mrnx/network

Port reference

Common ports and protocols with notes on what to watch for. Search by number, service or keyword.

Show only
PortProtoServiceNotes
20-21TCPFTPFile sharingCleartextCredentials and data in plaintext. Use SFTP (22) or FTPS instead.
22TCPSSH / SFTP / SCPRemote accessConstantly brute-forced when exposed. Use key auth and disable password login.
23TCPTelnetRemote accessCleartextKeep internalPlaintext remote shell. Common Mirai/IoT botnet target. Replace with SSH.
25TCPSMTPMailServer-to-server mail relay. Often blocked outbound by ISPs. STARTTLS is opportunistic.
49TCPTACACS+Directory & authKeep internalDevice AAA. Body obfuscated with a shared secret, not real encryption — keep it on the management network.
53TCP/UDPDNSDNS & timeAmplificationOpen resolvers are abused for amplification. TCP is used for large responses and zone transfers.
67-68UDPDHCP (server/client)Network infraKeep internalRogue DHCP servers can hijack clients — use DHCP snooping on switches.
69UDPTFTPFile sharingCleartextKeep internalNo authentication. Used for PXE boot and device firmware/config.
80TCPHTTPWebCleartextRedirect to HTTPS. Also used for ACME HTTP-01 certificate challenges.
88TCP/UDPKerberosDirectory & authKeep internalActive Directory authentication. Watch for Kerberoasting and AS-REP roasting.
110TCPPOP3MailCleartextUse POP3S (995).
111TCP/UDPRPCbind / portmapperFile sharingKeep internalAmplificationExposes RPC service list (NFS). Abused for amplification.
123UDPNTPDNS & timeAmplificationLegacy monlist queries cause large amplification. Disable on public servers.
135TCPMS RPC endpoint mapperDirectory & authKeep internalWindows DCOM/RPC. Never expose to the internet.
137-139TCP/UDPNetBIOSFile sharingKeep internalName service (137/udp), datagram (138/udp), session (139/tcp). Legacy; leaks host info.
143TCPIMAPMailCleartextUse IMAPS (993).
161-162UDPSNMP / SNMP trapMonitoring & opsKeep internalAmplificationv1/v2c send the community string in plaintext. Prefer SNMPv3 with authPriv.
179TCPBGPNetwork infraKeep internalFilter to known peers, use TCP-AO/MD5 and GTSM (TTL security).
389TCP/UDPLDAPDirectory & authCleartextKeep internalSimple binds send passwords in plaintext. Use LDAPS (636) or StartTLS; enable LDAP signing.
443TCP/UDPHTTPS (UDP = QUIC / HTTP/3)WebTLS. Many VPNs (SSL VPN, OpenVPN TCP) also run here to pass firewalls.
445TCPSMBFile sharingKeep internalWannaCry/EternalBlue vector. Disable SMBv1. Never expose to the internet.
465TCPSMTPS (submission, implicit TLS)MailClient mail submission over TLS (RFC 8314).
500UDPIKE (IPsec)VPN & tunnelsIPsec key exchange. IKEv1 aggressive mode leaks a crackable PSK hash.
514UDPSyslogMonitoring & opsCleartextKeep internalUnauthenticated and spoofable. Use syslog over TLS (6514/tcp) across untrusted links.
520UDPRIPNetwork infraKeep internalUse RIPv2 authentication or passive interfaces to prevent route injection.
546-547UDPDHCPv6 (client/server)Network infraKeep internalRogue DHCPv6 / RA attacks — use RA Guard and DHCPv6 Guard.
587TCPSMTP submission (STARTTLS)MailAuthenticated client submission. Enforce STARTTLS before AUTH.
636TCPLDAPSDirectory & authKeep internalLDAP over TLS.
830TCPNETCONF over SSHNetwork infraKeep internalNetwork device automation (RFC 6242).
853TCPDNS over TLSDNS & timeEncrypted DNS (RFC 7858). DoH uses 443.
873TCPrsync daemonFile sharingCleartextKeep internalUnencrypted; misconfigured modules often allow anonymous reads. Prefer rsync over SSH.
993TCPIMAPSMailIMAP over TLS.
995TCPPOP3SMailPOP3 over TLS.
1194UDPOpenVPNVPN & tunnelsDefault port; can also run on TCP.
1433TCPMicrosoft SQL ServerDatabasesKeep internalFrequently brute-forced (sa account). Never expose directly.
1521TCPOracle DB listenerDatabasesKeep internalNever expose directly.
1701UDPL2TPVPN & tunnelsCleartextNo encryption on its own — run inside IPsec (L2TP/IPsec).
1723TCPPPTPVPN & tunnelsMS-CHAPv2 is broken. Do not use; migrate to WireGuard or IPsec.
1812-1813UDPRADIUS (auth / accounting)Directory & authKeep internalOnly the password attribute is obscured. Vulnerable to Blast-RADIUS (2024) without Message-Authenticator; consider RadSec.
1883TCPMQTTMessaging & IoTCleartextKeep internalIoT messaging; often deployed without auth. Use 8883 (TLS) when crossing networks.
1900UDPSSDP / UPnPHomelabKeep internalAmplificationDevice discovery. Disable UPnP on the internet-facing router.
2049TCP/UDPNFSFile sharingKeep internalNFSv3 trusts client UIDs. Restrict exports by host and use NFSv4 with Kerberos where possible.
2375TCPDocker API (plain)Monitoring & opsCleartextKeep internalUnauthenticated root on the host. Never bind to a network interface.
2376TCPDocker API (TLS)Monitoring & opsKeep internalRequires client certificates; still effectively root access.
3000TCPGrafanaMonitoring & opsKeep internalDefault admin/admin on first login — change it.
3306TCPMySQL / MariaDBDatabasesKeep internalBind to localhost or a private network.
3389TCP/UDPRDPRemote accessKeep internalTop ransomware entry point. Put it behind a VPN; enable NLA.
3784UDPBFDNetwork infraKeep internalFast link-failure detection for routing protocols.
4500UDPIPsec NAT-TVPN & tunnelsESP encapsulated in UDP when NAT is detected.
4789UDPVXLANNetwork infraCleartextKeep internalNo encryption or authentication; keep on the underlay only.
5060-5061TCP/UDPSIP (5061 = TLS)Messaging & IoTHeavily scanned for toll fraud. Restrict to your provider.
5353UDPmDNSHomelabKeep internalBonjour/Avahi discovery. Needs a reflector to cross VLANs.
5432TCPPostgreSQLDatabasesKeep internalRestrict with pg_hba.conf; require scram-sha-256.
5900TCPVNCRemote accessCleartextKeep internalWeak auth, often unencrypted. Tunnel over SSH or VPN.
6379TCPRedisDatabasesKeep internalNo auth by default in older versions; exposed instances are hijacked within hours.
6443TCPKubernetes API serverMonitoring & opsKeep internalRestrict by source IP; disable anonymous auth.
8006TCPProxmox VE web UIHomelabKeep internalRoot-level hypervisor access. Keep on the LAN or behind a VPN; enable 2FA.
8080TCPHTTP alternate / proxiesWebCleartextCommon for app servers, admin panels and proxies.
8123TCPHome AssistantHomelabPut behind a reverse proxy with TLS; enable MFA if exposed.
8443TCPHTTPS alternateWebCommon for admin UIs (UniFi, firewalls).
8883TCPMQTT over TLSMessaging & IoTEncrypted MQTT.
9090TCPPrometheusMonitoring & opsKeep internalNo auth by default; exposes topology and labels.
9100TCPnode_exporter / JetDirectMonitoring & opsKeep internalPrometheus host metrics, or raw printing on printers. Both unauthenticated.
9200TCPElasticsearchDatabasesKeep internalSource of many data leaks. Enable security features and never expose.
11211TCP/UDPMemcachedDatabasesKeep internalAmplificationUDP amplification up to ~50,000× (1.3 Tbps GitHub attack, 2018). Disable UDP.
27017TCPMongoDBDatabasesKeep internalThousands of exposed instances ransomed. Enable auth and bind to localhost.
51820UDPWireGuardVPN & tunnelsDefault port. Silent to unauthenticated packets, so it does not show up in scans.

Cleartext unencrypted by default ·Keep internal should not be reachable from the internet ·Amplification abused in UDP reflection DDoS

IPv4 subnet calculatorNetwork, broadcast, host range, binary view and subnet splitting.VLSM plannerCarve an address block into right-sized subnets from host counts.CIDR aggregationMerge and deduplicate prefix lists for ACLs, firewalls and route summaries.Wildcard mask calculatorConvert masks and wildcards, see exactly which addresses a wildcard matches and find one wildcard for a set of hosts.IPv6 calculatorCompress, expand, classify and subnet IPv6 prefixes.IP ↔ hex & DHCP option 43Convert IPs to hex, decimal and binary, build or decode option 43 for wireless controller discovery.
Domain health reportOne graded report for a domain: name servers, SOA, DNSSEC, CAA, MX, SPF, DMARC, DKIM and MTA-STS.DNS lookupAll common record types for a name in one go, with TTLs, DNSSEC status and reverse lookups.SPF / DMARC / DKIM checkerLook up or paste email authentication records and get them validated and explained.Email header analyzerTrace a message hop by hop with delays, see SPF/DKIM/DMARC results and spot spoofing signs.
What's my IPYour public IP address as the internet sees it, plus what your browser reveals.IP, ASN & WHOIS lookupOwner, prefix, origin AS, RPKI status and abuse contact for an IP; prefixes for an AS; registration for a domain.Bulk IP extractor & enrichmentPull every IP out of a log, count and classify them, then add owner, AS, country and Tor-exit status.Bulk MAC vendor lookupPaste a MAC/ARP table or any text; every MAC is found and matched to its vendor.
Config template generatorFill a config template with {{ placeholders }} from a spreadsheet: one block per port, VLAN, firewall object or switch.ACL builderBuild Cisco IOS access lists from plain input (CIDR, port lists, ranges) with correct wildcards, then send them to the tester.ACL testerPaste a Cisco IOS ACL, test a packet against it and find shadowed or redundant rules.Prefix list creator & testerTest which entry of a BGP prefix list a route hits, spot dead entries, or generate lists for IOS, IOS XR and Junos.BGP toolkitTest AS-path regexes, decode communities (no-export, blackhole, route targets) and convert or classify AS numbers.VLAN list calculatorCompare, compress and expand trunk VLAN lists and get the add / remove commands for each vendor.
Packet capture analyzerDrop a .pcap / .pcapng: talkers, TCP retransmissions and resets, DNS, DHCP, TLS, ARP and STP problems, analysed in your browser.Config & state diffCompare configs or full show-command backups: see interfaces that went down, lost neighbors, moved MACs, and get draft config commands.MTU & MSS calculatorStack tunnels (GRE, IPsec, VXLAN, WireGuard, PPPoE, MPLS) to get the inner MTU, TCP MSS clamp and DF ping tests.Bandwidth & throughputLive copy progress, transfer times, TCP window limits, TB vs TiB and latency from distance.Signal & link budgetdBm to mW, Wi-Fi signal through walls, free-space path loss and fibre optical power budget.
Certificate decoderDecode PEM certificates and chains: SANs, validity, key size, extensions and fingerprints.JWT decoderDecode a JSON Web Token, read its claims and expiry, spot risky settings and check HMAC signatures.Password & key generatorStrong random passwords, Wi-Fi keys, hex/base64 secrets and UUIDs, with entropy and crack-time estimates.Encoders & convertersBase64, URL and hex encoding, SHA hashes, Unix timestamps, punycode domains and a chmod calculator.
Subnet cheat sheetEvery prefix length with mask, wildcard and host count, plus reserved ranges and IPv6 sizes.Port referenceSearchable list of common ports and protocols with security notes.DSCP & QoS referenceDSCP, ToS byte, precedence, CoS and Wi-Fi classes side by side, with capture filters and marking commands.Network command referenceCommands by task for Cisco, Arista, Aruba, Juniper, Huawei, MikroTik, Fortinet (switch, FortiGate) and Palo Alto, side by side.

↑↓ move↵ openesc close