| 20 | TCP | FTP data | Active-mode FTP data channel. |
| 21 | TCP | FTP | File Transfer Protocol control channel. Plaintext. |
| 22 | TCP | SSH | Secure Shell; also carries SFTP and SCP. |
| 23 | TCP | Telnet | Unencrypted remote shell. Obsolete — use SSH. |
| 25 | TCP | SMTP | Mail transfer between servers. Often blocked outbound by ISPs. |
| 53 | TCP/UDP | DNS | Domain name resolution. UDP for queries, TCP for large answers and zone transfers. |
| 67 | UDP | DHCP server | DHCP server listens here for client requests. |
| 68 | UDP | DHCP client | DHCP client receives offers and acknowledgements here. |
| 69 | UDP | TFTP | Trivial FTP; used for network boot and device firmware. |
| 80 | TCP | HTTP | Unencrypted web traffic. Usually redirects to 443. |
| 88 | TCP/UDP | Kerberos | Kerberos key distribution centre authentication. |
| 110 | TCP | POP3 | Mailbox retrieval, plaintext. See 995 for the TLS version. |
| 111 | TCP/UDP | rpcbind | ONC RPC portmapper; needed by classic NFS. |
| 123 | UDP | NTP | Network Time Protocol clock synchronisation. |
| 135 | TCP | MSRPC | Microsoft RPC endpoint mapper. |
| 137 | UDP | NetBIOS name | NetBIOS name service on legacy Windows networks. |
| 139 | TCP | NetBIOS session | SMB over NetBIOS; superseded by port 445. |
| 143 | TCP | IMAP | Mailbox access, plaintext. See 993 for the TLS version. |
| 161 | UDP | SNMP | Network device monitoring and polling. |
| 162 | UDP | SNMP trap | Asynchronous SNMP notifications sent to a manager. |
| 194 | TCP | IRC | Internet Relay Chat, plaintext. |
| 389 | TCP | LDAP | Directory access, plaintext or STARTTLS. |
| 443 | TCP | HTTPS | TLS-encrypted web traffic; also QUIC/HTTP-3 over UDP. |
| 445 | TCP | SMB | Windows file sharing over TCP. Never expose to the internet. |
| 465 | TCP | SMTPS | Mail submission wrapped in implicit TLS. |
| 514 | UDP | syslog | Classic remote logging. Unauthenticated and unencrypted. |
| 587 | TCP | SMTP submission | The standard port for clients submitting mail, with STARTTLS. |
| 631 | TCP | IPP / CUPS | Internet Printing Protocol and the CUPS web interface. |
| 636 | TCP | LDAPS | LDAP wrapped in implicit TLS. |
| 873 | TCP | rsync | rsync daemon protocol. |
| 993 | TCP | IMAPS | IMAP over implicit TLS. |
| 995 | TCP | POP3S | POP3 over implicit TLS. |
| 1080 | TCP | SOCKS proxy | SOCKS4/SOCKS5 proxy, including SSH dynamic forwarding. |
| 1194 | UDP | OpenVPN | OpenVPN default tunnel port. |
| 1433 | TCP | MS SQL Server | Microsoft SQL Server database engine. |
| 1521 | TCP | Oracle DB | Oracle database listener. |
| 1723 | TCP | PPTP | Legacy VPN protocol; cryptographically broken. |
| 1883 | TCP | MQTT | IoT publish/subscribe messaging, plaintext (8883 for TLS). |
| 2049 | TCP/UDP | NFS | Network File System server. |
| 2181 | TCP | ZooKeeper | Apache ZooKeeper client port. |
| 2375 | TCP | Docker API | Unencrypted Docker daemon API. Exposing this grants root. |
| 2376 | TCP | Docker API (TLS) | Docker daemon API with TLS client certificates. |
| 3000 | TCP | Dev server | Conventional local port for Node, Next.js, Rails, and Grafana. |
| 3128 | TCP | Squid proxy | Squid HTTP caching proxy default port. |
| 3306 | TCP | MySQL | MySQL and MariaDB database server. |
| 3389 | TCP | RDP | Windows Remote Desktop. A frequent brute-force target. |
| 4200 | TCP | Angular dev server | Default ng serve development port. |
| 4369 | TCP | epmd | Erlang port mapper; used by RabbitMQ and Elixir clusters. |
| 5000 | TCP | Flask / dev server | Flask default, and macOS AirPlay Receiver — a common clash. |
| 5060 | TCP/UDP | SIP | Session Initiation Protocol signalling for VoIP. |
| 5173 | TCP | Vite dev server | Vite default development server port. |
| 5432 | TCP | PostgreSQL | PostgreSQL database server. |
| 5601 | TCP | Kibana | Kibana web interface for Elasticsearch. |
| 5672 | TCP | AMQP | RabbitMQ and other AMQP 0-9-1 brokers. |
| 5900 | TCP | VNC | Remote framebuffer display :0; each display adds one. |
| 5984 | TCP | CouchDB | Apache CouchDB HTTP API. |
| 6379 | TCP | Redis | Redis server. Unauthenticated by default — bind to localhost. |
| 6443 | TCP | Kubernetes API | kube-apiserver secure port. |
| 7000 | TCP | Cassandra / AirPlay | Cassandra inter-node gossip; also macOS AirPlay. |
| 8000 | TCP | Dev / HTTP alt | Django, python -m http.server, and many local APIs. |
| 8080 | TCP | HTTP alternate | Tomcat, Jenkins, and proxies; the classic non-privileged HTTP port. |
| 8086 | TCP | InfluxDB | InfluxDB HTTP API. |
| 8443 | TCP | HTTPS alternate | TLS on a non-privileged port; common for admin consoles. |
| 8883 | TCP | MQTT over TLS | Encrypted MQTT. |
| 9000 | TCP | PHP-FPM / MinIO | PHP-FPM FastCGI, MinIO, SonarQube, and Portainer. |
| 9090 | TCP | Prometheus | Prometheus web UI and query API. |
| 9092 | TCP | Kafka | Apache Kafka broker listener. |
| 9200 | TCP | Elasticsearch HTTP | Elasticsearch and OpenSearch REST API. |
| 9300 | TCP | Elasticsearch transport | Node-to-node cluster transport (pre-8.x clusters). |
| 11211 | TCP/UDP | Memcached | Memcached cache. UDP has been abused for amplification attacks. |
| 15672 | TCP | RabbitMQ UI | RabbitMQ management plugin web interface. |
| 27017 | TCP | MongoDB | MongoDB database server. |
| 50000 | TCP | DB2 / SAP | IBM DB2 instance and SAP application server range. |