This website has been designed for use with the FireFox browser. Please use FireFox to view this page.
TCP & UDP well-known port reference for C# and Visual Basic .NET (VB.NET)
Below is a list of well-known TCP and UDP ports used by everyday applications and services.
Some of these ports are known to be used by viruses, and thus detection of heavy or regular pulses of
traffic on these ports can indicate infected machines on a network. To find further information on
common protocols, or read about ways of detecting such traffic on a network, the book Network programming in .NET
should be of invaluable assistance.
"BoKS Dir Server,Private Port". Uses bdir_priv service.
Port 6508 tcp/udp
"BoKS Dir Server,Public Port". Uses bdir_pub service.
Port 6509 tcp/udp
MGCS-MFP Port. Uses mgcs-mfp-port service.
Port 6510 tcp/udp
MCER Port. Uses mcer-port service.
Port 6543 tcp/udp
lds_distrib. Uses lds-distrib service.
Port 6547 tcp/udp
APC 6547. Uses apc-6547 service.
Port 6548 tcp/udp
APC 6548. Uses apc-6548 service.
Port 6549 tcp/udp
APC 6549. Uses apc-6549 service.
Port 6550 tcp/udp
fg-sysupdate. Uses fg-sysupdate service.
Port 6566 tcp/udp
SANE Control Port. Uses sane-port service.
Port 6580 tcp/udp
Parsec Masterserver. Uses parsec-master service.
Port 6581 tcp/udp
Parsec Peer-to-Peer. Uses parsec-peer service.
Port 6582 tcp/udp
Parsec Gameserver. Uses parsec-game service.
Port 6595 tcp/udp
Assasin
Port 6628 tcp/udp
AFE Stock Channel M/C. Uses afesc-mc service.
Port 6631 tcp/udp
Mitchell telecom host. Uses mach service.
Port 6661 tcp
TEMan,Weia-Meia
Port 6665-6669 tcp/udp
IRCU. Uses ircu service.
Port 6666 tcp
AltaVista Tunnel server also uses this port.
Port 6666 tcp
Script kiddies trying to compromiseReal Server servers might mistakenly use this port.
Port 6666 tcp
Many sites running "napster" may use this port.
Port 6666 tcp
Dark Connection Inside,NetBus worm
Port 6666 udp
Kali uses UDP 6666.
Port 6667 tcp
VocalTec Internet PhoneAn alternate port other than 6670 used to connect to servers.
Port 6667 tcp
IRC Clients can connect to servers on this port.
Port 6667 tcp
Dark FTP,ScheduleAgent
Port 6669 tcp
Host Control,Vampire
Port 6670 tcp
BackWeb Server,Deep Throat
Port 6670 tcp/udp
Vocaltec Global Online Directory. Uses vocaltec-gold service.
Port 6672 tcp/udp
vision_server. Uses vision_server service.
Port 6673 tcp/udp
vision_elmd. Uses vision_elmd service.
Port 6697 tcp/udp
Feardoor
Port 6699 tcp
A program called "napster" for exchangingMP3 files defaults to this port.
Port 6701 tcp/udp
KTI/ICAD Nameserver. Uses kti-icad-srvr service.
Port 6711 tcp
BackDoor-G,SubSeven
Port 6712 tcp
Funny trojan,SubSeven
Port 6713 tcp
SubSeven
Port 6714 tcp/udp
Internet Backplane Protocol. Uses ibprotocol service.
Port 6718 tcp
Kilo
Port 6723 tcp
Mstream
Port 6754 tcp/udp
Mapsy
Port 6767 tcp/udp
BMC PERFORM AGENT. Uses bmc-perf-agent service.
Port 6768 tcp/udp
BMC PERFORM MGRD. Uses bmc-perf-mgrd service.
Port 6771 tcp
Deep Throat,Foreplay
Port 6776 tcp/udp
RAT:SubSevenThis port often seen as part of the Sub7communication. You may see a steadystream of connection attempts: this isbecause it uses this port separately fromthe command port in order to transferinformation. Sometimes the control-connection thinks the agent is alive,and will continue to attempt thisconnection as well. Backdoor port in Sub7. Uses hnmp service.
Port 6776 tcp
2000 Cracks,BackDoor-G
Port 6788 tcp/udp
SMC-HTTP. Uses smc-http service.
Port 6789 tcp/udp
SMC-HTTPS. Uses smc-https service.
Port 6789 tcp
W32.Netsky
Port 6790 tcp/udp
HNMP. Uses hnmp service.
Port 6831 tcp/udp
ambit-lm. Uses ambit-lm service.
Port 6838 udp
Mstream
Port 6841 tcp/udp
Netmo Default. Uses netmo-default service.
Port 6842 tcp/udp
Netmo HTTP. Uses netmo-http service.
Port 6850 tcp/udp
ICCRUSHMORE. Uses iccrushmore service.
Port 6883 tcp
Delta Source DarkStar
Port 6888 tcp/udp
MUSE. Uses muse service.
Port 6912 tcp
Shit Heep
Port 6939 tcp
Indoctrination
Port 6961 tcp/udp
JMACT3. Uses jmact3 service.
Port 6962 tcp/udp
jmevt2. Uses jmevt2 service.
Port 6963 tcp/udp
swismgr1. Uses swismgr1 service.
Port 6964 tcp/udp
swismgr2. Uses swismgr2 service.
Port 6965 tcp/udp
swistrap. Uses swistrap service.
Port 6966 tcp/udp
swispol. Uses swispol service.
Port 6969 tcp/udp
acmsoda. Uses acmsoda service.
Port 6969 tcp
GateCrasher,IRC 3
Port 6970-6971 udp
RTP(RealTime Protocol)
Port 6970 tcp
GateCrasher
Port 6998 tcp/udp
IATP-highPri. Uses iatp-highpri service.
Port 6999 tcp/udp
IATP-normalPri. Uses iatp-normalpri service.
Port 7000 tcp
'xfont' (X Windows font server)
Port 7000 tcp/udp
file server itself. Uses afs3-fileserver service.
Port 7000 tcp
Exploit Translation Server,Kazimas
Port 7001 tcp
Freak88,Freak2k
Port 7001 tcp/udp
callbacks to cache managers. Uses afs3-callback service.
Port 7002 tcp/udp
users & groups database. Uses afs3-prserver service.
Tier 2 Data Resource Manager. Uses t2-drm service.
Port 7933 tcp/udp
Tier 2 Business Rules Manager. Uses t2-brm service.
Port 7967 tcp/udp
Supercell. Uses supercell service.
Port 7979 tcp/udp
Micromuse-ncps. Uses micromuse-ncps service.
Port 7980 tcp/udp
Quest Vista. Uses quest-vista service.
Port 7983 tcp
Mstream
Port 7999 tcp/udp
iRDMI2. Uses irdmi2 service.
Port 8000 tcp/udp
iRDMI. Uses irdmi service.
Port 8001 tcp/udp
VCOM Tunnel. Uses vcom-tunnel service.
Port 8002 tcp/udp
Teradata ORDBMS. Uses teradataordbms service.
Port 8002 tcp
'rcgi' or "PERL.NLM' allows running ofPERL scripts on a Novell 4.1 webserver.
Port 8008 tcp/udp
HTTP Alternate. Uses http-alt service.
Port 8008 tcp
Haxdoor
Port 8010 tcp
WinGate v2.1 has a webserver on port8010 for the "LogFile Service". If thisport is open,then anyone can connectto WinGate in order read not only thelogfiles
Port 8012 tcp
Ptakks
Port 8022 tcp/udp
oa-system. Uses oa-system service.
Port 8032 tcp/udp
ProEd. Uses pro-ed service.
Port 8033 tcp/udp
MindPrint. Uses mindprint service.
Port 8080 tcp/udp
HTTP Alternate (see port 80). Uses http-alt service.
Port 8080 tcp
Brown Orifice,Reverse WWW TunnelBackdoor
Port 8088 tcp/udp
Radan HTTP. Uses radan-http service.
Port 8090 tcp/udp
Asniffer
Port 8100 tcp/udp
Xprint Server. Uses xprint-server service.
Port 8115 tcp/udp
MTL8000 Matrix. Uses mtl8000-matrix service.
Port 8116 tcp/udp
Check Point Clustering. Uses cp-cluster service.
Port 8118 tcp/udp
Privoxy HTTP proxy. Uses privoxy service.
Port 8121 tcp/udp
Apollo Data Port. Uses apollo-data service.
Port 8122 tcp/udp
Apollo Admin Port. Uses apollo-admin service.
Port 8130 tcp/udp
INDIGO-VRMI. Uses indigo-vrmi service.
Port 8131 tcp/udp
INDIGO-VBCP. Uses indigo-vbcp service.
Port 8132 tcp/udp
dbabble. Uses dbabble service.
Port 8160 tcp/udp
Patrol. Uses patrol service.
Port 8161 tcp/udp
Patrol SNMP. Uses patrol-snmp service.
Port 8173 tcp/udp
Zebroxy
Port 8199 tcp/udp
VVR DATA. Uses vvr-data service.
Port 8200 tcp/udp
TRIVNET. Uses trivnet1 service.
Port 8201 tcp/udp
TRIVNET. Uses trivnet2 service.
Port 8204 tcp/udp
LM Perfworks. Uses lm-perfworks service.
Port 8205 tcp/udp
LM Instmgr. Uses lm-instmgr service.
Port 8206 tcp/udp
LM Dta. Uses lm-dta service.
Port 8207 tcp/udp
LM SServer. Uses lm-sserver service.
Port 8208 tcp/udp
LM Webwatcher. Uses lm-webwatcher service.
Port 8311 tcp/udp
Mxsender
Port 8351 tcp/udp
Server Find. Uses server-find service.
Port 8376 tcp/udp
Cruise ENUM. Uses cruise-enum service.
Port 8377 tcp/udp
Cruise SWROUTE. Uses cruise-swroute service.
Port 8378 tcp/udp
Cruise CONFIG. Uses cruise-config service.
Port 8379 tcp/udp
Cruise DIAGS. Uses cruise-diags service.
Port 8380 tcp/udp
Cruise UPDATE. Uses cruise-update service.
Port 8383 tcp/udp
IpSwitch's IMail program has aadministrative web server running on this port.
Port 8400 tcp/udp
cvd. Uses cvd service.
Port 8401 tcp/udp
sabarsd. Uses sabarsd service.
Port 8402 tcp/udp
abarsd. Uses abarsd service.
Port 8403 tcp/udp
admind. Uses admind service.
Port 8416 tcp/udp
eSpeech Session Protocol. Uses espeech service.
Port 8417 tcp/udp
eSpeech RTP Protocol. Uses espeech-rtp service.
Port 8443 tcp/udp
PCsync HTTPS. Uses pcsync-https service.
Port 8444 tcp/udp
PCsync HTTP. Uses pcsync-http service.
Port 8450 tcp/udp
npmp. Uses npmp service.
Port 8473 tcp/udp
Virtual Point to Point. Uses vp2p service.
Port 8500 tcp/udp
Flight Data Exchange. Uses fde service.
Port 8520 tcp/udp
W32.Socay.Worm
Port 8546 tcp/udp
Berbew
Port 8554 tcp/udp
RTSP Alternate (see port 554). Uses rtsp-alt service.
Port 8555 tcp/udp
SYMAX D-FENCE. Uses d-fence service.
Port 8611 tcp/udp
Canon BJNP Port 1. Uses canon-bjnp1 service.
Port 8612 tcp/udp
Canon BJNP Port 2. Uses canon-bjnp2 service.
Port 8613 tcp/udp
Canon BJNP Port 3. Uses canon-bjnp3 service.
Port 8614 tcp/udp
Canon BJNP Port 4. Uses canon-bjnp4 service.
Port 8719 tcp/udp
WinShell.50
Port 8733 tcp/udp
iBus. Uses ibus service.
Port 8763 tcp/udp
MC-APPSERVER. Uses mc-appserver service.
Port 8764 tcp/udp
OPENQUEUE. Uses openqueue service.
Port 8765 tcp/udp
Ultraseek HTTP. Uses ultraseek-http service.
Port 8786 tcp/udp
Message Client. Uses msgclnt service.
Port 8787 tcp
Back Orifice 2000
Port 8787 tcp/udp
Message Server. Uses msgsrvr service.
Port 8804 tcp/udp
truecm. Uses truecm service.
Port 8811 tcp/udp
Fearic,Monator
Port 8866 tcp/udp
W32.Beagle
Port 8875 tcp/udp
Napster
Port 8880 tcp/udp
CDDBP. Uses cddbp-alt service.
Port 8888 tcp
NewsEDGE server TCP (TCP 1). Uses ddi-tcp-1 service.
Port 8888 udp
NewsEDGE server UDP (UDP 1). Uses ddi-udp-1 service.
Port 8888 tcp/udp
Napster,W32.Axatak
Port 8889 tcp
Desktop Data TCP 1. Uses ddi-tcp-2 service.
Port 8889 udp
NewsEDGE server broadcast. Uses ddi-udp-2 service.
Desktop Data UDP 3: NESS application. Uses ddi-udp-4 service.
Port 8891 tcp
Desktop Data TCP 3: NESS application. Uses ddi-tcp-4 service.
Port 8892 tcp
Desktop Data TCP 4: FARM product. Uses ddi-tcp-5 service.
Port 8892 udp
Desktop Data UDP 4: FARM product. Uses ddi-udp-5 service.
Port 8893 tcp
Desktop Data TCP 5: NewsEDGE/Web application. Uses ddi-tcp-6 service.
Port 8893 udp
Desktop Data UDP 5: NewsEDGE/Web application. Uses ddi-udp-6 service.
Port 8894 tcp
Desktop Data TCP 6: COAL application. Uses ddi-tcp-7 service.
Port 8894 udp
Desktop Data UDP 6: COAL application. Uses ddi-udp-7 service.
Port 8900 tcp/udp
JMB-CDS 1. Uses jmb-cds1 service.
Port 8901 tcp/udp
JMB-CDS 2. Uses jmb-cds2 service.
Port 8910 tcp/udp
manyone-http. Uses manyone-http service.
Port 8911 tcp/udp
manyone-xml. Uses manyone-xml service.
Port 8954 tcp/udp
Cumulus Admin Port. Uses cumulus-admin service.
Port 8988 tcp
BacHack
Port 8989 tcp
Rcon,Recon
Port 8999 tcp/udp
Brodos Crypto Trade Protocol. Uses bctp service.
Port 9000 tcp/udp
CSlistener. Uses cslistener service.
Port 9000 udp
Asheron's CallThis port is used in Microsoft's massively-multiplayer game called "Asheron's Call".The game can continue to contact theplayer even after the player has logged out.
Port 9000 tcp
Netministrator
Port 9000 tcp
AltaVista HTTP ServerThe may be an attempt to compromisean AltaVista HTTP (web) server.
Port 9000 tcp
Sendmail Switch SDAPSendmail's "Switch" protocol listens onthis TCP port. It also listens on port 8890.
Backdoor. One of the many Linuxmountd (port 635) exploits installsits backdoor at this port. Origin???10751 = 0x2a00,where 0x2a = 42(proposed by Darren Reed) The bx.c IRC exploit puts a root shellbackdoor listening at this port. The ADM named v3 attack puts ashell at this port.
h323 Call Signal Alternate. Uses h323callsigalt service.
Port 11751 tcp/udp
Intrepid SSL. Uses intrepid-ssl service.
Port 11831 tcp/udp
Antilam
Port 11967 tcp/udp
SysInfo Service Protocol. Uses sysinfo-sp service.
Port 12000 tcp/udp
IBM Enterprise Extender SNAXID Exchange. Uses entextxid service.
Port 12001 tcp/udp
IBM Enterprise Extender SNACOS Network Priority. Uses entextnetwk service.
Port 12002 tcp/udp
IBM Enterprise Extender SNACOS High Priority. Uses entexthigh service.
Port 12003 tcp/udp
IBM Enterprise Extender SNACOS Medium Priority. Uses entextmed service.
Port 12004 tcp/udp
IBM Enterprise Extender SNACOS Low Priority. Uses entextlow service.
Port 12005 tcp/udp
DBISAM Database Server - Regular. Uses dbisamserver1 service.
Port 12006 tcp/udp
DBISAM Database Server - Admin. Uses dbisamserver2 service.
Port 12076 tcp
Gjamer
Port 12109 tcp/udp
RETS over SSL. Uses rets-ssl service.
Port 12172 tcp/udp
HiveP. Uses hivep service.
Port 12223 tcp
HacküL99 KeyLogger
Port 12345 tcp/udp
Italk Chat System. Uses italk service.
Port 12345 tcp/udp
Notice how this port is the sequence ofnumbers "1 2 3 4 5". This is commonchosen whenever somebody is asked toconfigure a port number. It is likewisechosen by programmers when creatingdefault port numbers for their products.One very famous such uses is with NetBus.Trend Micro's OfficeScan products usethis port.Ashley,cron / crontab
RAT: NetSphereAn FTP service is run at TCP port 30101in order to download the keylogger filesand recorded WAV files.
Port 30102 tcp
RAT: NetSphere (TCP)An FTP service is run at TCP port 30102in order to download screen captures.
Port 30103 tcp/udp
RAT: NetSphere
Port 30133 tcp
NetSphere
Port 30303 tcp/udp
Sockets de Troie(A French Trojan Horse and virus)
Port 30464 tcp
SMTP ETRN overflowA known Netwin ESMTP exploit bindsa root shell to TCP port 30464.
Port 30947 tcp
Intruse
Port 30999 tcp
Kuang2
Port 31320 tcp/udp
LittleWitch
Port 31332 tcp/udp
Grobodor
Port 31335 tcp/udp
Trinoo slave->master port.The packet contains the string"*HELLO*" on notification,or "PONG"when responding to a broadcast.
Port 31336 tcp
Bo Whack,Butt Funnel
Port 31337 tcp
Back Fire,Back Orifice 1.20 patches
Port 31337 udp
Back Orifice Back Orifice is a backdoor program thatcommonly runs at this port. Scans on thisport are usually looking for Back Orifice.
Port 31337-31388 udp
Deep BO
Port 31339 tcp
NetSpy (DK)
Port 31388 tcp
Back Orifice,Butt Funnel
Port 31416 tcp/udp
XQoS network monitor. Uses xqosd service.
Port 31556 tcp/udp
Zdemon,SysXXX
Port 31620 tcp/udp
lm mon. Uses lm-mon service.
Port 31666 tcp
BOWhack
Port 31693 tcp/udp
Turkojan
Port 31765 tcp/udp
GameSmith Port. Uses gamesmith-port service.
Port 31785 tcp
HacküLaüLTack
Port 31787-31792 tcp
HacküLaüLTack
Port 32001 tcp
Donald Dick
Port 32100 tcp
Peanut Brittle,Project nEXT
Port 32418 tcp
Acid Battery
Port 32768 tcp/udp
Filenet TMS. Uses filenet-tms service.
Port 32769 tcp/udp
Filenet RPC. Uses filenet-rpc service.
Port 32770 tcp/udp
Filenet NCH. Uses filenet-nch service.
Port 32771 tcp/udp
FileNET RMI. Uses filenet-rmi service.
Port 32771 tcp/udp
Ghost Portmapper. Some SunOS machineslisten at this port for portmapper. Sincefirewalls frequently don't filter at high ports,it can allow the attacker access to portmappereven when port 111 is blocked.
Port 32772 tcp/udp
FileNET Process Analyzer. Uses filenet-pa service.
Sun puts RPC services in this region. Scansagainst this port might be looking for anyRPC service,or maybe the rpc.ttdbserverdor rpc.sadmind service.. Uses #rpc.ttdbserverd service.
Port 32774 tcp/udp
FileNET Rules Engine. Uses filenet-re service.
Port 32776 tcp/udp
Sun puts RPC services in this region. Scansagainst this port might be looking for anyRPC service,or maybe the rpc.spray service.. Uses #rpc.spray service.
Port 32777 tcp/udp
Sun puts RPC services in this region. Scansagainst this port might be looking for anyRPC service,or maybe the rpc.walld service.. Uses #rpc.walld service.
Port 32779 tcp/udp
Sun puts RPC services in this region. Scansagainst this port might be looking for anyRPC service,or maybe the rpc.cmsd service.. Uses #rpc.cmsd service.
Cisco SAFE IDS / NetRanger NetRanger (and IDS probe) regularlycommunicates to the "Director"(management console) via port 45000.Among other things,this acts as ahearbeat so that the console knowsthe agent is alive.
Port 45054 tcp/udp
InVision AG. Uses invision-ag service.
Port 45672 tcp/udp
Delf
Port 45678 tcp/udp
EBA PRISE. Uses eba service.
Port 45836 tcp/udp
W32.HLLW.Graps
Port 45966 tcp/udp
SSRServerMgr. Uses ssr-servermgr service.
Port 47000 tcp/udp
Message Bus. Uses mbus service.
Port 47017 tcp/udp
Part of rootkit "t0rn",a programcalled "in.amqd" might run on this.
Port 47262 udp
Delta Source
Port 47387 tcp/udp
Amitis
Port 47557 tcp/udp
Databeam Corporation. Uses dbbrowse service.
Port 47624 tcp/udp
Direct Play Server. Uses directplaysrvr service.
Port 47806 tcp/udp
ALC Protocol. Uses ap service.
Port 47808 tcp/udp
Building Automation and Control Networks. Uses bacnet service.
Port 48000 tcp/udp
Nimbus Controller. Uses nimcontroller service.
Port 48001 tcp/udp
Nimbus Spooler. Uses nimspooler service.
Port 48002 tcp/udp
Nimbus Hub. Uses nimhub service.
Port 48003 tcp/udp
Nimbus Gateway. Uses nimgtw service.
Port 48556 tcp/udp
com-bardac-dw. Uses com-bardac-dw service.
Port 48619 tcp/udp
iqobject. Uses iqobject service.
Port 49151 tcp/udp
IANA Reserved
Port 49301 tcp
OnLine KeyLogger
Port 50021 tcp/udp
OptixPro
Port 50130 tcp
Enterprise
Port 50505 tcp/udp
Sockets de Troie(A French Trojan Horse and virus)
Port 50766 tcp
Fore,Schwindler
Port 51234 tcp
Cyn
Port 51966 tcp
Cafeini
Port 52031 tcp/udp
Graybird
Port 52317 tcp
Acid Battery 2000
Port 52559 tcp
AntiLam
Port 52901 udp
Possibly the Omega DDoS tool.
Port 53001 tcp
Remote Windows Shutdown - RWS
Port 53201 tcp
Backdoor.Ranck
Port 54112 tcp
Ranky
Port 54283 tcp
SubSeven,SubSeven 2.1 Gold
Port 54312 tcp/udp
Niovadoor
Port 54320 tcp
Back Orifice 2000
Port 54321 tcp
Back Orifice 2000,School Bus
Port 54321 udp
A service that replies with the loadaverage of a machine.