[ Home | Contact Me ]




Any Port in a Datastorm

It seems like every day there is a new Internet service that uses some new set of poorly-documented, unregistered ports. I created this page to gather together all the information I could find about the ports used by these new services, for use by firewall administrators and other network monitors.

When a specific port is registered it is usually assigned for both TCP and UDP even though only one or the other may be required. Where possible I have only shown the required ones.

This is not intended to list old, well-documented services such as telnet, FTP etc. You can find these in the IANA list.

You may contact me by email with any suggestions or corrections, or post a message to the TCP/IP Ports discussion.

Ports for Internet Services

Service TCP UDP Notes
SSH 22 Secure Shell *
HTTP 80 HyperText Transfer Protocol * (e.g. for web browsing). Currently (2003-07-05) HTTP/1.1 is officially described in RFC 2616.
HOSTS2 Name Server 81 81 * An interesting story. The name attached to this port in the IANA list, Earl Killian, says he shouldn't be. He says "I don't know what 81 is, or whether it is still in use." Since Mr. Killian doesn't know what HOSTS2 is/was, and with Postel gone, I wonder if there's anyone left in the world who knows what 81 was/is for and who actually requested it.
XFER Utility 82 82 * Another interesting story. The name attached to this port in the IANA list, Thomas M. Smith of Lockheed Martin, says Sorry... there is no publicly available information regarding the details of the XFER Utility and its use of tcp and udp port # 82. XFER employs a proprietary protocol which has not been disclosed.
RPC Endpoint Mapper 135 135 * registered as "epmap - DCE endpoint resolution". Used by Microsoft for RPC locator service. See additional information.
LDAP 389 389 Lightweight Directory Access Protocol *
MS NetMeeting LDAP or ULP, dyn >=1024, 1503, H.323 HostCall, MS ICCP dyn >=1024 videoconferencing
Timbuktu 407, 1417-1420 407 remote control *
SLP 427 427 Service Location Protocol * Used by MacOS and NetWare.
HTTPs 443 secure HTTP (SSL) *
LPD / printer 515 515 printing * LPD stands for Line Printer Daemon. Also see printing section.
ULP 522 522 User Location Protocol (Microsoft) *
AppleTalk Filing Protocol (AFP) 548 548 *
QuickTime 4 RTSP RTP-QT4 streaming audio, video *
RTSP 554 Real Time Streaming Protocol *. Currently (2003-07-05) described in RFC 2326.
NNTPs 563 secure NNTP news (SSL) *
Internet Printing Protocol (IPP) 631 631 print remotely to any IPP enabled printer through the Internet * The Common Unix Printing System (CUPS) is based on IPP. Also see printing section.
LDAPs 636 636 secure LDAP * (LDAP protocol over TLS/SSL)
Doom 666 666 network game *
Remotely Possible (ControlIT) 799 remote control. CA ControlIT support.
VMware Virtual Machine Console 902 remote control and viewing of virtual machines. vmware-authd.
SOCKS 1080 internet proxy *. Also used by Trojans.
OpenVPN 1194 1194 *
Kazaa 1214 1214 peer-to-peer file sharing *
WASTE 1337 1337 peer-to-peer. Also see InfoAnarchy WASTE FAQ. This port is officially registered for Men and Mice DNS (QuickDNS Remote).
Lotus Notes Domino 1352 *
VocalTec Internet Phone 1490, 6670, 25793 22555 videoconferencing *
Citrix ICA 1494, dyn >=1023 1604, dyn >=1023 remote application access *
Virtual Places 1533 conferencing *, also see VP voice
Xing StreamWorks 1558 streaming video *
Novell GroupWise (Remote Client) 1677 1677 group collaboration * NOTE: Other features of GroupWise use many other ports.
H.323 Host Call 1720 1720 H.323 host call *
PPTP 1723 virtual private network (VPN) * Note PPTP also uses the GRE protocol. However Microsoft says in Understanding PPTP: "PPTP can be used with most firewalls and routers by enabling traffic destined for port 1723 to be routed through the firewall or router."
MS ICCP 1731 1731 audio call control (Microsoft) *
MS NetShow 1755 1755, dyn >=1024 <=5000 streaming video *
MSN Messenger 1863 instant messenging *. NOTE: For detailed info on ports for file transfers, voice and video, see the Windows and MSN Messenger section below.
Netopia netOctopus 1917, 1921 1917 network management *
Big Brother 1984 1984 network monitoring *
ICU II 2000-2003 videoconferencing. NOTE: security risk on TCP port 50000
iSpQ 2000-2003 videoconferencing. Note: support docs are inconsistent on what ports are required
glimpseserver 2001 search engine
Distributed.Net RC5/DES 2064 distributed computation
SoulSeek 2234, 5534 2234, 5534 file sharing
Microsoft DirectX gaming (DirectPlay) 7 2300-2400, 47624 2300-2400 networked multiplayer games, * only 47624 is registered as "Direct Play Server", if needed also see MSN Gaming Zone
Microsoft DirectX gaming (DirectPlay) 8 2302-2400, 6073 networked multiplayer games, * only 6073 is registered as DirectPlay8, if needed also see MSN Gaming Zone
MADCAP - Multicast Address Dynamic Client Allocation Protocol 2535 2535 * defined in RFC 2730 - Multicast Address Dynamic Client Allocation Protocol (MADCAP). Also used by Trojans.
Netrek 2592 network game *
ShareDirect 2705 2705 peer-to-peer (P2P) filesharing. Officially registered for Sun SDS Admin.
URBISNET 2745 2745 * Alex Tronin reports was used for Urbis geolocation service... now not operational, but may be revived. Also used by Trojans.
Borland Interbase database 3050 3050 * gds_db. See CERT Advisory CA-2001-01 for potential security risk.
squid 3128 3130 web proxy cache. Also used by Trojans.
iSNS 3205 3205 * Internet Storage Name Service, see iSCSI section
iSCSI default port 3260 3260 * SCSI over IP, see iSCSI section
Windows Remote Desktop Protocol (RDP) 3389 * registered as ms-wbt-server. RDP 5.1 is the current version. See below for more information. Remote Desktop Web Connection also uses HTTP.
NetworkLens SSL Event 3410 3410 * Also used by Trojans.
Virtual Places Voice Chat 3450, 8000-9000 voice chat, also see Virtual Places
Apple iTunes music sharing (DAAP) 3689 3689 Digital Audio Access Protocol *
World of Warcraft 3724 online game *
Mirabilis ICQ dyn >=1024 4000 locator, chat (note: see newer AOL ICQ)
Blizzard / Battle.net 4000, 6112-6119 4000, 6112-6119 network gaming - support (captured 2001-11-11), proxy and firewall info
Abacast 4000-4100, 4500, 9000-9100 peer-to-peer audio and video streaming. NOTE: This software will create OUTGOING streams to other users if it can.
GlobalChat client, server 4020 4020 chat rooms, used to be called ichat
PGPfone 4747 secure phone
PlayLink 4747, 4748, 10090 6144 online games
radmin 4899 4899 remote control *
Yahoo Messenger - Voice Chat 5000-5001 5000-5010 voice chat
GnomeMeeting H.323 HostCall, 30000-30010 5000-5003, 5010-5013 audio and videoconference. 5000-5003 is RTP and RTCP range for this app.
Yahoo Messenger - messages 5050 messaging. NOTE: It will try ports 5050, 80, any port.
SIP 5060 5060 Session Initiation Protocol *. For audio and video. Currently (2003-07-05) see RFCs 3261, 3262, 3263, 3264, 3265
Apple iChat AV SIP, RTP-iChatAV audio and video conferencing. May also need iChat local port.
Yahoo Messenger - Webcams 5100 video
AOL Instant Messenger (AIM) 5190 5190 America OnLine * Also used by Apple iChat (in AIM compatibility mode).
AIM Video IM 1024-5000 ? 1024-5000 ? video chat. It is unclear from their FAQ whether you need to open both TCP and UDP ports.
AOL ICQ 5190, dyn >=1024 messaging
AOL 5190-5193 5190-5193 America OnLine *
XMPP / Jabber 5222, 5269 5222, 5269 * Extensible Messaging and Presence Protocol. Also see Using Jabber behind firewalls. Defined by XMPP specs (RFCs now issued), specs created by IETF group.
Qnext 5235-5237 5235-5237 audio / video conference, fileshare, everything. Port 5236 is officially assigned to "padl2sim".
iChat local traffic 5298 5298 Some Rendezvous thing.
Multicast DNS 5353 5353 * Mac OS X 10.2: About Multicast DNS. Related to Zeroconf which Apple has implemented as Rendezvous. (Note: the regular Domain Name Service port is 53.)
Dialpad.com 5354, 7175, 8680-8890, 9000, 9450-9460 dyn >=1024 telephony
HotLine 5500-5503 peer-to-peer filesharing.
SGI ESP HTTP 5554 5554 * SGI Embedded Support Partner (ESP) web server. Also used by Trojans, see SGI Security Advisory 20040501-01-I.
InfoSeek Personal Agent 5555 5555 * I don't know if InfoSeek Personal Agent exists anymore. This port is commonly used by HP OpenView Storage Data Protector (formerly HP OmniBack).
pcAnywhere 5631 5632 remote control *
eShare Chat Server 5760
eShare Web Tour 5761
eShare Admin Server 5764
VNC 5800+, 5900+ remote control
Blizzard Battle.net 6112 6112 online gaming
GNUtella 6346, 6347 6346, 6347 peer-to-peer file sharing *
Netscape Conference H.323 HostCall, 6498, 6502 2327 audioconferencing
Danware NetOp Remote Control 6502 6502 remote control
common IRC 6665-6669 Internet Relay Chat *
Net2Phone CommCenter selected 6801, selected telephony, admin should select one TCP and UDP port in the range 1-3000. Same ports are used by Yahoo Messenger - PC-to-Phone.
BitTorrent 6881-6889, 6969 distributed data download, newer versions TCP 6881-6999. Alternate FAQ link.
Blizzard Downloader World of Warcraft, Battle.net and BitTorrent downloads patches for World of Warcraft
RTP-QT4 6970-6999 Realtime Transport Protocol. (These ports are specifically for the Apple QT4 version.)
VDOLive 7000 user-specified streaming video
Real Audio & Video RTSP, 7070 6970-7170 streaming audio and video
CU-SeeMe, Enhanced CUSM 7648, 7649, LDAP 7648-7652, 24032 videoconferencing
common HTTP 8000, 8001, 8080
Apache JServ Protocol v12 (ajp12) 8007 8007 (default port) See Workers HowTo for config info.
Apache JServ Protocol v13 (ajp13) 8009 8009 (default port) e.g. Apache mod_jk Tomcat connector using ajp13. See Workers HowTo for config info.
Grouper 8038 8038 peer-to-peer (P2P) filesharing
PDL datastream 9100 9100 printing * PDL is Page Description Language. Used commonly by HP printers and by Apple. Also see printing section.
MonkeyCom 9898 9898 * video-chat, also used by Trojans
iVisit 9943, 9945, 56768 videoconferencing
The Palace 9992-9997 9992-9997 chat environment *
common Palace 9998 chat environment
NDMP 10000 10000 Network Data Management Protocol *. Used for storage backup. Also used by Trojans.
Amanda 10080 10080 backup software *. Also used by Trojans.
Yahoo Games 11999 network games
Italk 12345 12345 network chat supporting multiple access methods * Appears mostly used in Japan. There are many other applications calling themselves "italk". TrendMicro OfficeScan antivirus also uses this port. Commonly used by Trojans.
RTP-iChatAV 16384-16403 Used by Apple iChat AV.
RTP 16384-32767 Realtime Transport Protocol. RTP in general is described in RFC 3550. This range is not registered (it never could be, being so broad) but it seems to be somewhat common. See Are there specific ports assigned to RTP?
Palm Computing Network Hotsync 14237 14238 data synchronization
Liquid Audio 18888 streaming audio
FreeTel 21300-21303 audioconferencing
VocalTec Internet Conference 22555 22555 audio & document conferencing *
Quake 26000 26000 network game *
MSN Gaming Zone 28800-29100 28800-29100 network gaming (zone.com, zone.msn.com), also see DirectPlay 7 and DirectPlay 8
Sygate Manager 39213

iSCSI

iSCSI is specified in RFC 3720 - Internet Small Computer Systems Interface.

The well-known user TCP port number for iSCSI connections assigned by IANA is 3260 and this is the default iSCSI port. Implementations needing a system TCP port number may use port 860, the port assigned by IANA as the iSCSI system port; however in order to use port 860, it MUST be explicitly specified - implementations MUST NOT default to use of port 860, as 3260 is the only allowed default.

Also associated with iSCSI is iSNS, Internet Storage Name Service, on port 3205.

These services essentially open up your storage to the Internet in ways even more deep than CIFS, NFS and other file-level sharing services. Therefore you should be very careful about security and may want to block these ports completely, or tightly limit access to them.

Printing

There are several port numbers that may be involved with printing.

Print Server Port Numbers is a useful guide.

The three main ones are LPD ("printer") on port 515, IPP on 631, and PDL-datastream on 9100.

Apple MacOS X Rendezvous Printing (PDF) will discover printers that are advertising their services. They give the example

For example, the Apple LaserWriter 8500 would register the following services,
assuming the default domain is "local."

Apple LaserWriter 8500._printer._tcp.local.        Port 515
Apple LaserWriter 8500._ipp._tcp.local.            Port 631
Apple LaserWriter 8500._pdl-datastream._tcp.local. Port 9100

Napster

After examining Napster, I decided it was such a complex protocol that it deserved its own section. The first thing to be aware of is that there are two versions of Napster. The "original" flavor is what most people will be interested in. This is the full music file-sharing service. This original service provided by Napster.com has now been shut down. Napster.com will be providing a new service with much more controlled music sharing. However, the original protocol lives on, and the protocol has been analyzed so that people could write compatible applications for many different operating systems.

There is information on the protocol (and how to get it through your firewall) from:

Here is a summary of the TCP ports it uses. I have put the notation (primary) after the main port, if more than one port is listed.

PalTalk

PalTalk is another messy service that uses many ports, more than I want to summarize here. Visit their support page: PalTalk Networking Support.

Ultima Online

Information from What are the port numbers I need to play UO behind a firewall or proxy server?

Service Ports Notes
Game 5001-5010
Login 7775-7777
Patch 8888 overlaps with common HTTP port
UO Messenger 8800-8900 includes port 8866 which is also used by Trojan
Patch 9999

Windows and MSN Messenger Application

A related note: the Messenger Service that runs at the Windows SERVICE level is different from the Windows Messenger or MSN Messenger application. For information about the Messenger APPLICATION see

Service TCP UDP Notes
Windows Messenger - voice (computer to phone) 2001-2120, 6801, 6901 from Q324214. NOTE: 6801 is Net2Phone.
MSN Messenger - file transfers 6891-6900 from Q278887. Allows up to 10 simultaneous transfers.
MSN Messenger - voice communications (computer to computer) 6901 6901 from Q278887

For Windows Messenger in a non-UPnP environment, unfortunately Microsoft requires dynamic UDP ports across a very wide range. This is a tremendous security risk. Try to establish a UPnP environment if possible. Nevertheless, here is what they say To support [audio and video] in both directions through the firewall, all UDP ports between 5004 and 65535 must be opened to allow signaling (SIP) and media streams (RTP) to traverse the firewall.

Also note: I don't know how much information for WINDOWS Messenger applies to MSN Messenger and vice versa. I also don't know how much information for MSN Messenger Windows version applies to MSN Messenger Mac version. And last but not least, there are multiple different versions of Messenger, which may differ in various ways.

Email Ports

Email is sent around the Internet mainly from server to server using SMTP. Once delivered, clients may access it in a variety of ways, including POP3 and IMAP. This section DOES NOT cover Microsoft Exchange or other proprietary mail protocols.

The major upcoming change to email is the use of TCP port 587 "submission" for email, as defined in section 3.1 of RFC 2476 - Message Submission. This is planned to replace the traditional use of TCP port 25, SMTP.

3.1. Submission Identification

Port 587 is reserved for email message submission as specified in this document. Messages received on this port are defined to be submissions. The protocol used is ESMTP [SMTP-MTA, ESMTP], with additional restrictions as specified here.

While most email clients and servers can be configured to use port 587 instead of 25, there are cases where this is not possible or convenient. A site MAY choose to use port 25 for message submission, by designating some hosts to be MSAs and others to be MTAs.

This initiative is being promoted by, amongst others, the Anti-Spam Technical Alliance. See Anti-Spam Technical Alliance Technology and Policy Proposal, Version 1.0, 22 June 2004 (PDF)

We further recommend that SMTP authentication be implemented on the standard Mail Submission Port, port 587, and that ISPs encourage their customers to switch their mail client software (for example, MS Outlook, Eudora, and so on) to this port. Using this port will provide seamless connectivity that does not depend on if a network allows port 25 traffic.

In addition to SMTP, the other main email protocols are POP3 and IMAP, these are protocols for email clients to access their mailboxes. There are many other topics that are outside the scope of this page. For example, email addresses are described in RFC 2822 (obsoletes RFC 822), and SMTP authentication is covered in RFC 2554 - SMTP Service Extension for Authentication. Transport Layer Security (TLS) is covered in RFC 2246 - The TLS Protocol Version 1.0. SMTP over TLS is covered in RFC 3207 - SMTP Service Extension for Secure SMTP over Transport Layer Security.

The Network Sorcery RFC Sourcebook entry for SMTP also links to many relevant RFCs that cover the details of the protocol itself.

Service TCP Port Notes
SMTP - Simple Mail Transfer Protocol 25 * As part of the anti-spam best practices, you should block this outgoing for any machine that doesn't need to send email directly.
SMTPs - secure SMTP 465 Port 465 shows up Appendix A of the 1996 non-standard standard The SSL Protocol Version 3.0 as "Simple Mail Transfer Protocol with SSL". Unfortunately, it's not registered for SMTPs, it's registered for URD - "URL Rendesvous Directory for SSM" by Cisco. The recommended approach, at least for authentication, is to use START TLS encryption on submission port 587.
(SMTP email) submission 587 * See RFC 2476 - Message Submission.
POP2 - Post Office Protocol 2 109 * obsolete
POP3 - Post Office Protocol 3 110 *
POP3s - secure POP3 995 * Full description is "pop3 protocol over TLS/SSL (was spop3)".
IMAP3 - Interactive Mail Access Protocol v3 220 * obsolete
IMAP4 - Internet Message Access Protocol 4 143 * Also referred to by version as IMAP4.
IMAPs - secure IMAP 993 * Full description is "imap4 protocol over TLS/SSL". Use 993 instead of TCP port 585 "imap4-ssl", which is deprecated.

Oracle Database TCP/IP Ports

I have a separate page for Oracle ports.

Obsolete Services

Apple released QuickTime 4 some time ago. I am unsure of the status of their older QuickTime Conferencing (MovieTalk) protocol. All of the applications that supported it (Connectix VideoPhone, Apple VideoPhone, Netscape CoolTalk, QuickTime TV) are no longer supported and the QuickTime Conferencing website is gone.

Service TCP UDP Notes
QuickTime Conferencing (MovieTalk) 458 458, dyn >= 7000 videoconferencing *
Apple VideoPhone MovieTalk MovieTalk videoconferencing *
Connectix VideoPhone MovieTalk MovieTalk, dyn >=1024, 4242 videoconferencing
Netscape CoolTalk 6499, 6500 13000 videoconferencing

Official TCP/IP Port Assignments

Also note, although you will sometimes see mention of RFC 1700 "Assigned Numbers" (dated October 1994) it was long ago obsoleted by the official IANA list. Do not use RFC 1700 as a reference. This fact is now officially documented by RFC 3232 "Assigned Numbers: RFC 1700 is Replaced by an On-line Database".

Network Sorcery lists the IANA TCP/UDP Ports with links to pages describing some protocols in detail, as part of its incredibly useful RFC Sourcebook.

Searchable Port Lists

These cover registered, unregistered, and trojan ports - note that many ports have legitimate, required uses, even though people have also used them as trojan ports.

Understanding TCP/IP

The IBM RedBooks are an amazing resource for many technical topics. They have a TCP/IP Tutorial and Technical Overview available as HTML or 7.7 MB PDF.

Cisco also provides excellent information online. Internet Protocols is just one section of their Internetworking Technology Handbook.

There is information on IP (the protocol on which TCP and UDP are built) in Internet Core Protocols: The Definitive Guide Sample Chapter 2: The Internet Protocol [IP].

Articles and Related Resources

Windows

This section discusses specific port information related to Microsoft or provided by them. If you are looking for information about Windows firewalls, including XP Service Pack 2, see the Windows Security Software and Built-in Windows Firewalls sections of my Trojan TCP/IP Ports page.

Microsoft has announced a new Windows Firewall in Windows XP Service Pack 2, it replaces the Internet Connection Firewall (ICF) in previous versions of Windows.

More information about Windows Remote Desktop Protocol (RDP)

As indicated in the RDP section above, this protocol uses a registered TCP port. It is used for XP Pro Remote Desktop and XP Remote Assistance (read Administering Remote Assistance for a very good overview of firewall, NAT and blocking issues). Also used for WinNT4 Terminal Server, Win2000 Terminal Services, and Win .NET Server 2003 Terminal Server.

Windows Remote Procedure Call (RPC) and Distributed COM (DCOM)

In some cases, Microsoft uses port 135 as an RPC Endpoint Mapper. Runs as RPCSS on (some versions of?) Windows. This is a sort of "RPC directory" service which can be used to lookup what ports other services are running on. For some additional information, see Windows 2000 Network Architecture: Remote Procedure Call and NT Gatekeeper: RPC and Firewall Configuration.

MS-RPC on port 135 is required for some Exchange Server and Active Directory communications. See e.g. TCP Ports and Microsoft Exchange: In-depth Discussion and Restricting Active Directory Replication Traffic to a Specific Port.
However this port also poses a security risk, as indicated in the NET SEND section of my broadband security page.

UPDATE 2003-08-13: Also see the Blaster Worm section for information about this additional security risk.

Additional information:

Mac

OpenDoor (makers of DoorStop) have a nice list of MacOS-related ports, with hyperlinks to relevant information.

Apple support has provided a list of "Well Known" TCP and UDP Ports Used By Apple Software Products.

Although it doesn't give any port numbers, you may find Rendezvous service types being used by Mac OS X useful.

Novell (NetWare)

IBM (WebSphere)

IP Telephony / Voice over IP (VoIP) / H.323 / SIP / RTP

Some applications that use H.323 include: ohphone, ohphoneX, ...

Getting H.323 audio/video conferencing through firewalls is particularly problematic. I have used Google cache to rescue an Intel document The Problems and Pitfalls of Getting H.323 Safely Through Firewalls. Note in particular that RTCP (Real Time Control Protocol) has no fixed port, an RTCP session is paired with an RTP session, if you have an RTP stream on even numbered UDP port x, RTCP is on x + 1.

General

The white paper Cisco PIX Firewall and Stateful Firewall Security contains some useful information about the ports and connection protocols for VDOnet, CU-SeeMe, and RealAudio.

Ed Bott's article Block those ports! contains some useful information, and also a kind review of this web page.

You can check out Internet Firewalls: Frequently Asked Questions. As of this writing it was last updated 2000/12/01 but it still has lots of good information.

NetGear's Applications Port List lists a lot of games.

Tim Williams' list of Ports Used by Computer Games has lots of good info.

By popular request: a page on Blocking Chat Programs.

More and more good resources are becoming available, particularly for people with home networks. If you haven't found what you were looking for here, you can try:

Network Protocols

Note that certain services such as IPSec and Microsoft's PPTP use non-TCP/UDP protocols so they may be more complicated to use. In particular, PPTP uses GRE (protocol 47) and IPSec uses ESP (protocol 50) and AH (protocol 51). Protocol numbers are not the same as port numbers. IANA maintains the Assigned Internet Protocol Numbers.

Books

Related Information: Trojan TCP/IP Ports, Free Firewall Book

Those of you concerned with Internet security may wish to also check out my companion page, Trojan TCP/IP Ports for a list of ports used by trojan horse and backdoor programs. Also I have a link to firewall books there (including a free book).


Questions

If you have questions, comments or suggestions specifically about this page or TCP/IP ports then you can email me or use my QuickTopic: Discuss TCP/IP Ports.

For firewall questions I suggest the USENET group comp.security.firewalls via groups.google.com or your newsreader.

If your question is Microsoft-specific, you may want to try the USENET microsoft.public groups, in particular:


Copyright © 1996-2007 Richard Akerman. All rights reserved. No mirroring without prior written consent.

If you wish to mirror this page, contact me by email. The requirements are:


[ Home | Contact Me ]