Common Port Reference

Port Reference is a searchable, category-filtered directory of the TCP and UDP ports you actually run into — web and mail standards, databases, message queues, dev servers, and infrastructure services. Instead of hunting through forum threads to remember whether Elasticsearch is 9200 or 9300, look it up in seconds. It is built for developers writing firewall rules, DevOps engineers reading connection logs, and anyone auditing what is listening on a machine.

Searching and Filtering

The tool offers two ways to narrow roughly eighty entries. The search box takes a port number (443), a service name (redis), or a word from the description (proxy). Numeric queries use exact matching first; if nothing matches exactly, they fall back to a prefix match so 80 surfaces 8000, 8008, 8080, and 8443 alongside port 80 itself. Text queries are case-insensitive and search both the service name and the description.

Below the search box, category chips restrict the table to one family at a time: web, file transfer, email, network, remote access, databases, messaging, and dev tools. Each row shows the port number, its protocol, the service, and a one-line description, with a copy button for the number. Everything is a static local dataset, so results appear instantly with no network calls.

The Three Port Ranges

Port numbers run from 0 to 65535 and are split into three IANA ranges. Ports 0–1023 are the well-known ports assigned to core protocols — 22 SSH, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS. Ports 1024–49151 are the registered ports where applications live, such as MySQL on 3306, PostgreSQL on 5432, Redis on 6379, and MongoDB on 27017. Ports 49152–65535 are dynamic or ephemeral ports the operating system hands out temporarily to the client side of each outbound connection.

The range does not by itself tell you whether a service is safe. A database on a registered port can be just as exposed as one on a well-known port if it is bound to a public interface without authentication.

Worked Lookups

You search	What comes back	Why it matters
443	HTTPS, TCP	The destination port for almost all secure web and API traffic
22	SSH / SFTP, TCP	Encrypted remote login and file transfer share this port
5432	PostgreSQL, TCP	The default in connection strings and Docker Compose files
9200	Elasticsearch REST, TCP	Frequently left open on cloud hosts; should be firewalled
5000	Dev server, TCP	Flask and many Node dev servers; also Docker Registry and UPnP on some systems
netstat-style LISTEN audit	Database and dev categories	Reveals services you did not intend to expose

Two entries sit close enough to trip people up: Elasticsearch’s REST API is 9200 while its internal cluster transport is 9300, and MongoDB’s server is 27017 while shard servers default to 27018.

Development tools collide constantly on the same low thousands. React’s create-react-app and Express demos default to 3000, Flask and many Python servers to 5000, Django to 8000, and Tomcat to 8080, while React Native’s Metro bundler uses 8081. When two projects claim one port, the second fails with EADDRINUSE — the fix is to override the framework’s PORT setting rather than disabling the service. Searching the dev category is a quick way to identify which tool owns a port you found in lsof -i output.

Ports You Should Never Expose

Some defaults are dangerous the moment they face the internet. Redis (6379), MongoDB (27017), Elasticsearch (9200), and Memcached (11211) commonly ship without authentication and have been behind many large data breaches. Docker’s unencrypted API on 2375 is worse — it grants effectively root control over the host. Telnet (23) sends credentials in cleartext, and legacy PPTP (1723) uses broken encryption.

The safe pattern is to bind these services to 127.0.0.1, place them on a private subnet, or require a VPN or SSH tunnel, and firewall everything else. A port reference tells you which number a service uses; it does not make that service safe to publish.

TCP vs UDP and Dual-Protocol Services

Each entry states its protocol. DNS (53), LDAP (389), NFS (2049), SIP (5060), SMB-related NetBIOS services, and NTP (123) all appear with their actual transport, and several are dual-protocol. UDP suits small, retry-tolerant request-response traffic, while TCP carries anything that needs ordered, reliable delivery. SNMP is split across 161 for polling and 162 for traps, both UDP. When a firewall rule is not working, a protocol mismatch — allowing TCP when the service speaks UDP — is one of the first things to check.

Common Mistakes

• Opening a port by description instead of number. Cloud security groups take numbers, so convert the service name first.
• Assuming an ephemeral client port is a listening service. High source ports are the client’s side of a connection.
• Leaving a database port open “temporarily” for debugging. Automated scanners find it within minutes.
• Confusing 587 and 25. 587 is submission from clients; 25 is relay between servers and is often blocked.
• Forgetting that Docker publishes ports on 0.0.0.0 by default. A -p 3306:3306 mapping can expose MySQL beyond localhost unless you bind to 127.0.0.1.

Related Tools

• HTTP Status Reference
• Subnet Calculator
• URL Parser
• MIME Type Lookup