Port Reference

Port number ranges

The 65,535 available port numbers are divided into three ranges by IANA (Internet Assigned Numbers Authority):

Well-known ports (0–1023)

Reserved for system-level and widely used services. These are the ports you'll encounter most often: HTTP (80), HTTPS (443), SSH (22), DNS (53), SMTP (25). On Unix/Linux systems, binding to these ports typically requires root privileges. IANA tightly controls assignments in this range.

Registered ports (1024–49151)

Assigned by IANA to specific services upon request, but not as strictly controlled. Common databases (MySQL 3306, PostgreSQL 5432), application servers (Tomcat 8080), and management interfaces fall in this range. Any process can bind to these ports without special privileges.

Dynamic/Ephemeral ports (49152–65535)

Used by the operating system for temporary outbound connections. When your browser connects to a web server on port 443, your side of the connection uses a random ephemeral port. These are never assigned to specific services. The exact range varies by OS. Linux uses 32768–60999 by default.

TCP vs UDP

Both TCP and UDP are transport-layer protocols that sit on top of IP, but they serve different purposes:

TCP (Transmission Control Protocol)

Connection-oriented: establishes a session with a three-way handshake before sending data. Guarantees delivery, ordering, and error checking. Used for HTTP, SSH, email, database connections, file transfers, and anything where data integrity is critical. Higher overhead due to acknowledgements and retransmission.

UDP (User Datagram Protocol)

Connectionless: sends packets (datagrams) without establishing a session. No delivery guarantee, no ordering, no retransmission. Used for DNS queries, NTP, SNMP, VoIP, video streaming, and gaming, where speed matters more than guaranteed delivery, or where the application handles reliability itself.

Some services use both. DNS uses UDP for standard queries (fast) but falls back to TCP for zone transfers and large responses. Similarly, SIP uses UDP for call signalling but can use TCP for reliability.

Firewall considerations

Understanding ports is essential for firewall configuration. Key principles:

• Default deny: Start by blocking everything, then open only the ports you need. This is the most secure approach and the standard for any production environment.
• Inbound vs outbound: Inbound rules control what can connect to your services. Outbound rules control what your systems can reach. Both matter. Malware often uses outbound connections to well-known ports (80, 443) to blend in with legitimate traffic.
• Stateful inspection: Modern firewalls track connection state, so you only need to allow the initial inbound connection. Return traffic on ephemeral ports is automatically allowed as part of the established session.
• Non-standard ports: Running services on non-standard ports (e.g. SSH on 2222 instead of 22) is not security; it's obscurity. It reduces automated scanning noise but doesn't protect against targeted attacks. Always combine with proper authentication and access controls.
• Documentation: Every open port should be documented with a business justification. If you can't explain why a port is open, close it. Periodically audit your firewall rules against this reference.

IANA assignments

Ports marked with the IANA badge are officially assigned by the Internet Assigned Numbers Authority. This means the port-to-service mapping is standardised and documented in the IANA Service Name and Transport Protocol Port Number Registry. Ports without the badge are de facto conventions: widely used but not officially registered. Both are valid; the distinction matters mainly for documentation and compliance contexts.