This website has been designed for use with the FireFox browser. Please use FireFox to view this page.
TCP & UDP well-known port reference for C# and Visual Basic .NET (VB.NET)
Below is a list of well-known TCP and UDP ports used by everyday applications and services.
Some of these ports are known to be used by viruses, and thus detection of heavy or regular pulses of
traffic on these ports can indicate infected machines on a network. To find further information on
common protocols, or read about ways of detecting such traffic on a network, the book Network programming in .NET
should be of invaluable assistance.
TCP Port Service Multiplexer. Uses tcpmux service.
Port 1 udp
Sockets des Troie
Port 2 tcp/udp
Management Utility. Uses compressnet service.
Port 2 tcp
Death
Port 3 tcp/udp
Compression Process. Uses compressnet service.
Port 3 tcp/udp
Midnight CommanderSometimes this program is assigned to this port. Uses compressnet service.
Port 4 tcp
Self-Certifying File System(SFS)sfssd acceps connections on TCP port 4 and passes them to the appropriate SFS daemon. SFS is a secure,global file system with completely decentralized control. SFS uses NFS 3 as the underlying protocol for file access.
Port 4 tcp
Midnight CommanderSometimes this program is assigned to this prot
Port 5 tcp/udp
Remote Job Entry. Uses rje service.
Port 7 tcp/udp
Echo. Uses echo service.
Port 9 tcp/udp
Discard. Uses discard service.
Port 11 tcp/udp
Active Users. Uses systat service.
Port 13 tcp/udp
Daytime (RFC 867). Uses daytime service.
Port 17 tcp/udp
Quote of the Day. Uses qotd service.
Port 18 tcp/udp
Message Send Protocol. Uses msp service.
Port 19 tcp/udp
Character Generator. Uses chargen service.
Port 20 tcp/udp
File Transfer [Default Data]. Uses ftp-data service.
Port 20 tcp
Randex
Port 21 tcp
Back Construction,Blade Runner
Port 21 tcp/udp
File Transfer [Control]. Uses ftp service.
Port 21 tcp
Senna Spy FTP server
Port 22 tcp/udp
SSH Remote Login Protocol. Uses ssh service.
Port 22 udp
pcAnywhere(Used in older versions,though newer version still use it for backwards compatibility.)
Port 22 tcp
Shaft
Port 23 tcp/udp
Telnet. Uses telnet service.
Port 23 tc
Fire HacKer,Tiny Telnet Server - TTS
Port 24 tcp/udp
any private mail system
Port 25 tcp/udp
Simple Mail Transfer. Uses smtp service.
Port 25 tcp
Ajan,Antigen
Port 26 tcp
W32.Netsky
Port 27 tcp/udp
NSW User System FE. Uses nsw-fe service.
Port 29 tcp/udp
MSG ICP. Uses msg-icp service.
Port 30 tcp
Agent 40421
Port 31 tcp/udp
MSG Authentication. Uses msg-auth service.
Port 31 tcp
Agent 31,Hackers Paradise
Port 33 tcp/udp
Display Support Protocol. Uses dsp service.
Port 35 tcp/udp
any private printer server
Port 37 tcp/udp
Time. Uses time service.
Port 38 tcp/udp
Route Access Protocol. Uses rap service.
Port 39 tcp/udp
Resource Location Protocol. Uses rlp service.
Port 39 tcp/udp
Upfudoor
Port 40 tcp
Midnight CommanderSometimes access FTP servers running at this port.
Port 41 tcp
RAT: Deep ThroatPuts an FTP service at port 41 (TCP).Foreplay
Swift Remote Virtural File Protocol. Uses swift-rvf service.
Port 98 tcp/udp
TAC News. Uses tacnews service.
Port 99 tcp/udp
Metagram Relay. Uses metagram service.
Port 99 tcp
Hidden Port,NCX
Port 100 tcp
[unauthorized use]. Uses newacct service.
Port 101 tcp/udp
NIC Host Name Server. Uses hostname service.
Port 101 tcp/udp
Udps
Port 102 tcp/udp
ISO-TSAP Class 0. Uses iso-tsap service.
Port 103 tcp/udp
Genesis Point-to-Point Trans Net. Uses gppitnp service.
Port 104 tcp/udp
ACR-NEMA Digital Imag. & Comm. 300. Uses acr-nema service.
Port 105 tcp/udp
CCSO name server protocol. Uses cso service.
Port 105 tcp/udp
Mailbox Name Nameserver. Uses csnet-ns service.
Port 106 tcp/udp
3COM-TSMUX. Uses 3com-tsmux service.
Port 106 tcp
allows passwords to be changed on POP servers. Traditionally,users would have to have shell (Telnet) accounts on the servers in order to change their passwords. This allows users with just POP access to change their passwords.. Uses poppassd(epass) service.
Port 107 tcp/udp
Remote Telnet Service. Uses rtelnet service.
Port 108 tcp/udp
SNA Gateway Access Server. Uses snagas service.
Port 109 tcp/udp
Post Office Protocol - Version 2. Uses pop2 service.
Port 110 tcp/udp
Post Office Protocol - Version 3. Uses pop3 service.
Port 110 tcp
ProMail trojan
Port 111 tcp/udp
SUN Remote Procedure Call. Uses sunrpc service.
Port 112 tcp/udp
McIDAS Data Transmission Protocol. Uses mcidas service.
Port 113 tcp/udp
Authentication Service. Uses auth service.
Port 113 tcp
Invisible Identd Deamon,Kazimas
Port 114 tcp/udp
Audio News Multicast. Uses audionews service.
Port 115 tcp/udp
Simple File Transfer Protocol. Uses sftp service.
Port 116 tcp/udp
ANSA REX Notify. Uses ansanotify service.
Port 116 udp
Diablo
Port 117 tcp/udp
UUCP Path Service. Uses uucp-path service.
Port 118 tcp/udp
SQL Services. Uses sqlserv service.
Port 118 udp
Diablo
Port 119 tcp/udp
Network News Transfer Protocol. Uses nntp service.
Port 119 tcp
Happy99
Port 120 tcp/udp
CFDPTKT. Uses cfdptkt service.
Port 121 tcp
Attack Bot,God Message
Port 121 tcp/udp
Encore Expedited Remote Pro.Call. Uses erpc service.
Port 122 tcp/udp
SMAKYNET. Uses smakynet service.
Port 122 tcp/udp
Upfudoor
Port 123 tcp/udp
Network Time Protocol. Uses ntp service.
Port 123 tcp
Net Controller,Madfind
Port 124 tcp/udp
ANSA REX Trader. Uses ansatrader service.
Port 124 tcp
SecureID v1
Port 125 tcp/udp
Locus PC-Interface Net Map Ser. Uses locus-map service.
Port 126 tcp/udp
Unisys Unitary Login. Uses #unitary service.
Port 126 tcp/udp
NXEdit. Uses nxedit service.
Port 127 tcp/udp
Locus PC-Interface Conn Server. Uses locus-con service.
Port 128 tcp/udp
GSS X License Verification. Uses gss-xlicen service.
Interactive Mail Access Protocol v3. Uses imap3 service.
Port 221 tcp/udp
Berkeley rlogind with SPX auth. Uses fln-spx service.
Port 222 tcp/udp
Berkeley rshd with SPX auth. Uses rsh-spx service.
Port 223 tcp/udp
Certificate Distribution Center. Uses cdc service.
Port 224 tcp/udp
masqdialer. Uses masqdialer service.
Port 225-241 tcp/udp
Reserved
Port 242 tcp/udp
Direct. Uses direct service.
Port 243 tcp/udp
Survey Measurement. Uses sur-meas service.
Port 244 tcp/udp
inbusiness. Uses inbusiness service.
Port 245 tcp/udp
LINK. Uses link service.
Port 246 tcp/udp
Display Systems Protocol. Uses dsp3270 service.
Port 247 tcp/udp
SUBNTBCST_TFTP. Uses subntbcst_tftp service.
Port 248 tcp/udp
bhfhs. Uses bhfhs service.
Port 249-255 tcp/udp
Reserved
Port 256 tcp/udp
RAP. Uses rap service.
Port 256 tcp
FW1Certificate/key distribution. VPN clients (SecuRemote) can download keys on this port.
Port 257 tcp/udp
Secure Electronic Transaction. Uses set service.
Port 257 tcp
FW1logging
Port 258 tcp/udp
Yak Winsock Personal Chat. Uses yak-chat service.
Port 258 tcp
FW1Remote control over policy editing.
Port 259 tcp/udp
Efficient Short Remote Operations. Uses esro-gen service.
Port 260 tcp/udp
Openport. Uses openport service.
Port 261 tcp/udp
IIOP Name Service over TLS/SSL. Uses nsiiops service.
Port 262 tcp/udp
Arcisdms. Uses arcisdms service.
Port 263 tcp/udp
HDAP. Uses hdap service.
Port 264 tcp
FW1_topoFW1 can be flooded on this port in order to cause CPU utilization to reach 100% and stopping managers from connecting. However,it requires a fast link and access to that port
Port 264 tcp/udp
BGMP. Uses bgmp service.
Port 265 tcp/udp
X-Bone CTL. Uses x-bone-ctl service.
Port 266 tcp/udp
SCSI on ST. Uses sst service.
Port 267 tcp/udp
Tobit David Service Layer. Uses td-service service.
Port 268 tcp/udp
Tobit David Replica. Uses td-replica service.
Port 280 tcp/udp
http-mgmt. Uses http-mgmt service.
Port 281 tcp/udp
Personal Link. Uses personal-link service.
Port 282 tcp/udp
Cable Port A/X. Uses cableport-ax service.
Port 283 tcp/udp
rescap. Uses rescap service.
Port 284 tcp/udp
corerjd. Uses corerjd service.
Port 286 tcp/udp
FXP Communication. Uses fxp service.
Port 287 tcp/udp
K-BLOCK. Uses k-block service.
Port 308 tcp/udp
Novastor Backup. Uses novastorbakcup service.
Port 309 tcp/udp
EntrustTime. Uses entrusttime service.
Port 310 tcp/udp
bhmds. Uses bhmds service.
Port 311 tcp/udp
AppleShare IP WebAdmin. Uses asip-webadmin service.
Transport Independent Convergence for FNA. Uses ticf-1 service.
Port 493 tcp/udp
Transport Independent Convergence for FNA. Uses ticf-2 service.
Port 494 tcp/udp
POV-Ray. Uses pov-ray service.
Port 495 tcp/udp
intecourier. Uses intecourier service.
Port 496 tcp/udp
PIM-RP-DISC. Uses pim-rp-disc service.
Port 497 tcp/udp
dantz. Uses dantz service.
Port 498 tcp/udp
siam. Uses siam service.
Port 499 tcp/udp
ISO ILL Protocol. Uses iso-ill service.
Port 500 tcp/udp
isakmp. Uses isakmp service.
Port 501 tcp/udp
STMF. Uses stmf service.
Port 502 tcp/udp
asa-appl-proto. Uses asa-appl-proto service.
Port 503 tcp/udp
Intrinsa. Uses intrinsa service.
Port 504 tcp/udp
citadel. Uses citadel service.
Port 505 tcp/udp
mailbox-lm. Uses mailbox-lm service.
Port 506 tcp/udp
ohimsrv. Uses ohimsrv service.
Port 507 tcp/udp
crs. Uses crs service.
Port 508 tcp/udp
xvttp. Uses xvttp service.
Port 509 tcp/udp
snare. Uses snare service.
Port 510 tcp/udp
FirstClass Protocol. Uses fcp service.
Port 511 tcp/udp
PassGo. Uses passgo service.
Port 511 tcp
Part of rootkit t0rn,a program called "leeto's socket daemon" runs at this port.
Port 512 tcp
remote process execution; authentication performed using passwords and UNIX login names. Uses exec service.
Port 512 udp
used by mail system to notify users of new mail received; currently receives messages only from processes on the same machine. Uses biff service.
Port 513 tcp
"remote login a la telnet; automatic authentication performed based on priviledged port numbers and distributed data bases which identify ""authentication domains""". Uses login service.
Port 513 udp
maintains data bases showing who's logged in to machines on a local net and the load average of the machine. Uses who service.
Port 513 tcp
Grlogin
Port 514 tcp
"cmd like exec,but automatic authentication isperformed as for login server". Uses shell service.
Port 514 tcp
RPC Backdoor
Port 515 tcp/udp
spooler. Uses printer service.
Port 516 tcp/udp
videotex. Uses videotex service.
Port 517 tcp/udp
"like tenex link,but across machine - unfortunately. Uses talk service.
Port 519 tcp/udp
unixtime. Uses utime service.
Port 520 udp
local routing process (on site); uses variant of Xerox NS routing information protocol - RIP. Uses router service.
Port 520 tcp
extended file name server. Uses efs service.
Port 521 tcp/udp
ripng. Uses ripng service.
Port 522 tcp/udp
ULP. Uses ulp service.
Port 523 tcp/udp
IBM-DB2. Uses ibm-db2 service.
Port 524 tcp/udp
NCP. Uses ncp service.
Port 525 tcp/udp
timeserver. Uses timed service.
Port 526 tcp/udp
newdate. Uses tempo service.
Port 527 tcp/udp
Stock IXChange. Uses stx service.
Port 528 tcp/udp
Customer IXChange. Uses custix service.
Port 529 tcp/udp
IRC-SERV. Uses irc-serv service.
Port 530 tcp/udp
rpc. Uses courier service.
Port 531 tcp/udp
chat. Uses conference service.
Port 531 tcp
Net666,Rasmin
Port 532 tcp/udp
readnews. Uses netnews service.
Port 533 tcp/udp
for emergency broadcasts. Uses netwall service.
Port 534 tcp/udp
MegaMedia Admin. Uses mm-admin service.
Port 535 tcp/udp
iiop. Uses iiop service.
Port 536 tcp/udp
opalis-rdv. Uses opalis-rdv service.
Port 537 tcp/udp
Networked Media Streaming Protocol. Uses nmsp service.
The bindshell.c program puts a backdoor root shell on this port by default. This assumes that you've already been compromised by some other exploit and that the hacker uses the default port.
Port 1234 tcp
SubSeven Java client,Ultors Trojan
Port 1235 tcp/udp
mosaicsyssvc1. Uses mosaicsyssvc1 service.
Port 1236 tcp/udp
bvcontrol. Uses bvcontrol service.
Port 1237 tcp/udp
tsdos390. Uses tsdos390 service.
Port 1238 tcp/udp
hacl-qs. Uses hacl-qs service.
Port 1239 tcp/udp
NMSD. Uses nmsd service.
Port 1240 tcp/udp
Instantia. Uses instantia service.
Port 1241 tcp/udp
nessus. Uses nessus service.
Port 1242 tcp/udp
NMAS over IP. Uses nmasoverip service.
Port 1243 tcp/udp
SerialGateway. Uses serialgateway service.
Port 1243 tcp
BackDoor-G,SubSeven
Port 1244 tcp/udp
isbconference1. Uses isbconference1 service.
Port 1245 tcp
VooDoo Doll
Port 1245 tcp/udp
isbconference2. Uses isbconference2 service.
Port 1246 tcp/udp
payrouter. Uses payrouter service.
Port 1247 tcp/udp
VisionPyramid. Uses visionpyramid service.
Port 1248 tcp/udp
hermes. Uses hermes service.
Port 1249 tcp/udp
Mesa Vista Co. Uses mesavistaco service.
Port 1250 tcp/udp
swldy-sias. Uses swldy-sias service.
Port 1251 tcp/udp
servergraph. Uses servergraph service.
Port 1252 tcp/udp
bspne-pcc. Uses bspne-pcc service.
Port 1253 tcp/udp
q55-pcc. Uses q55-pcc service.
Port 1254 tcp/udp
de-noc. Uses de-noc service.
Port 1255 tcp
Scarab
Port 1255 tcp/udp
de-cache-query. Uses de-cache-query service.
Port 1256 tcp/udp
de-server. Uses de-server service.
Port 1256 tcp
Project nEXT
Port 1257 tcp/udp
Shockwave 2. Uses shockwave2 service.
Port 1258 tcp/udp
Open Network Library. Uses opennl service.
Port 1259 tcp/udp
Open Network Library Voice. Uses opennl-voice service.
Port 1260 tcp/udp
ibm-ssd. Uses ibm-ssd service.
Port 1261 tcp/udp
mpshrsv. Uses mpshrsv service.
Port 1262 tcp/udp
QNTS-ORB. Uses qnts-orb service.
Port 1263 tcp/udp
dka. Uses dka service.
Port 1264 tcp/udp
PRAT. Uses prat service.
Port 1265 tcp/udp
DSSIAPI. Uses dssiapi service.
Port 1266 tcp/udp
DELLPWRAPPKS. Uses dellpwrappks service.
Port 1267 tcp/udp
eTrust Policy Compliance. Uses epc service.
Port 1268 tcp/udp
PROPEL-MSGSYS. Uses propel-msgsys service.
Port 1269 tcp/udp
WATiLaPP. Uses watilapp service.
Port 1269 tcp
Matrix
Port 1270 tcp/udp
Microsoft Operations Manager. Uses opsmgr service.