20/tcp ftp-dataftps-data file-transfer cleartext exploitedWell-known FTP data transfer (active mode).
21/tcp ftpfile-transfer cleartext exploitedWell-known File Transfer Protocol control channel.
22/tcp sshsecure-shell remote encrypted exploitedWell-known Secure Shell — encrypted remote login and command execution.
23/tcp telnetremote cleartext exploitedWell-known Unencrypted remote login (legacy).
25/tcp smtpmail mail cleartext exploitedWell-known Simple Mail Transfer Protocol — server-to-server mail delivery.
53/tcp/udp domaindns name-resolution cleartext exploitedWell-known Domain Name System — resolves hostnames to IP addresses.
67/udp bootpsdhcp-server network cleartext Well-known DHCP server → client (offers/acks).
68/udp bootpcdhcp-client network cleartext Well-known DHCP client → server (discovers/requests).
69/udp tftpfile-transfer cleartext Well-known Trivial File Transfer Protocol — unauthenticated file transfer.
70/tcp gopherweb cleartext Well-known Gopher protocol (pre-Web document retrieval, legacy).
79/tcp fingerother cleartext Well-known Finger user-information protocol.
80/tcp httpwww web cleartext exploitedWell-known HyperText Transfer Protocol — unencrypted web traffic.
88/tcp/udp kerberossecurity encryptedWell-known Kerberos network authentication service.
110/tcp pop3mail cleartext Well-known Post Office Protocol v3 — client mail download.
111/tcp/udp sunrpcportmapper rpcbind network cleartext Well-known ONC RPC portmapper — maps RPC programs to port numbers.
113/tcp identauth other cleartext Well-known Ident protocol — looks up the owner of a TCP connection.
119/tcp nntpother cleartext Well-known Network News Transfer Protocol (Usenet).
123/udp ntpnetwork cleartext exploitedWell-known Network Time Protocol — clock synchronization.
135/tcp msrpcepmap dcom network cleartext Well-known Microsoft RPC endpoint mapper.
137/udp netbios-nsnetwork cleartext Well-known NetBIOS Name Service.
138/udp netbios-dgmnetwork cleartext Well-known NetBIOS Datagram Service.
139/tcp netbios-ssnfile-transfer cleartext exploitedWell-known NetBIOS Session Service (SMB over NetBIOS).
143/tcp imapmail cleartext Well-known Internet Message Access Protocol — client mailbox access.
161/udp snmpnetwork cleartext exploitedWell-known Simple Network Management Protocol — device monitoring.
162/udp snmptrapnetwork cleartext Well-known SNMP Trap — async device notifications.
179/tcp bgpnetwork cleartext Well-known Border Gateway Protocol — inter-AS routing.
194/tcp ircmessaging cleartext Well-known Internet Relay Chat.
389/tcp ldapdirectory cleartext Well-known Lightweight Directory Access Protocol.
443/tcp httpshttp-tls web encryptedWell-known HTTP over TLS — encrypted web traffic.
445/tcp microsoft-dssmb cifs file-transfer encrypted exploitedWell-known Server Message Block — Windows file/printer sharing.
465/tcp smtpssubmission-tls ssmtp mail encryptedWell-known SMTP over implicit TLS (message submission).
500/udp isakmpike security encryptedWell-known Internet Security Association and Key Management Protocol (IKE / IPsec phase 1).
514/udp syslogother cleartext Well-known Syslog remote logging.
515/tcp printerlpd lpr printing cleartext Well-known Line Printer Daemon — Unix printing.
520/udp ripnetwork cleartext Well-known Routing Information Protocol.
540/tcp uucpfile-transfer cleartext Well-known Unix-to-Unix Copy Protocol.
546/udp dhcpv6-clientnetwork cleartext Well-known DHCPv6 client.
547/udp dhcpv6-servernetwork cleartext Well-known DHCPv6 server.
548/tcp afpappletalk-filing file-transfer encryptedWell-known Apple Filing Protocol (AppleShare).
554/tcp rtspmedia cleartext Well-known Real Time Streaming Protocol.
587/tcp submissionsmtp-submission mail encryptedWell-known SMTP message submission (client → server) — STARTTLS.
631/tcp ippcups printing encryptedWell-known Internet Printing Protocol (CUPS).
636/tcp ldapsldap-tls directory encryptedWell-known LDAP over TLS.
691/tcp msexch-routingmail cleartext Well-known Microsoft Exchange routing.
873/tcp rsyncfile-transfer cleartext Well-known rsync file synchronization.
902/tcp vmware-authremote encryptedWell-known VMware Authentication Daemon.
953/tcp rndcname-resolution cleartext Well-known BIND Remote Name Daemon Control.
990/tcp ftpsftp-tls file-transfer encryptedWell-known FTP over implicit TLS.
992/tcp telnetsremote encryptedWell-known Telnet over TLS.
993/tcp imapsimap-tls mail encryptedWell-known IMAP over TLS.
995/tcp pop3spop3-tls mail encryptedWell-known POP3 over TLS.
1080/tcp sockssocks5 network cleartext Registered SOCKS proxy.
1099/tcp rmiregistryjmx-rmi remote cleartext Registered Java RMI registry / JMX.
1194/udp openvpnsecurity encryptedRegistered OpenVPN.
1241/tcp nessussecurity encryptedRegistered Nessus vulnerability scanner.
1311/tcp dell-openmanageremote encryptedRegistered Dell OpenManage Server Administrator.
1352/tcp lotusnotesibm-domino mail cleartext Registered IBM Lotus Notes / Domino.
1414/tcp ibm-mqmessaging cleartext Registered IBM MQ messaging.
1433/tcp ms-sql-smssql database encrypted exploitedRegistered Microsoft SQL Server.
1434/udp ms-sql-mdatabase cleartext Registered Microsoft SQL Server browser.
1494/tcp icacitrix remote encryptedRegistered Citrix ICA (Independent Computing Architecture).
1521/tcp ncube-lmoracle database cleartext Registered Oracle Database listener.
1524/tcp ingreslockdatabase cleartext Registered Ingres database lock; common backdoor port.
1533/tcp imailmail cleartext Registered IMail Server.
1701/udp l2tpsecurity cleartext Registered Layer 2 Tunneling Protocol.
1720/tcp h323media cleartext Registered H.323 call signaling (VoIP).
1723/tcp pptpsecurity cleartext Registered Point-to-Point Tunneling Protocol.
1755/tcp/udp ms-streamingmms media cleartext Registered Microsoft Media Server (streaming).
1812/udp radiusradius-auth security cleartext Registered RADIUS authentication.
1813/udp radius-acctsecurity cleartext Registered RADIUS accounting.
1863/tcp msnpmessaging cleartext Registered MSN Messenger protocol (legacy).
1900/udp upnpssdp network cleartext exploitedRegistered Universal Plug and Play / SSDP discovery.
1985/udp hsrpnetwork cleartext Registered Cisco Hot Standby Router Protocol.
2000/tcp cisco-sccpskinny media cleartext Registered Cisco Skinny Call Control Protocol (VoIP).
2049/tcp/udp nfsfile-transfer cleartext exploitedRegistered Network File System.
2086/tcp gnunetnetwork encryptedRegistered GNUnet.
2181/tcp zookeeperdatabase cleartext Registered Apache ZooKeeper coordination service.
2375/tcp dockerremote cleartext exploitedRegistered Docker daemon (unencrypted).
2376/tcp docker-tlsremote encryptedRegistered Docker daemon over TLS.
2424/tcp msexch-rfrmail cleartext Registered Microsoft Exchange RFR.
2598/tcp citriximacitrix-ima remote encryptedRegistered Citrix IMA.
2628/tcp dictother cleartext Registered DICT dictionary protocol.
2638/tcp sybasedatabase cleartext Registered Sybase / SAP SQL Anywhere.
2775/tcp smppmessaging cleartext Registered Short Message Peer-to-Peer (SMS gateway).
2944/tcp/udp megaco-h248media cleartext Registered Megaco / H.248 (VoIP gateway control).
3050/tcp gds-dbfirebird database cleartext Registered Firebird / InterBase database.
3074/udp xbox-livemessaging encryptedRegistered Xbox Live multiplayer.
3128/tcp squid-httpnetwork cleartext Registered Squid web proxy.
3260/tcp iscsiiscsi-target database cleartext Registered iSCSI block storage.
3268/tcp ms-ad-global-catalogdirectory cleartext Registered Microsoft Active Directory Global Catalog.
3269/tcp ms-ad-gc-ssldirectory encryptedRegistered Microsoft AD Global Catalog over TLS.
3306/tcp mysqldatabase encrypted exploitedRegistered MySQL / MariaDB database.
3389/tcp ms-wbt-serverrdp remote encrypted exploitedRegistered Microsoft Remote Desktop Protocol.
3478/udp stunnetwork cleartext Registered Session Traversal Utilities for NAT (WebRTC).
3690/tcp svnfile-transfer cleartext Registered Subversion version control.
3702/udp ws-discoverynetwork cleartext Registered Web Services Dynamic Discovery.
3724/tcp wowmessaging encryptedRegistered World of Warcraft.
3899/tcp remote-asremote encryptedRegistered Remote-as / Apple Remote Desktop.
4022/tcp syslog-tlsother encryptedRegistered Syslog over TLS (also 6514).
4321/tcp rwhoisnetwork cleartext Registered Referral Whois.
4500/udp ipsec-nat-tsecurity encryptedRegistered IPsec NAT Traversal.
4567/tcp tramother cleartext Registered 奇异 Mark / Sanswire TRAM.
4848/tcp appserv-httpweb cleartext Registered GlassFish Application Server admin.
5000/tcp upnp-altnetwork cleartext Registered UPnP (alternate) / Flask default.
5004/udp rtpmedia cleartext Registered Real-time Transport Protocol (media).
5005/udp rtp-rtcpmedia cleartext Registered RTP Control Protocol (RTCP).
5060/tcp/udp sipmessaging cleartext Registered Session Initiation Protocol (VoIP signaling).
5061/tcp sipsmessaging encryptedRegistered SIP over TLS.
5190/tcp aimmessaging cleartext Registered AOL Instant Messenger (legacy).
5222/tcp xmpp-clientjabber-client messaging encryptedRegistered XMPP client-to-server.
5269/tcp xmpp-serverjabber-server messaging encryptedRegistered XMPP server-to-server.
5351/udp nat-pmpnetwork cleartext Registered NAT Port Mapping Protocol (Apple).
5353/udp mdnsname-resolution cleartext Registered Multicast DNS (Bonjour, Avahi).
5355/udp llmnrname-resolution cleartext Registered Link-Local Multicast Name Resolution.
5432/tcp postgresqldatabase encryptedRegistered PostgreSQL database.
5500/tcp fcp-addr-srvr1vnc-http-legacy remote cleartext Registered VNC HTTP viewer (legacy).
5666/tcp nrpenetwork cleartext Registered Nagios Remote Plugin Executor.
5672/tcp amqpmessaging encryptedRegistered RabbitMQ / AMQP messaging.
5683/udp coapnetwork cleartext Registered Constrained Application Protocol (IoT).
5800/tcp vnc-httpremote cleartext Registered VNC web viewer (Java applet, legacy).
5900/tcp rfbvnc remote cleartext exploitedRegistered Virtual Network Computing remote desktop.
5984/tcp couchdbdatabase cleartext Registered Apache CouchDB.
5985/tcp wsmanwinrm-http remote cleartext Registered Windows Remote Management (HTTP).
5986/tcp wsmanswinrm-https remote encryptedRegistered Windows Remote Management (HTTPS).
6000/tcp x11remote cleartext Registered X Window System (X11).
6379/tcp redisdatabase cleartext exploitedRegistered Redis in-memory data store.
6443/tcp k8s-apisecurity encryptedRegistered Kubernetes API server.
6600/tcp mpdmedia cleartext Registered Music Player Daemon.
6667/tcp ircuirc-alt messaging cleartext Registered IRC (common alternate).
6697/tcp ircsmessaging encryptedRegistered IRC over TLS.
6881/tcp/udp bittorrentfile-transfer cleartext Registered BitTorrent (common client port).
7000/tcp afs3-fileserverfile-transfer cleartext Registered Andrew File System v3.
7001/tcp afs3-callbackfile-transfer cleartext Registered AFS v3 callback.
7100/tcp font-servicefs other cleartext Registered X11 font service.
7474/tcp neo4jdatabase cleartext Registered Neo4j graph database (Bolt on 7687).
7547/tcp cwmptr-069 network cleartext Registered CPE WAN Management Protocol (TR-069).
7687/tcp neo4j-boltdatabase encryptedRegistered Neo4j Bolt protocol.
7777/tcp cbtother cleartext Registered Computer-Based Telephony; common alternate for Unreal Tournament.
8000/tcp irdmihttp-alt-1 web cleartext Registered HTTP alternate (common dev port).
8008/tcp http-altweb cleartext Registered HTTP alternate.
8009/tcp ajp13web cleartext Registered Apache JServ Protocol (Tomcat AJP).
8080/tcp http-proxyhttp-alt-2 web cleartext Registered HTTP alternate / proxy (common).
8081/tcp sunproxyadminnetwork cleartext Registered Sun proxy admin.
8086/tcp influxdbdatabase cleartext Registered InfluxDB HTTP API.
8088/tcp radan-httpweb cleartext Registered Radan HTTP; common alternate for various admin panels.
8089/tcp splunkother encryptedRegistered Splunk management / REST.
8161/tcp activemq-webconsolemessaging cleartext Registered ActiveMQ Web Console.
8200/tcp trivnet1security encryptedRegistered Trivenet; common alternate for Vault dev server.
8333/tcp bitcoinother encryptedRegistered Bitcoin Core daemon.
8443/tcp https-altweb encryptedRegistered HTTPS alternate (admin panels, dev).
8530/tcp wsussecurity cleartext Registered Windows Server Update Services (HTTP).
8531/tcp wsus-tlssecurity encryptedRegistered WSUS over TLS.
8649/tcp ganglianetwork cleartext Registered Ganglia monitoring.
8765/tcp ultraseek-httpweb cleartext Registered Ultraseek HTTP; common alternate for various daemons.
8804/tcp truecmweb cleartext Registered TrueCM; common alternate for various admin panels.
8834/tcp nessus-tlssecurity encryptedRegistered Nessus web UI over TLS.
8888/tcp newsedge-serverhttp-alt-3 web cleartext Registered HTTP alternate (common dev/admin port).
9000/tcp cslistenerhttp-alt-4 php-fpm-1 web cleartext Registered PHP-FPM alternate; SonarQube; common dev port.
9001/tcp tor-orportsecurity encryptedRegistered Tor relay ORPort.
9050/tcp tor-sockssecurity encryptedRegistered Tor SOCKS proxy.
9051/tcp tor-controlsecurity cleartext Registered Tor control port.
9080/tcp glrpchttp-alt-5 web cleartext Registered HTTP alternate (often app servers).
9090/tcp websmprometheus network cleartext Registered Prometheus metrics; WebSM.
9091/tcp xmltec-xmlmailother cleartext Registered XML mail; common alternate for various daemons (Transmission, etc.).
9100/tcp jetdirectpdl-data-stream printing cleartext Registered HP JetDirect / raw printing.
9200/tcp elasticsearchdatabase cleartext exploitedRegistered Elasticsearch HTTP API.
9300/tcp elasticsearch-transportdatabase encryptedRegistered Elasticsearch transport (node-to-node).
9418/tcp gitfile-transfer cleartext Registered Git protocol (unauthenticated pull).
9443/tcp tungsten-httpshttps-alt-2 web encryptedRegistered HTTPS alternate (admin/dev).
9500/tcp ismserverother cleartext Registered ISM server; common alternate for various daemons.
9876/tcp sdcyborg-systems other cleartext Registered Session Director; common alternate for various daemons.
9990/tcp osm-appsrvrweb cleartext Registered WildFly admin console.
9999/tcp distincthttp-alt-6 web cleartext Registered HTTP alternate (common dev/admin port).
10000/tcp ndmpwebmin web encryptedRegistered Webmin admin panel; NDMP backup.
10050/tcp zabbix-agentnetwork cleartext Registered Zabbix agent.
10051/tcp zabbix-servernetwork cleartext Registered Zabbix server / proxy.
11211/tcp memcachememcached database cleartext exploitedRegistered Memcached key-value cache.
11371/tcp hkpsecurity cleartext Registered OpenPGP HTTP Keyserver Protocol.
15001/tcp tor-hiddensecurity encryptedRegistered Tor hidden-service port (common).
15672/tcp rabbitmq-mgmtmessaging cleartext Registered RabbitMQ management UI.
25565/tcp minecraftother cleartext Registered Minecraft server.
25826/udp collectdnetwork cleartext Registered collectd metrics.
26257/tcp cockroachdbdatabase encryptedRegistered CockroachDB SQL.
27015/udp halflifesrcds messaging cleartext Registered Steam / Source engine game server.
27017/tcp mongodbdatabase cleartext exploitedRegistered MongoDB database.
32400/tcp plexmedia encryptedRegistered Plex media server.
33434/udp traceroutenetwork cleartext Registered Default traceroute base port.
50000/tcp ibm-db2database encryptedDynamic IBM Db2 database.
50070/tcp hdfs-namenodedatabase cleartext Dynamic Hadoop HDFS NameNode web UI.
50075/tcp hdfs-datanodedatabase cleartext Dynamic Hadoop HDFS DataNode web UI.
50090/tcp yarn-rmdatabase cleartext Dynamic Hadoop YARN ResourceManager.
61613/tcp stompmessaging cleartext Dynamic STOMP messaging (ActiveMQ).