TCP / UDP Port Directory & Attack Surface Analyzer
Search over 1,000 standardized IANA port assignments, inspect CVE attack vectors, analyze open ports from scan outputs or configs, and generate tailored firewall rules.
tcpmux
TCP Port Service Multiplexer
rje
Remote Job Entry
echo
Echo
discard
Discard
systat
Active Users
daytime
Daytime
port-15
Unassigned [was netstat]
qotd
Quote of the Day
msp
Message Send Protocol (historic)
chargen
Character Generator
ftp-data
File Transfer [Default Data]
ftp
File Transfer Protocol [Control]
ssh
The Secure Shell (SSH) Protocol
telnet
Telnet
port-24
any private mail system
smtp
Simple Mail Transfer
nsw-fe
NSW User System FE
msg-icp
MSG ICP
msg-auth
MSG Authentication
dsp
Display Support Protocol
port-35
any private printer server
time
Time
rap
Route Access Protocol
rlp
Resource Location Protocol
graphics
Graphics
name
Host Name Server
nicname
Who Is
mpm-flags
MPM FLAGS Protocol
mpm
Message Processing Module [recv]
mpm-snd
MPM [default send]
auditd
Digital Audit Daemon
tacacs
Login Host Protocol (TACACS)
TCP & UDP Port Reference & Security FAQ
Essential networking fundamentals, port range taxonomy, and firewall defense strategies.
What is a TCP / UDP Port and how does assignment work?
In computer networking, a port is a 16-bit unsigned number (ranging from 0 to 65,535) that identifies a specific endpoint or application process on an operating system. The Internet Assigned Numbers Authority (IANA) coordinates standard port number assignments to prevent conflicts between common Internet services like HTTP, DNS, and SSH.
What port is 8080 and why is it used as an alternative to 80?
Port 8080 is the standard HTTP Alternate port. On Unix and Linux systems, ports below 1024 are privileged and require root or administrator access to bind to. Port 8080 allows developers and application servers (such as Apache Tomcat, Jenkins, Spring Boot, or local proxies) to host HTTP web applications without requiring root execution privileges.
What is the difference between Well-Known, Registered, and Dynamic Ports?
RFC 6335 establishes three standardized port ranges:
• Well-Known Ports (0–1023): Assigned to foundational network protocols (HTTP 80, SSH 22, DNS 53); requires system privileges.
• Registered Ports (1024–49151): Listed by IANA for specific vendor software and database daemons (MySQL 3306, Redis 6379, RDP 3389).
• Dynamic / Ephemeral Ports (49152–65535): Used temporarily by client operating systems for outbound sessions.
Which ports are most commonly targeted by automated ransomware and botnets?
The most actively probed attack surfaces on the public Internet include Port 445 (SMB, exploited by EternalBlue MS17-010), Port 3389 (RDP, targeted by credential brute-forcers), Port 23 (Telnet, hijacked by Mirai IoT botnets), and unauthenticated data stores like Port 6379 (Redis) and Port 27017 (MongoDB). These services should always be sequestered behind private VPC subnets or VPNs.