TCP and UDP port numbers

The three port ranges

A port is a 16-bit number (0-65535) that tells the operating system which program should receive a TCP or UDP packet. IANA splits the space into three ranges (RFC 6335):

• Well-known ports, 0-1023. Assigned to core internet services such as SSH (22), DNS (53) and HTTPS (443). On Linux and macOS only root (or a process with CAP_NET_BIND_SERVICE) may listen on them.
• Registered ports, 1024-49151. Assigned by IANA on request to applications such as MySQL (3306) or RDP (3389). Registration is not enforced: many programs use unregistered numbers, and one number can have several unrelated users.
• Dynamic or private ports, 49152-65535. Never assigned. Operating systems use them as temporary (ephemeral) source ports for outgoing connections. Linux by default uses 32768-60999 instead (net.ipv4.ip_local_port_range).

TCP and UDP have separate port spaces, so TCP 53 and UDP 53 are different sockets. IANA usually assigns a service both. A port that is open answers a connection, closed replies with a reset, and filtered gives no reply because a firewall drops the packets. Our open port checker tests any public host for you.

Should a port be open to the internet?

Each port page says how the service is usually meant to be exposed:

• Meant to face the internet: Fine to expose when the service is intended to be public and kept patched.
• Expose only to trusted sources: Allow it only from known IP addresses, a VPN or a bastion host.
• Do not expose to the internet: Keep it on private networks and block it at the perimeter firewall.
• Localhost or LAN only: It should listen on 127.0.0.1 or the local network, never on a public address.