\"pill p-m\">Medium<\/span><\/td><td>Clear text and spoofable. Send logs over TLS (6514) where possible and restrict senders.<\/td><\/tr><tr data-s=\"587 tcp smtp submission (starttls) authenticated client mail submission. require tls and mfa-capable accounts.\" data-r=\"l\"><td class=\"mono\"><b>587<\/b><\/td><td>TCP<\/td><td><b>SMTP submission (STARTTLS)<\/b><\/td><td><span class=\"pill p-l\">Low<\/span><\/td><td>Authenticated client mail submission. Require TLS and MFA-capable accounts.<\/td><\/tr><tr data-s=\"623 udp ipmi \/ bmc server out-of-band management with known authentication flaws. isolate on a management network.\" data-r=\"c\"><td class=\"mono\"><b>623<\/b><\/td><td>UDP<\/td><td><b>IPMI \/ BMC<\/b><\/td><td><span class=\"pill p-c\">Critical if exposed<\/span><\/td><td>Server out-of-band management with known authentication flaws. Isolate on a management network.<\/td><\/tr><tr data-s=\"636 tcp ldaps ldap over tls. internal only.\" data-r=\"m\"><td class=\"mono\"><b>636<\/b><\/td><td>TCP<\/td><td><b>LDAPS<\/b><\/td><td><span class=\"pill p-m\">Medium<\/span><\/td><td>LDAP over TLS. Internal only.<\/td><\/tr><tr data-s=\"853 tcp dns over tls encrypted dns. watch for it if you rely on dns filtering.\" data-r=\"l\"><td class=\"mono\"><b>853<\/b><\/td><td>TCP<\/td><td><b>DNS over TLS<\/b><\/td><td><span class=\"pill p-l\">Low<\/span><\/td><td>Encrypted DNS. Watch for it if you rely on DNS filtering.<\/td><\/tr><tr data-s=\"873 tcp rsync frequently left open without authentication, leaking data. tunnel over ssh.\" data-r=\"h\"><td class=\"mono\"><b>873<\/b><\/td><td>TCP<\/td><td><b>rsync<\/b><\/td><td><span class=\"pill p-h\">High<\/span><\/td><td>Frequently left open without authentication, leaking data. Tunnel over SSH.<\/td><\/tr><tr data-s=\"989-990 tcp ftps ftp over tls. better than ftp, but sftp is simpler to firewall.\" data-r=\"m\"><td class=\"mono\"><b>989-990<\/b><\/td><td>TCP<\/td><td><b>FTPS<\/b><\/td><td><span class=\"pill p-m\">Medium<\/span><\/td><td>FTP over TLS. Better than FTP, but SFTP is simpler to firewall.<\/td><\/tr><tr data-s=\"993 tcp imaps encrypted mailbox access. enforce mfa or modern authentication.\" data-r=\"l\"><td class=\"mono\"><b>993<\/b><\/td><td>TCP<\/td><td><b>IMAPS<\/b><\/td><td><span class=\"pill p-l\">Low<\/span><\/td><td>Encrypted mailbox access. Enforce MFA or modern authentication.<\/td><\/tr><tr data-s=\"995 tcp pop3s encrypted pop3.\" data-r=\"l\"><td class=\"mono\"><b>995<\/b><\/td><td>TCP<\/td><td><b>POP3S<\/b><\/td><td><span class=\"pill p-l\">Low<\/span><\/td><td>Encrypted POP3.<\/td><\/tr><tr data-s=\"1080 tcp socks proxy open proxies are abused to hide attackers&#x27; traffic. require authentication or close.\" data-r=\"h\"><td class=\"mono\"><b>1080<\/b><\/td><td>TCP<\/td><td><b>SOCKS proxy<\/b><\/td><td><span class=\"pill p-h\">High<\/span><\/td><td>Open proxies are abused to hide attackers&#x27; traffic. Require authentication or close.<\/td><\/tr><tr data-s=\"1194 udp openvpn vpn. keep patched and use certificate plus mfa authentication.\" data-r=\"m\"><td class=\"mono\"><b>1194<\/b><\/td><td>UDP<\/td><td><b>OpenVPN<\/b><\/td><td><span class=\"pill p-m\">Medium<\/span><\/td><td>VPN. Keep patched and use certificate plus MFA authentication.<\/td><\/tr><tr data-s=\"1433 tcp microsoft sql server databases must not be internet-facing. brute-forced and exploited constantly.\" data-r=\"c\"><td class=\"mono\"><b>1433<\/b><\/td><td>TCP<\/td><td><b>Microsoft SQL Server<\/b><\/td><td><span class=\"pill p-c\">Critical if exposed<\/span><\/td><td>Databases must not be internet-facing. Brute-forced and exploited constantly.<\/td><\/tr><tr data-s=\"1521 tcp oracle database listener internal only.\" data-r=\"c\"><td class=\"mono\"><b>1521<\/b><\/td><td>TCP<\/td><td><b>Oracle database listener<\/b><\/td><td><span class=\"pill p-c\">Critical if exposed<\/span><\/td><td>Internal only.<\/td><\/tr><tr data-s=\"1645-1646, 1812-1813 udp radius aaa for vpn, wi-fi (802.1x) and network devices. use strong shared secrets or radsec.\" data-r=\"m\"><td class=\"mono\"><b>1645-1646, 1812-1813<\/b><\/td><td>UDP<\/td><td><b>RADIUS<\/b><\/td><td><span class=\"pill p-m\">Medium<\/span><\/td><td>AAA for VPN, Wi-Fi (802.1X) and network devices. Use strong shared secrets or RadSec.<\/td><\/tr><tr data-s=\"1723 tcp pptp vpn pptp\/ms-chapv2 is cryptographically broken. replace with ikev2\/ipsec, wireguard or ssl vpn.\" data-r=\"c\"><td class=\"mono\"><b>1723<\/b><\/td><td>TCP<\/td><td><b>PPTP VPN<\/b><\/td><td><span class=\"pill p-c\">Critical if exposed<\/span><\/td><td>PPTP\/MS-CHAPv2 is cryptographically broken. Replace with IKEv2\/IPsec, WireGuard or SSL VPN.<\/td><\/tr><tr data-s=\"1883 tcp mqtt iot messaging, often without authentication. use 8883 with tls and credentials.\" data-r=\"h\"><td class=\"mono\"><b>1883<\/b><\/td><td>TCP<\/td><td><b>MQTT<\/b><\/td><td><span class=\"pill p-h\">High<\/span><\/td><td>IoT messaging, often without authentication. Use 8883 with TLS and credentials.<\/td><\/tr><tr data-s=\"2049 tcp\/udp nfs network file system. internal only, with export restrictions.\" data-r=\"h\"><td class=\"mono\"><b>2049<\/b><\/td><td>TCP\/UDP<\/td><td><b>NFS<\/b><\/td><td><span class=\"pill p-h\">High<\/span><\/td><td>Network file system. Internal only, with export restrictions.<\/td><\/tr><tr data-s=\"2375-2376 tcp docker api port 2375 is the unauthenticated docker api \u2014 full control of the host. never expose; use 2376 with mutual tls.\" data-r=\"c\"><td class=\"mono\"><b>2375-2376<\/b><\/td><td>TCP<\/td><td><b>Docker API<\/b><\/td><td><span class=\"pill p-c\">Critical if exposed<\/span><\/td><td>Port 2375 is the unauthenticated Docker API \u2014 full control of the host. Never expose; use 2376 with mutual TLS.<\/td><\/tr><tr data-s=\"3128 tcp squid \/ http proxy open proxies are abused. require authentication.\" data-r=\"h\"><td class=\"mono\"><b>3128<\/b><\/td><td>TCP<\/td><td><b>Squid \/ HTTP proxy<\/b><\/td><td><span class=\"pill p-h\">High<\/span><\/td><td>Open proxies are abused. Require authentication.<\/td><\/tr><tr data-s=\"3306 tcp mysql \/ mariadb databases must not be internet-facing.\" data-r=\"c\"><td class=\"mono\"><b>3306<\/b><\/td><td>TCP<\/td><td><b>MySQL \/ MariaDB<\/b><\/td><td><span class=\"pill p-c\">Critical if exposed<\/span><\/td><td>Databases must not be internet-facing.<\/td><\/tr><tr data-s=\"3389 tcp\/udp rdp (remote desktop) a leading ransomware entry point. never expose directly; put it behind a vpn or gateway with mfa and enable nla.\" data-r=\"c\"><td class=\"mono\"><b>3389<\/b><\/td><td>TCP\/UDP<\/td><td><b>RDP (Remote Desktop)<\/b><\/td><td><span class=\"pill p-c\">Critical if exposed<\/span><\/td><td>A leading ransomware entry point. Never expose directly; put it behind a VPN or gateway with MFA and enable NLA.<\/td><\/tr><tr data-s=\"4500 udp ipsec nat traversal part of ipsec vpns (with udp 500).\" data-r=\"m\"><td class=\"mono\"><b>4500<\/b><\/td><td>UDP<\/td><td><b>IPsec NAT traversal<\/b><\/td><td><span class=\"pill p-m\">Medium<\/span><\/td><td>Part of IPsec VPNs (with UDP 500).<\/td><\/tr><tr data-s=\"4786 tcp cisco smart install unauthenticated; abused by nation-state actors to take over switches. disable with &#x27;no vstack&#x27;.\" data-r=\"c\"><td class=\"mono\"><b>4786<\/b><\/td><td>TCP<\/td><td><b>Cisco Smart Install<\/b><\/td><td><span class=\"pill p-c\">Critical if exposed<\/span><\/td><td>Unauthenticated; abused by nation-state actors to take over switches. Disable with &#x27;no vstack&#x27;.<\/td><\/tr><tr data-s=\"5060-5061 tcp\/udp sip (voip) targeted for toll fraud. use 5061 (tls), strong passwords and a session border controller.\" data-r=\"h\"><td class=\"mono\"><b>5060-5061<\/b><\/td><td>TCP\/UDP<\/td><td><b>SIP (VoIP)<\/b><\/td><td><span class=\"pill p-h\">High<\/span><\/td><td>Targeted for toll fraud. Use 5061 (TLS), strong passwords and a session border controller.<\/td><\/tr><tr data-s=\"5432 tcp postgresql databases must not be internet-facing.\" data-r=\"c\"><td class=\"mono\"><b>5432<\/b><\/td><td>TCP<\/td><td><b>PostgreSQL<\/b><\/td><td><span class=\"pill p-c\">Critical if exposed<\/span><\/td><td>Databases must not be internet-facing.<\/td><\/tr><tr data-s=\"5800, 5900 tcp vnc remote desktop, often with weak or no passwords. tunnel through a vpn or ssh.\" data-r=\"c\"><td class=\"mono\"><b>5800, 5900<\/b><\/td><td>TCP<\/td><td><b>VNC<\/b><\/td><td><span class=\"pill p-c\">Critical if exposed<\/span><\/td><td>Remote desktop, often with weak or no passwords. Tunnel through a VPN or SSH.<\/td><\/tr><tr data-s=\"5985-5986 tcp winrm (powershell remoting) windows remote management. internal only; prefer https (5986).\" data-r=\"h\"><td class=\"mono\"><b>5985-5986<\/b><\/td><td>TCP<\/td><td><b>WinRM (PowerShell remoting)<\/b><\/td><td><span class=\"pill p-h\">High<\/span><\/td><td>Windows remote management. Internal only; prefer HTTPS (5986).<\/td><\/tr><tr data-s=\"6379 tcp redis often deployed without authentication; mass-exploited for cryptomining. bind to localhost or require auth.\" data-r=\"c\"><td class=\"mono\"><b>6379<\/b><\/td><td>TCP<\/td><td><b>Redis<\/b><\/td><td><span class=\"pill p-c\">Critical if exposed<\/span><\/td><td>Often deployed without authentication; mass-exploited for cryptomining. Bind to localhost or require auth.<\/td><\/tr><tr data-s=\"6514 tcp syslog over tls encrypted log transport.\" data-r=\"l\"><td class=\"mono\"><b>6514<\/b><\/td><td>TCP<\/td><td><b>Syslog over TLS<\/b><\/td><td><span class=\"pill p-l\">Low<\/span><\/td><td>Encrypted log transport.<\/td><\/tr><tr data-s=\"8080, 8443 tcp alternate http \/ https often admin panels, proxies or dev servers. inventory what is listening and restrict.\" data-r=\"m\"><td class=\"mono\"><b>8080, 8443<\/b><\/td><td>TCP<\/td><td><b>Alternate HTTP \/ HTTPS<\/b><\/td><td><span class=\"pill p-m\">Medium<\/span><\/td><td>Often admin panels, proxies or dev servers. Inventory what is listening and restrict.<\/td><\/tr><tr data-s=\"8291 tcp mikrotik winbox router management, targeted by botnets. restrict to management networks.\" data-r=\"c\"><td class=\"mono\"><b>8291<\/b><\/td><td>TCP<\/td><td><b>MikroTik Winbox<\/b><\/td><td><span class=\"pill p-c\">Critical if exposed<\/span><\/td><td>Router management, targeted by botnets. Restrict to management networks.<\/td><\/tr><tr data-s=\"8883 tcp mqtt over tls secure iot messaging; still require client authentication.\" data-r=\"m\"><td class=\"mono\"><b>8883<\/b><\/td><td>TCP<\/td><td><b>MQTT over TLS<\/b><\/td><td><span class=\"pill p-m\">Medium<\/span><\/td><td>Secure IoT messaging; still require client authentication.<\/td><\/tr><tr data-s=\"9100 tcp raw printing (jetdirect) printers accept jobs and sometimes commands with no authentication. internal only.\" data-r=\"h\"><td class=\"mono\"><b>9100<\/b><\/td><td>TCP<\/td><td><b>Raw printing (JetDirect)<\/b><\/td><td><span class=\"pill p-h\">High<\/span><\/td><td>Printers accept jobs and sometimes commands with no authentication. Internal only.<\/td><\/tr><tr data-s=\"9200 tcp elasticsearch behind thousands of data leaks. never expose; enable security features.\" data-r=\"c\"><td class=\"mono\"><b>9200<\/b><\/td><td>TCP<\/td><td><b>Elasticsearch<\/b><\/td><td><span class=\"pill p-c\">Critical if exposed<\/span><\/td><td>Behind thousands of data leaks. Never expose; enable security features.<\/td><\/tr><tr data-s=\"10000 tcp webmin \/ ndmp server admin panels. restrict and patch.\" data-r=\"h\"><td class=\"mono\"><b>10000<\/b><\/td><td>TCP<\/td><td><b>Webmin \/ NDMP<\/b><\/td><td><span class=\"pill p-h\">High<\/span><\/td><td>Server admin panels. Restrict and patch.<\/td><\/tr><tr data-s=\"11211 udp\/tcp memcached used for record-breaking ddos amplification. disable udp and never expose.\" data-r=\"c\"><td class=\"mono\"><b>11211<\/b><\/td><td>UDP\/TCP<\/td><td><b>Memcached<\/b><\/td><td><span class=\"pill p-c\">Critical if exposed<\/span><\/td><td>Used for record-breaking DDoS amplification. Disable UDP and never expose.<\/td><\/tr><tr data-s=\"20000 tcp dnp3 utility\/scada protocol. isolate in the ot network.\" data-r=\"c\"><td class=\"mono\"><b>20000<\/b><\/td><td>TCP<\/td><td><b>DNP3<\/b><\/td><td><span class=\"pill p-c\">Critical if exposed<\/span><\/td><td>Utility\/SCADA protocol. Isolate in the OT network.<\/td><\/tr><tr data-s=\"27017 tcp mongodb exposed instances have been wiped and ransomed by the thousand. require auth and bind internally.\" data-r=\"c\"><td class=\"mono\"><b>27017<\/b><\/td><td>TCP<\/td><td><b>MongoDB<\/b><\/td><td><span class=\"pill p-c\">Critical if exposed<\/span><\/td><td>Exposed instances have been wiped and ransomed by the thousand. Require auth and bind internally.<\/td><\/tr><tr data-s=\"44818 tcp\/udp ethernet\/ip (cip) industrial automation protocol. isolate in the ot network.\" data-r=\"c\"><td class=\"mono\"><b>44818<\/b><\/td><td>TCP\/UDP<\/td><td><b>EtherNet\/IP (CIP)<\/b><\/td><td><span class=\"pill p-c\">Critical if exposed<\/span><\/td><td>Industrial automation protocol. Isolate in the OT network.<\/td><\/tr><tr data-s=\"47808 udp bacnet building automation (hvac, access control). never internet-facing.\" data-r=\"c\"><td class=\"mono\"><b>47808<\/b><\/td><td>UDP<\/td><td><b>BACnet<\/b><\/td><td><span class=\"pill p-c\">Critical if exposed<\/span><\/td><td>Building automation (HVAC, access control). Never internet-facing.<\/td><\/tr><tr data-s=\"51820 udp wireguard modern vpn. keep keys protected and rotate when staff leave.\" data-r=\"l\"><td class=\"mono\"><b>51820<\/b><\/td><td>UDP<\/td><td><b>WireGuard<\/b><\/td><td><span class=\"pill p-l\">Low<\/span><\/td><td>Modern VPN. Keep keys protected and rotate when staff leave.<\/td><\/tr><\/table><\/div>\n<p class=\"small\" id=\"m212plnone\" style=\"display:none;margin-top:10px\">No match in our list. Check the <a href=\"https:\/\/www.iana.org\/assignments\/service-names-port-numbers\/service-names-port-numbers.xhtml\" target=\"_blank\" rel=\"noopener\">IANA port registry<\/a> \u2014 and remember that any service can run on any port.<\/p><\/section>\n<section class=\"sec\" id=\"m212pl-how\"><h3>How to use this<\/h3><ul class=\"l\"><li><b>&#8220;Critical if exposed&#8221;<\/b> means the service should never be reachable from the internet. If a scan shows it open externally, treat it as an incident until proven otherwise.<\/li><li>Find what&#8217;s open with the <a href=\"\/tools\/nmap-command-builder\/\">Nmap command builder<\/a> (on networks you&#8217;re authorised to scan), then look each port up here.<\/li><li>Default-deny inbound at the firewall and open only what has a documented business need and an owner.<\/li><li>Port numbers are conventions: attackers and admins run services on non-standard ports, so use <code>nmap -sV<\/code> to identify what is really listening.<\/li><\/ul><\/section>\n<p class=\"small noprint\" style=\"margin:-8px 0 18px;padding:0 4px\">\u2696\ufe0f For education and use on systems you own or are authorised to test. Results are automated guidance, not a professional audit. See our <a href=\"\/terms-of-use\/\">terms of use<\/a> and <a href=\"\/privacy-policy\/\">privacy policy<\/a>.<\/p>\n<div class=\"help\"><div><div class=\"kick\" style=\"margin-bottom:4px\">Need expert help?<\/div>\n<p style=\"font-size:17px;margin:0\"><b>MAG212 CYBER<\/b> offers network and cybersecurity consultation, plus security seminars for organisations around the world.<\/p><\/div>\n<a class=\"cta\" href=\"\/services\/\">Explore our services \u2192<\/a><\/div>\n<script>\n(function(){\nvar root=document.getElementById('m212-port-lookup'); if(!root) return;\nvar q=document.getElementById('m212plq'), rows=root.querySelectorAll('#m212pltab tr[data-s]'), f='';\nfunction inRange(port,spec){ return spec.split(',').some(function(part){ var p=part.trim().split('-'); var a=parseInt(p[0],10), b=p.length>1?parseInt(p[1],10):a; return port>=a ? port<=b : false; }); }\nfunction filt(){\n  var t=q.value.trim().toLowerCase(), n=0, num=\/^\\d{1,5}$\/.test(t);\n  Array.prototype.forEach.call(rows,function(r){ var ok=true; if(t){ ok=num ? inRange(+t,r.firstChild.textContent) : r.getAttribute('data-s').indexOf(t)>-1; } if(f) if(r.getAttribute('data-r')!==f) ok=false; r.classList.toggle('hid',!ok); if(ok) n++; });\n  document.getElementById('m212plcount').textContent=n+' of '+rows.length+' ports';\n  document.getElementById('m212plnone').style.display=n?'none':'block';\n}\nq.addEventListener('input',filt);\nArray.prototype.forEach.call(root.querySelectorAll('[data-f]'),function(b){ b.addEventListener('click',function(){ f=b.getAttribute('data-f'); Array.prototype.forEach.call(root.querySelectorAll('[data-f]'),function(x){ x.classList.toggle('on',x===b); }); filt(); }); });\nfilt();\n})();\n<\/script>\n<\/div>\n\n","protected":false},"excerpt":{"rendered":"<p>MAG212 CYBER \u00b7 Tools Port &amp; protocol lookup. What is running on port 3389, and should it be open to the internet? Search 65 common ports for the service, the exposure risk and how to secure it. Search portsHow to use this Search ports Risk:AllCriticalHighMediumLow Port Protocol Service Internet exposure risk What to do 20-21 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":3386,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-3463","page","type-page","status-publish","hentry"],"_hostinger_reach_plugin_has_subscription_block":false,"_hostinger_reach_plugin_is_elementor":false,"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3463","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=3463"}],"version-history":[{"count":0,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3463\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3386"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=3463"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}