All 146 ports Subbing drills, grouped the way the app groups them. Exam core first, then the services a port scan finds, then databases and admin, then the industrial protocols.
Ports listed under several sets appear in each. Jump to exam core, nmap top 100, databases, admin and cloud or industrial / OT.
| Port | Service | Transport | Note |
|---|---|---|---|
| 20 | FTP data | TCP | FTP data channel (active mode) |
| 21 | FTP | TCP | File Transfer Protocol control channel; credentials in clear text |
| 22 | SSH | TCP | Secure Shell, also SFTP and SCP |
| 23 | Telnet | TCP | Unencrypted remote terminal; still common on PLCs and switches |
| 25 | SMTP | TCP | Mail transfer between servers |
| 53 | DNS | TCP/UDP | Name resolution; UDP queries, TCP for zone transfers and large answers |
| 67 | DHCP server | UDP | DHCP server listens here |
| 68 | DHCP client | UDP | DHCP client side |
| 69 | TFTP | UDP | Trivial FTP; firmware, configs and PXE, no authentication |
| 80 | HTTP | TCP | Plain web traffic |
| 88 | Kerberos | TCP/UDP | Kerberos authentication (Active Directory KDC) |
| 110 | POP3 | TCP | Mail retrieval, download and delete |
| 123 | NTP | UDP | Network Time Protocol |
| 135 | MS RPC | TCP | Microsoft RPC endpoint mapper; DCOM and classic OPC DA start here |
| 137 | NetBIOS name | UDP | NetBIOS name service |
| 139 | NetBIOS session | TCP | NetBIOS session service; SMB over NetBIOS |
| 143 | IMAP | TCP | Mail retrieval, server-side folders |
| 161 | SNMP | UDP | SNMP agent queries; v1/v2c community strings travel in clear text |
| 162 | SNMP trap | UDP | SNMP traps to the manager |
| 179 | BGP | TCP | Border Gateway Protocol |
| 389 | LDAP | TCP/UDP | Directory lookups (Active Directory) |
| 443 | HTTPS | TCP | Web over TLS |
| 445 | SMB | TCP | Windows file sharing directly over TCP |
| 465 | SMTPS | TCP | SMTP with implicit TLS |
| 500 | IKE | UDP | IPsec key exchange |
| 514 | Syslog | UDP | Log forwarding on UDP; 514/TCP is rsh (remote shell) |
| 587 | SMTP submission | TCP | Mail submission from clients with STARTTLS |
| 636 | LDAPS | TCP | LDAP over TLS |
| 990 | FTPS | TCP | FTP with implicit TLS |
| 993 | IMAPS | TCP | IMAP over TLS |
| 995 | POP3S | TCP | POP3 over TLS |
| 1433 | MS SQL | TCP | Microsoft SQL Server |
| 1521 | Oracle DB | TCP | Oracle TNS listener |
| 1701 | L2TP | UDP | Layer 2 Tunneling Protocol |
| 1723 | PPTP | TCP | Legacy VPN; MS-CHAPv2 is broken |
| 1812 | RADIUS auth | UDP | RADIUS authentication |
| 1813 | RADIUS accounting | UDP | RADIUS accounting |
| 3306 | MySQL | TCP | MySQL / MariaDB |
| 3389 | RDP | TCP | Remote Desktop Protocol |
| 5060 | SIP | TCP/UDP | VoIP signalling (5061 for TLS) |
| 5432 | PostgreSQL | TCP | PostgreSQL |
| 5900 | VNC | TCP | Virtual Network Computing; 5900 + display number |
| 8080 | HTTP alt | TCP | The usual alternate HTTP port: proxies, Tomcat, dev servers |
| 8443 | HTTPS alt | TCP | Alternate HTTPS port: Tomcat, Plesk, appliances |
| Port | Service | Transport | Note |
|---|---|---|---|
| 7 | Echo | TCP/UDP | Echo service; legacy diagnostics, usually disabled |
| 9 | Discard | TCP/UDP | Discard service; a null sink, legacy |
| 13 | Daytime | TCP/UDP | Daytime service; returns the date as text |
| 21 | FTP | TCP | File Transfer Protocol control channel; credentials in clear text |
| 22 | SSH | TCP | Secure Shell, also SFTP and SCP |
| 23 | Telnet | TCP | Unencrypted remote terminal; still common on PLCs and switches |
| 25 | SMTP | TCP | Mail transfer between servers |
| 37 | Time | TCP/UDP | Time protocol (RFC 868); 32-bit seconds since 1900, predates NTP |
| 53 | DNS | TCP/UDP | Name resolution; UDP queries, TCP for zone transfers and large answers |
| 79 | Finger | TCP | User information lookup; a classic enumeration target |
| 80 | HTTP | TCP | Plain web traffic |
| 81 | HTTP alt | TCP | A second web port (IANA: hosts2-ns); common on cameras and embedded devices |
| 88 | Kerberos | TCP/UDP | Kerberos authentication (Active Directory KDC) |
| 110 | POP3 | TCP | Mail retrieval, download and delete |
| 111 | rpcbind | TCP/UDP | ONC RPC port mapper; lists NFS and other RPC services |
| 113 | Ident | TCP | Identification protocol; IRC servers still query it |
| 119 | NNTP | TCP | Usenet news transfer |
| 135 | MS RPC | TCP | Microsoft RPC endpoint mapper; DCOM and classic OPC DA start here |
| 139 | NetBIOS session | TCP | NetBIOS session service; SMB over NetBIOS |
| 143 | IMAP | TCP | Mail retrieval, server-side folders |
| 179 | BGP | TCP | Border Gateway Protocol |
| 199 | SMUX | TCP | SNMP multiplexing; often open on Linux hosts running snmpd |
| 389 | LDAP | TCP/UDP | Directory lookups (Active Directory) |
| 427 | SLP | TCP/UDP | Service Location Protocol; printers, ESXi; UDP amplification abuse |
| 443 | HTTPS | TCP | Web over TLS |
| 445 | SMB | TCP | Windows file sharing directly over TCP |
| 465 | SMTPS | TCP | SMTP with implicit TLS |
| 513 | rlogin | TCP | Berkeley remote login; trust via rhosts, no encryption |
| 514 | Syslog | UDP | Log forwarding on UDP; 514/TCP is rsh (remote shell) |
| 515 | LPD | TCP | Line printer daemon |
| 548 | AFP | TCP | Apple Filing Protocol (macOS file sharing) |
| 554 | RTSP | TCP | Real Time Streaming Protocol; IP cameras and media servers |
| 587 | SMTP submission | TCP | Mail submission from clients with STARTTLS |
| 631 | IPP | TCP | Internet Printing Protocol; CUPS web interface |
| 646 | LDP | TCP/UDP | MPLS Label Distribution Protocol |
| 873 | rsync | TCP | rsync daemon; anonymous modules leak files |
| 990 | FTPS | TCP | FTP with implicit TLS |
| 993 | IMAPS | TCP | IMAP over TLS |
| 995 | POP3S | TCP | POP3 over TLS |
| 1025 | Windows RPC (dynamic) | TCP | Legacy Windows dynamic RPC endpoints (1025-1029); modern Windows uses 49152+ |
| 1433 | MS SQL | TCP | Microsoft SQL Server |
| 1720 | H.323 | TCP | H.323 call signalling (Q.931) for VoIP and video conferencing |
| 1723 | PPTP | TCP | Legacy VPN; MS-CHAPv2 is broken |
| 1900 | SSDP | UDP | UPnP discovery; amplification abuse |
| 2000 | Cisco SCCP | TCP | Cisco Skinny Client Control Protocol (IP phones) |
| 2049 | NFS | TCP/UDP | Network File System; check exports for no_root_squash |
| 2121 | FTP alt | TCP | Alternate FTP port (IANA: ccproxy-ftp) |
| 3000 | Grafana | TCP | Grafana by default; also Node, Rails and other dev servers |
| 3128 | Squid proxy | TCP | Squid HTTP proxy |
| 3306 | MySQL | TCP | MySQL / MariaDB |
| 3389 | RDP | TCP | Remote Desktop Protocol |
| 4899 | Radmin | TCP | Radmin remote control |
| 5000 | Docker registry | TCP | Docker registry, Flask dev server, Synology DSM; nmap labels it upnp |
| 5060 | SIP | TCP/UDP | VoIP signalling (5061 for TLS) |
| 5357 | WSDAPI | TCP | Windows Web Services for Devices (network printers, discovery) |
| 5432 | PostgreSQL | TCP | PostgreSQL |
| 5631 | pcAnywhere | TCP | Symantec pcAnywhere data (legacy remote control) |
| 5666 | NRPE | TCP | Nagios Remote Plugin Executor |
| 5800 | VNC (HTTP) | TCP | VNC browser viewer; the real VNC port is 5900 |
| 5900 | VNC | TCP | Virtual Network Computing; 5900 + display number |
| 6000 | X11 | TCP | X Window System; 6000 + display number |
| 8000 | HTTP alt | TCP | Alternate web port; Python http.server, Django dev server |
| 8008 | HTTP alt | TCP | Alternate web port (IANA: http-alt) |
| 8009 | AJP | TCP | Tomcat AJP connector (Ghostcat, CVE-2020-1938) |
| 8080 | HTTP alt | TCP | The usual alternate HTTP port: proxies, Tomcat, dev servers |
| 8081 | HTTP alt | TCP | Alternate web port; Nexus, McAfee ePO agent |
| 8443 | HTTPS alt | TCP | Alternate HTTPS port: Tomcat, Plesk, appliances |
| 8888 | HTTP alt | TCP | Alternate web port; Jupyter Notebook |
| 9100 | JetDirect | TCP | Raw printer port (HP JetDirect); also the Prometheus node exporter |
| 10000 | Webmin | TCP | Webmin admin UI (nmap labels it snet-sensor-mgmt) |
| Port | Service | Transport | Note |
|---|---|---|---|
| 21 | FTP | TCP | File Transfer Protocol control channel; credentials in clear text |
| 22 | SSH | TCP | Secure Shell, also SFTP and SCP |
| 23 | Telnet | TCP | Unencrypted remote terminal; still common on PLCs and switches |
| 25 | SMTP | TCP | Mail transfer between servers |
| 53 | DNS | TCP/UDP | Name resolution; UDP queries, TCP for zone transfers and large answers |
| 67 | DHCP server | UDP | DHCP server listens here |
| 69 | TFTP | UDP | Trivial FTP; firmware, configs and PXE, no authentication |
| 80 | HTTP | TCP | Plain web traffic |
| 88 | Kerberos | TCP/UDP | Kerberos authentication (Active Directory KDC) |
| 110 | POP3 | TCP | Mail retrieval, download and delete |
| 111 | rpcbind | TCP/UDP | ONC RPC port mapper; lists NFS and other RPC services |
| 123 | NTP | UDP | Network Time Protocol |
| 135 | MS RPC | TCP | Microsoft RPC endpoint mapper; DCOM and classic OPC DA start here |
| 137 | NetBIOS name | UDP | NetBIOS name service |
| 139 | NetBIOS session | TCP | NetBIOS session service; SMB over NetBIOS |
| 143 | IMAP | TCP | Mail retrieval, server-side folders |
| 161 | SNMP | UDP | SNMP agent queries; v1/v2c community strings travel in clear text |
| 162 | SNMP trap | UDP | SNMP traps to the manager |
| 389 | LDAP | TCP/UDP | Directory lookups (Active Directory) |
| 443 | HTTPS | TCP | Web over TLS |
| 445 | SMB | TCP | Windows file sharing directly over TCP |
| 464 | Kerberos password | TCP/UDP | Kerberos password change (kpasswd) |
| 500 | IKE | UDP | IPsec key exchange |
| 514 | Syslog | UDP | Log forwarding on UDP; 514/TCP is rsh (remote shell) |
| 587 | SMTP submission | TCP | Mail submission from clients with STARTTLS |
| 593 | RPC over HTTP | TCP | Microsoft RPC over HTTP endpoint mapper (Exchange, DCOM) |
| 623 | IPMI | UDP | Baseboard management (RMCP+); cipher 0 and hash leaks are classic findings |
| 631 | IPP | TCP | Internet Printing Protocol; CUPS web interface |
| 636 | LDAPS | TCP | LDAP over TLS |
| 873 | rsync | TCP | rsync daemon; anonymous modules leak files |
| 902 | VMware ESXi | TCP/UDP | VMware ESXi host agent / authentication daemon |
| 993 | IMAPS | TCP | IMAP over TLS |
| 995 | POP3S | TCP | POP3 over TLS |
| 1080 | SOCKS | TCP | SOCKS proxy |
| 1194 | OpenVPN | TCP/UDP | OpenVPN default, usually UDP |
| 1433 | MS SQL | TCP | Microsoft SQL Server |
| 1434 | MS SQL browser | UDP | SQL Server Browser; resolves named instances to ports |
| 1521 | Oracle DB | TCP | Oracle TNS listener |
| 1701 | L2TP | UDP | Layer 2 Tunneling Protocol |
| 1723 | PPTP | TCP | Legacy VPN; MS-CHAPv2 is broken |
| 1812 | RADIUS auth | UDP | RADIUS authentication |
| 1813 | RADIUS accounting | UDP | RADIUS accounting |
| 1883 | MQTT | TCP | MQTT broker (IIoT telemetry); anonymous access is common |
| 1900 | SSDP | UDP | UPnP discovery; amplification abuse |
| 2049 | NFS | TCP/UDP | Network File System; check exports for no_root_squash |
| 2181 | ZooKeeper | TCP | Apache ZooKeeper client port |
| 2375 | Docker API | TCP | Docker daemon without TLS; exposure means root on the host |
| 2376 | Docker API (TLS) | TCP | Docker daemon with TLS |
| 2379 | etcd | TCP | etcd client API; holds Kubernetes secrets |
| 3000 | Grafana | TCP | Grafana by default; also Node, Rails and other dev servers |
| 3128 | Squid proxy | TCP | Squid HTTP proxy |
| 3260 | iSCSI | TCP | iSCSI target |
| 3268 | Global Catalog | TCP | Active Directory Global Catalog over LDAP; 3269 for TLS |
| 3306 | MySQL | TCP | MySQL / MariaDB |
| 3389 | RDP | TCP | Remote Desktop Protocol |
| 3690 | Subversion | TCP | svnserve |
| 4500 | IPsec NAT-T | UDP | IPsec NAT traversal (ESP in UDP) |
| 5000 | Docker registry | TCP | Docker registry, Flask dev server, Synology DSM; nmap labels it upnp |
| 5432 | PostgreSQL | TCP | PostgreSQL |
| 5601 | Kibana | TCP | Kibana web UI for Elasticsearch |
| 5666 | NRPE | TCP | Nagios Remote Plugin Executor |
| 5672 | AMQP | TCP | AMQP (RabbitMQ); management UI on 15672 |
| 5900 | VNC | TCP | Virtual Network Computing; 5900 + display number |
| 5984 | CouchDB | TCP | Apache CouchDB HTTP API |
| 5985 | WinRM | TCP | Windows Remote Management over HTTP (PowerShell remoting); 5986 for HTTPS |
| 5986 | WinRM (HTTPS) | TCP | Windows Remote Management over HTTPS |
| 6000 | X11 | TCP | X Window System; 6000 + display number |
| 6379 | Redis | TCP | Redis; unauthenticated by default in older versions |
| 6443 | Kubernetes API | TCP | Kubernetes API server |
| 7001 | WebLogic | TCP | Oracle WebLogic (T3 and HTTP) |
| 8000 | HTTP alt | TCP | Alternate web port; Python http.server, Django dev server |
| 8006 | Proxmox | TCP | Proxmox VE web interface |
| 8009 | AJP | TCP | Tomcat AJP connector (Ghostcat, CVE-2020-1938) |
| 8080 | HTTP alt | TCP | The usual alternate HTTP port: proxies, Tomcat, dev servers |
| 8086 | InfluxDB | TCP | InfluxDB HTTP API |
| 8200 | Vault | TCP | HashiCorp Vault API |
| 8291 | MikroTik Winbox | TCP | MikroTik RouterOS Winbox management |
| 8443 | HTTPS alt | TCP | Alternate HTTPS port: Tomcat, Plesk, appliances |
| 8500 | Consul | TCP | HashiCorp Consul HTTP API and UI |
| 8883 | MQTT (TLS) | TCP | MQTT over TLS |
| 9090 | Prometheus | TCP | Prometheus server and web UI |
| 9092 | Kafka | TCP | Apache Kafka broker |
| 9100 | JetDirect | TCP | Raw printer port (HP JetDirect); also the Prometheus node exporter |
| 9200 | Elasticsearch | TCP | Elasticsearch REST API; 9300 is the transport port |
| 10000 | Webmin | TCP | Webmin admin UI (nmap labels it snet-sensor-mgmt) |
| 10250 | Kubelet | TCP | Kubelet API; anonymous access gives container exec |
| 11211 | memcached | TCP/UDP | memcached; UDP amplification abuse |
| 15672 | RabbitMQ management | TCP | RabbitMQ management UI (guest/guest) |
| 27017 | MongoDB | TCP | MongoDB; no auth by default in older versions |
| 51820 | WireGuard | UDP | WireGuard VPN default |
| Port | Service | Transport | Note |
|---|---|---|---|
| 21 | FTP | TCP | File Transfer Protocol control channel; credentials in clear text |
| 23 | Telnet | TCP | Unencrypted remote terminal; still common on PLCs and switches |
| 69 | TFTP | UDP | Trivial FTP; firmware, configs and PXE, no authentication |
| 80 | HTTP | TCP | Plain web traffic |
| 102 | S7comm (ISO-TSAP) | TCP | Siemens S7 PLCs and IEC 61850 MMS run over ISO-TSAP (RFC 1006) |
| 123 | NTP | UDP | Network Time Protocol |
| 135 | MS RPC | TCP | Microsoft RPC endpoint mapper; DCOM and classic OPC DA start here |
| 161 | SNMP | UDP | SNMP agent queries; v1/v2c community strings travel in clear text |
| 162 | SNMP trap | UDP | SNMP traps to the manager |
| 443 | HTTPS | TCP | Web over TLS |
| 502 | Modbus TCP | TCP | Modbus over TCP; no authentication, function codes read and write registers |
| 554 | RTSP | TCP | Real Time Streaming Protocol; IP cameras and media servers |
| 623 | IPMI | UDP | Baseboard management (RMCP+); cipher 0 and hash leaks are classic findings |
| 789 | Red Lion Crimson | TCP | Red Lion HMI programming (Crimson v3) |
| 1883 | MQTT | TCP | MQTT broker (IIoT telemetry); anonymous access is common |
| 1911 | Niagara Fox | TCP | Tridium Niagara building automation (Fox); 4911 for TLS |
| 1962 | PCWorx | TCP | Phoenix Contact PCWorx PLC protocol |
| 2222 | EtherNet/IP I/O | UDP | CIP implicit (I/O) messaging; explicit messaging is on 44818 |
| 2404 | IEC 60870-5-104 | TCP | IEC 104 telecontrol (power grids, substations) |
| 2455 | CODESYS v2 | TCP | CODESYS v2 runtime (many PLC brands, e.g. WAGO); v3 uses 11740 |
| 3671 | KNXnet/IP | UDP | KNX building automation over IP |
| 4000 | Emerson ROC Plus | TCP | Emerson ROC Plus (remote operations controllers, oil and gas) |
| 4840 | OPC UA | TCP | OPC Unified Architecture binary protocol; anonymous endpoints are a common finding |
| 4911 | Niagara Fox (TLS) | TCP | Tridium Niagara Fox over TLS |
| 5007 | Mitsubishi MELSOFT | TCP | Mitsubishi MELSEC PLC programming (MELSOFT connection) |
| 5094 | HART-IP | TCP/UDP | HART field instrument protocol over IP |
| 5683 | CoAP | UDP | Constrained Application Protocol (IoT); 5684 for DTLS |
| 8883 | MQTT (TLS) | TCP | MQTT over TLS |
| 9600 | Omron FINS | TCP/UDP | Omron FINS PLC protocol |
| 11740 | CODESYS v3 | TCP | CODESYS v3 runtime gateway; v2 uses 2455 |
| 17185 | VxWorks WDB | UDP | VxWorks debug agent; remote memory read/write if exposed |
| 18245 | GE SRTP | TCP | GE Fanuc Service Request Transport Protocol (PLCs) |
| 20000 | DNP3 | TCP/UDP | Distributed Network Protocol 3 (utilities, water, power) |
| 20547 | ProConOS | TCP | ProConOS / MULTIPROG PLC runtime |
| 34964 | PROFINET CM | UDP | PROFINET context manager (DCE/RPC); real-time I/O uses 34962 and 34963 |
| 44818 | EtherNet/IP | TCP/UDP | CIP explicit messaging (Rockwell / Allen-Bradley); I/O on 2222/UDP |
| 47808 | BACnet/IP | UDP | Building automation (0xBAC0); no authentication |