Common Ports Reference

Q: How do I see listening ports on my machine?

On Linux use ss -tlnp or netstat -tlnp; on macOS lsof -i -P; on Windows netstat -ano.

Common TCP/UDP port reference: well-known (0-1023) ports mapped to common services (SSH, HTTP, HTTPS, databases …) with short descriptions.

Practical Notes

Ports below 1024 need privileges on LinuxNon-root processes cannot bind 80/443; the usual container pattern is to listen on 8080 and map it. Starting as an unprivileged user on port 80 yields EACCES, and the message is a bare permission denied that rarely points at port privileges.
Exposing 1433/3306/6379 to the internet is a top attack surfaceDatabase and Redis ports should never be public; Redis ships without auth by default and has been abused to write SSH keys. Bind to the private network or a tunnel and restrict sources with security groups.
"Port already in use" depends on the bind address127.0.0.1:3000, 0.0.0.0:3000 and IPv6 [::]:3000 are distinct bindings, which explains both "no process is using it yet it will not start" and "works locally but not from the LAN". Check the listen address with ss -lntp before concluding anything.

Data Sources

IANA Service Name and Transport Protocol Port Number Registry
RFC 6335

Codes, names and definitions above come from public specifications; we claim no originality over the specification data itself. The arrangement, Chinese annotations and practical notes on this page are written by us.

How It Works

A port is the transport-layer logical address (0-65535) that distinguishes applications on the same host. A connection is uniquely identified by IP plus protocol plus port: a server listens on a well-known or registered port (e.g. 443) while the client initiates from an ephemeral port (49152-65535); the 4-tuple (src IP, src port, dst IP, dst port) tells sessions apart.

IANA splits the range into three bands: 0-1023 well-known (system services, usually need admin to bind), 1024-49151 registered (apps register with IANA), 49152-65535 dynamic or private (ephemeral). Firewalls allow or block by destination port, so which ports are open or closed directly defines what external clients can reach.

When to Use This Table

This table is for confirming which service a port number maps to. It covers the ports you meet most often in operations and development: remote login, databases, web, mail and monitoring. Looking up ports is a high-frequency step in network troubleshooting.

When not to consult it: you are making a full network diagnosis. Timeout, connection refused and connected-but-unresponsive are three different problems, and the port number bears on only some of them. A correct port does not mean the service works: the port may be open while nothing is listening, or listening while a firewall drops the traffic.

Rule of thumb: start at the protocol layer. Grouped ports such as 20/21, 143/993, 25/110/143/465/587 belong to one service across different channels (control/data, send/receive, plaintext/TLS), and looking up only one of them is close to looking up none.

Mind that a port is not a unique identifier: the same port can host different protocols (8080 may be HTTP or a custom app), and modern services widely use non-standard ports (3000, 5173, 8000 and so on) — precisely the parts this table cannot cover.

Boundaries and Common Pitfalls

An open port does not mean a working service
Telnet succeeding while requests fail has three common causes: (1) the application process is not really listening (the container is up but the service inside is not ready); (2) it listens on 127.0.0.1 rather than 0.0.0.0, so only local connections are accepted; (3) a reverse proxy occupies the port but the backend is unreachable. Order of investigation: curl locally to confirm the app itself is alive, then check the listening address with ss -tlnp or netstat -an, and only then look at network policy.
Moving SSH off 22 means changing related configuration too
The most common emergency move is relocating SSH to a high port such as 2222 to reduce brute-force noise. Three places must change together: the Port directive in sshd_config, the server firewall rules, and the cloud security group or network ACL. Changing only one leaves you locked out with no way back. Moving the port does not hide you from an attacker — they scan all ports, so it only reduces log noise and passive discovery. It is not a security measure.
Ports mean different things inside containers and Kubernetes
In Docker, -p 8080:80 maps a host port on the left to a container port on the right, and the application inside only knows its own. In Kubernetes, the Service port and targetPort introduce yet another layer, and a container listening on a narrow address is still reachable through the Service because kube-proxy forwards. When a port "is not working", first establish which layer the port number you are reading belongs to — that is the most common wrong turn in such environments.

How This Relates to Neighbours

For status code semantics (the difference between 502 and 504, and who returns 502), use the in-site HTTP status codes page; this table only answers which service a port maps to.

Checking firewall rules, finding port holders with ss or lsof, and reading system logs are operational commands, out of scope here.

For the DNS behaviour behind port 53, the in-site DNS and character-encoding references are the right place; this table is a port lookup only.

If the goal is configuring a reverse proxy or load balancer, you need design and security assessment rather than a port cheat sheet.

Practical Snippet

Key points: (1) debug an unreachable port in this order — ss to check the listener, local curl to verify the app, only then firewall and security groups; reversing the order wastes time; (2) whether the listener binds 127.0.0.1 or 0.0.0.0 is the most overlooked detail; (3) in containers distinguish the host port (left of -p) from the container port (right), and in Kubernetes there is an extra targetPort layer; (4) changing the SSH port requires editing sshd_config, the firewall and the cloud security group together, and validating with sshd -t before reload.

# ① 排「端口不通」的三步定位（顺序很重要）
ss -tlnp | grep ':8080'        # ① 有人在监听吗？监听地址是 127.0.0.1 还是 0.0.0.0？
curl -sS -o /dev/null -w '%{http_code}
' http://127.0.0.1:8080/   # ② 应用本身活着吗？
# ③ 两者都正常却外部访问不到 → 才轮到防火墙 / 安全组 / 负载均衡

# ② 端口占用排查
sudo lsof -i :8080 -sTCP:LISTEN
sudo ss -tlnp | grep 8080
# Windows：netstat -ano | findstr :8080，然后 taskkill /PID <pid> /F

# ③ 容器场景：分清宿主机端口与容器端口
docker ps --format '{{.Names}}	{{.Ports}}'     # 0.0.0.0:8080->80/tcp
# 左边是宿主机端口，右边是容器内端口；容器内应用只认右边那个
docker exec <name> sh -c 'ss -tlnp'              # 确认容器内实际监听的端口

# ④ SSH 改端口要同步改三处（否则会断连）
# ① /etc/ssh/sshd_config: Port 2222
# ② 防火墙: ufw allow 2222/tcp && ufw deny 22/tcp
# ③ 云安全组 / 网络 ACL 放行 2222
sshd -t && systemctl reload sshd                   # 先校验配置语法再 reload，别直接 restart

Port	Service	Note
20/21	FTP	File transfer (21 control, 20 data)
22	SSH	Secure remote login / SCP / SFTP
23	Telnet	Plaintext remote terminal (insecure)
25	SMTP	Mail sending
53	DNS	Domain name resolution
67/68	DHCP	Dynamic host configuration
69	TFTP	Trivial file transfer
80	HTTP	Hypertext transfer (plaintext)
110	POP3	Mail retrieval (POP3)
111	RPC	Remote procedure call
123	NTP	Network time sync
135	MS-RPC	Windows RPC
137-139	NetBIOS	Windows file/print sharing (NetBIOS)
143	IMAP	Mail retrieval with folders (IMAP)
161/162	SNMP	Network management (SNMP)
179	BGP	Border gateway routing (BGP)
194	IRC	Internet relay chat
389	LDAP	Lightweight directory access (LDAP)
443	HTTPS	Encrypted hypertext transfer (TLS)
465	SMTPS	Encrypted mail sending (SMTPS)
514	Syslog	System logging (Syslog)
587	SMTP Submission	Mail submission (encrypted)
636	LDAPS	Encrypted directory access (LDAPS)
993	IMAPS	Encrypted mail retrieval (IMAPS)
995	POP3S	Encrypted mail retrieval (POP3S)
1433	MSSQL	SQL Server database
1521	Oracle	Oracle database
2049	NFS	Network file system (NFS)
3306	MySQL	MySQL database
3389	RDP	Windows remote desktop (RDP)
5432	PostgreSQL	PostgreSQL database
5672	RabbitMQ	Message queue (RabbitMQ)
6379	Redis	In-memory key-value store (Redis)
8080	HTTP-Alt	Common HTTP alternative (dev)
8443	HTTPS-Alt	Common HTTPS alternative (dev)
9092	Kafka	Distributed event stream (Kafka)
9200	Elasticsearch	Search/analytics engine (Elasticsearch)
11211	Memcached	Memory cache (Memcached)
27017	MongoDB	Document database (MongoDB)

Frequently Asked Questions

Why are 0-1023 called "well-known ports"?

IANA reserves 0-1023 for system/well-known services. They usually require root (or admin) to bind, used by HTTP, SSH, DNS and other standard services.

How are port ranges divided?

0-1023 well-known (system reserved); 1024-49151 registered (user programs register with IANA); 49152-65535 dynamic/private (ephemeral allocation).

How do I see listening ports on my machine?

On Linux use ss -tlnp or netstat -tlnp; on macOS lsof -i -P; on Windows netstat -ano.

Why do dev environments prefer 8080 / 8443?

80/443 are often occupied and need admin to bind; 8080/8443 avoid conflicts and need no privilege, so frameworks and local servers default to them.