Common network ports and what they're for
Port 80, 443, 22, 3306: what the most common network ports are for, and why some should stay closed.
What is a port?
A number (0 to 65535) that identifies a specific service on a networked machine, on top of its IP address. An IP says "which machine", a port says "which service on that machine".
Common web and mail ports
| Port | Protocol | Use |
|---|---|---|
| 80 | HTTP | Unencrypted web |
| 443 | HTTPS | Encrypted web (TLS) |
| 21 | FTP | File transfer |
| 22 | SSH | Secure remote connection |
| 25 | SMTP | Sending email (server-to-server) |
| 143 | IMAP | Receiving email |
| 587 | SMTP (submission) | Client-side encrypted email sending |
Databases
| Port | Service |
|---|---|
| 3306 | MySQL / MariaDB |
| 5432 | PostgreSQL |
| 6379 | Redis |
| 27017 | MongoDB |
These database ports should never be exposed directly to the Internet without a firewall and strict authentication — they're a frequent target of automated scans.
Well-known vs. dynamic ports
| Range | Name | Use |
|---|---|---|
| 0-1023 | Well-known ports | Standard services (need admin rights) |
| 1024-49151 | Registered ports | Specific applications |
| 49152-65535 | Dynamic / ephemeral ports | Assigned temporarily by the system |
Infrastructure and container ports
| Port | Service |
|---|---|
| 53 | DNS |
| 67/68 | DHCP |
| 123 | NTP (time sync) |
| 2375/2376 | Docker (remote API, unencrypted / TLS) |
| 6443 | Kubernetes API server |
Checking which ports are open
# Linux/macOS: ports listening locally ss -tulpn # or netstat -tulpn on older systems # Scan a remote host (with authorisation!) nmap -p 1-1000 example.com
Scanning ports on a machine you don't own, without explicit authorisation, is illegal in many jurisdictions — reserve nmap for your own systems or an authorised testing context (pentest, bug bounty).
Thanks for the feedback!