Indicia

Port reference for security

What runs on common ports, whether each should face the internet, the attacks it is known for and what it means when it shows up in your logs: RDP, SMB, SSH, Redis, Docker and more.

Runs in your browser. Nothing you paste is uploaded, stored or logged.

57 of 57 ports

PortServiceTransportInternet exposure
21FTPTCPRestrict
22SSHTCPRestrict
23TelnetTCPNever expose
25SMTPTCPPublic by design
53DNSTCP/UDPRestrict
69TFTPUDPNever expose
80HTTPTCPPublic by design
88KerberosTCP/UDPNever expose
110POP3TCPRestrict
123NTPUDPRestrict
135Microsoft RPC endpoint mapperTCPNever expose
137NetBIOS Name ServiceUDPNever expose
139NetBIOS Session (SMB over NetBIOS)TCPNever expose
143IMAPTCPRestrict
161SNMPUDPNever expose
389LDAPTCP/UDPNever expose
443HTTPSTCPPublic by design
445SMBTCPNever expose
465SMTPS (implicit TLS submission)TCPPublic by design
500IKE (IPsec VPN)UDPPublic by design
514SyslogUDPNever expose
587SMTP submissionTCPPublic by design
636LDAPSTCPNever expose
873rsyncTCPNever expose
993IMAPSTCPPublic by design
995POP3STCPPublic by design
1080SOCKS proxyTCPNever expose
1194OpenVPNUDPPublic by design
1433Microsoft SQL ServerTCPNever expose
1521Oracle Database listenerTCPNever expose
1723PPTP VPNTCPNever expose
1883MQTTTCPNever expose
1900SSDP / UPnPUDPNever expose
2049NFSTCP/UDPNever expose
2375Docker API (unencrypted)TCPNever expose
3128Squid HTTP proxyTCPNever expose
3268Active Directory Global CatalogTCPNever expose
3306MySQL / MariaDBTCPNever expose
3389RDPTCP/UDPNever expose
4444Metasploit default listenerTCPNever expose
4500IPsec NAT traversalUDPPublic by design
5060SIPTCP/UDPRestrict
5432PostgreSQLTCPNever expose
5601KibanaTCPNever expose
5900VNCTCPNever expose
5985WinRM (HTTP)TCPNever expose
6379RedisTCPNever expose
6443Kubernetes API serverTCPRestrict
8080HTTP alternateTCPRestrict
8443HTTPS alternateTCPRestrict
9050Tor SOCKS proxyTCPNever expose
9200ElasticsearchTCPNever expose
10250Kubernetes kubelet APITCPNever expose
11211MemcachedTCP/UDPNever expose
27017MongoDBTCPNever expose
50050Cobalt Strike team serverTCPNever expose
51820WireGuardUDPPublic by design

How it works

Firewall logs, IDS alerts and scan results all come down to ports. Each page covers what normally listens on a port, whether it should ever face the internet, the attacks it is known for and what it usually means when it appears in logs, written for analysts triaging alerts and for anyone reviewing what they expose.

Questions

Which ports should never be open to the internet?
Administrative and internal services: SMB (445), RDP (3389), WinRM (5985), Telnet (23), databases such as MySQL (3306), SQL Server (1433), PostgreSQL (5432), MongoDB (27017) and Redis (6379), and management APIs such as Docker (2375) and the Kubernetes kubelet (10250). Put them behind a VPN or restrict them to known networks.
Does traffic on a port prove which service it is?
No. Port numbers are conventions: any service can run on any port, and attackers often use common ones such as 443 to blend in. Treat the port as a starting point, and confirm with the protocol, the TLS certificate or the service banner.
What does “Restrict” mean here?
The service has legitimate remote uses, but should only be reachable from specific networks, through a VPN or with strong authentication, not from the whole internet.