What is a port? TCP and UDP ports, port ranges and a common ports list

02TCP ports vs UDP ports: are they the same?

No. TCP and UDP keep separate port spaces. TCP 53 and UDP 53 are two different sockets, and a DNS server opens both. IANA usually registers a number for the same service on both protocols, but not always: in its registry TCP 514 is the old rsh "shell" service while UDP 514 is syslog, and TCP 520 is "efs" while UDP 520 is the RIP routing protocol.

The two protocols also behave differently when nothing is listening, which is how port scanners tell open from closed:

03Well-known, registered and ephemeral port ranges

RFC 6335 (BCP 165, August 2011) divides the 65,536 numbers into three ranges, shown in the table below, and IANA keeps the registry of which service holds which number. Port 0 is reserved; a program that binds to port 0 asks the operating system for any free port.

Operating systems add rules of their own. On Linux, binding below 1024 needs root or the CAP_NET_BIND_SERVICE capability, because ip_unprivileged_port_start defaults to 1024. Client ports come from each system's own ephemeral range, which is not always the IANA one: Linux uses 32768 to 60999 by default (ip_local_port_range), while Windows has used 49152 to 65535 since Windows Vista and Server 2008, up from 1025 to 5000 before.

04How to see which ports are listening on a server

On Linux, ss -tulpn lists every listening TCP and UDP socket with the process that owns it: t for TCP, u for UDP, l for listening, p for the process and n for numbers instead of service names. Run it with sudo to see processes of other users. The output below comes from an isolated test namespace in which a small script held six sockets.

Read the local address column first. 0.0.0.0 and [::] mean every IPv4 or IPv6 address on the host, including the public one; 127.0.0.1 means loopback only. In the example, PostgreSQL on 127.0.0.1:5432 cannot be reached from outside, while 0.0.0.0:53 can unless a firewall says otherwise. UDP sockets show UNCONN because UDP has no connections. On Windows, netstat -ano lists the same with process IDs. What an outsider sees is a separate test, because a firewall can hide a listening socket.

$ sudo ss -tulpn
Netid State  Recv-Q Send-Q Local Address:Port Peer Address:Port Process
udp   UNCONN 0      0            0.0.0.0:53        0.0.0.0:*    users:(("python3",pid=1234,fd=7))
udp   UNCONN 0      0          127.0.0.1:323       0.0.0.0:*    users:(("python3",pid=1234,fd=8))
tcp   LISTEN 0      128          0.0.0.0:22        0.0.0.0:*    users:(("python3",pid=1234,fd=3))
tcp   LISTEN 0      128          0.0.0.0:53        0.0.0.0:*    users:(("python3",pid=1234,fd=6))
tcp   LISTEN 0      128        127.0.0.1:5432      0.0.0.0:*    users:(("python3",pid=1234,fd=4))
tcp   LISTEN 0      128             [::]:443          [::]:*    users:(("python3",pid=1234,fd=5))

# one port only, without the header line
$ sudo ss -Htlnp 'sport = :22'

# an established connection: the client side uses an ephemeral port
$ ss -tn state established
Recv-Q Send-Q Local Address:Port  Peer Address:Port Process
0      0          127.0.0.1:22       127.0.0.1:35948
0      0          127.0.0.1:35948    127.0.0.1:22

05Common ports list: what runs where, and what should face the internet

The table covers the ports that matter most on servers, with two columns most lists leave out: whether the port should ever be reachable from the whole internet, and the published bandwidth amplification factor where the service has been abused for reflection. The factor is reply bytes divided by request bytes. Figures are from CISA alert TA14-017A unless marked; RDP is from NETSCOUT (January 2021) and SLP from Bitsight (April 2023). A dash means none of those sources lists a factor, not that the port is safe.

06Which ports should be open to the internet?

As few as the server's job requires, each for a reason you can name. A web server needs 80 and 443, a mail server 25 and the submission ports, an authoritative name server 53 over both UDP and TCP. Almost everything else in the table is a management, database, file-sharing or discovery protocol built for a trusted network.

• Start from default deny and open ports one by one, as set out in firewall configuration
• Bind internal services to 127.0.0.1 or a private address rather than 0.0.0.0, so one firewall mistake does not expose them
• Reach management ports (22, 3389, databases) over a VPN or from a short allowlist of source addresses
• Turn off UDP on services that do not need it; memcached has shipped with UDP disabled by default since version 1.5.6
• Re-check with ss after installing packages, because some services start listening as soon as they are installed
• Behind a reverse proxy, let the origin accept 80 and 443 from the proxy only; see how to hide your origin IP

07Why open UDP ports are abused for amplification

A UDP service answers whoever a packet claims to come from, and UDP source addresses can be forged. An attacker sends a small request carrying the victim's address, and the server sends its larger reply to the victim. At memcached's upper figure of about 51,000, one megabit per second of forged requests could in principle summon around 51 gigabits per second of replies, given enough exposed servers.

That is why the table says never for so many UDP services: an exposed amplifier harms someone else first, and your own uplink second, since you pay to send the replies. The mechanics and the wider family are in amplification attacks explained. TCP ports are abused differently, mostly by exhausting connection state, as in a SYN flood.

08What a reverse proxy or firewall changes about open ports

A reverse proxy or CDN carries only the protocols it speaks, normally HTTP and HTTPS. It shields those ports at the origin and absorbs floods aimed at the website, but it does nothing for SSH, mail, game or database ports on the same server, and nothing if attackers know the server's address and target another port directly.

A host firewall decides which ports answer, but it runs on the machine it protects: a flood that fills the uplink arrives before any rule is evaluated. Volumetric protection for non-HTTP ports needs filtering upstream of the link, which is network-level protection rather than a web proxy; Layer 3/4 vs Layer 7 sets out the difference.