Common port numbers

An IP address identifies a device, but a device runs many programs that all use the network at once: a browser, a mail client, a game, a file-sharing service. The port number is how the two ends agree which program a packet belongs to. Every TCP and UDP packet carries a source port and a destination port, so a web request to 203.0.113.42:443 is read as "the HTTPS program on the machine at 203.0.113.42".

Servers listen on fixed, published ports so that clients know where to knock. Clients use a random high port for their end of the conversation, which is why you never configure a port for your browser. There are 65,536 possible numbers, divided into three ranges by the registry IANA maintains:

TCP and UDP have separate port spaces, so TCP 53 and UDP 53 are different doors, even though DNS happens to use both. A service listed as "TCP" below does not answer UDP packets on the same number. Every port in the first two ranges is listed in the IANA registry; the tables here are the subset that actually turns up in day-to-day work.

Three of these deserve a warning. Telnet (23), SMB (445) and the NetBIOS trio (137–139) carry logins or file access with weak or no encryption, and every address on the internet is scanned for them continuously. They should be reachable only inside your network. The port checker tests whether a port on your public address answers from outside; for those three, the right result is closed or filtered.

The pattern in this range: databases, remote-control tools and admin panels. None of them should face the internet directly. Remote Desktop on 3389 and VNC on 5900 are the two most attacked services on home connections, and an exposed Redis, MongoDB or Elasticsearch with default settings is an open database. If you need to reach any of these from outside, put a VPN (WireGuard on 51820 or OpenVPN on 1194) in front and forward only that one port; What is port forwarding? walks through the setup.

Consoles and game launchers publish the ports they use so that players with strict NAT can forward them. The lists change, and most modern games work without any forwarding because the console opens what it needs through UPnP. Forward ports only when a NAT type test says you need to.

Before forwarding anything, check the result you are trying to change. The NAT type test reports open, moderate or strict NAT and whether your provider uses carrier-grade NAT, in which case no amount of forwarding on your own router helps; What is NAT? explains why. After forwarding, the port checker confirms the port is reachable from the internet, which is the only test that matters.

There are two different questions hiding in "is the port open", and they need different tools.

Is a program listening on my computer? That is a local question. On Windows run netstat -ano | findstr LISTENING in Terminal; on macOS lsof -iTCP -sTCP:LISTEN -n -P; on Linux ss -ltnp. Each line names a port and the process behind it. A port can be listening and still be unreachable from outside, which is the normal state for everything on a home network.

Can the internet reach it? That depends on the router's NAT and firewall as well as the program. The port checker connects to your public address on the port you choose and reports open (something answered), closed (the router or host actively refused) or filtered (no answer at all, usually a firewall dropping the packet). Run it against a port you have forwarded to confirm the rule works, and against 23, 445, 3389 and 5900 to confirm they do not answer.

If you are looking at a port number in a lookup result or a log and want to know what it belongs to, the tables above cover the common cases. For anything else, the IANA service name registry is the authoritative list, and the HTTP headers tool will tell you what is actually answering on a web port, which is often not what the number suggests.