Port Reference
Well-known and registered port numbers
A port number is 16 bits, so there are 65,536 of them, and IANA divides the range into three parts. Ports 0 to 1023 are the well-known ones assigned to core protocols; 1024 to 49151 are registered, claimed by particular applications; and 49152 upward are ephemeral, handed out temporarily to the client side of a connection.
Knowing what conventionally listens where turns an opaque netstat output into something readable. A process on 5432 is almost certainly PostgreSQL, 6379 is Redis, 3306 is MySQL. The convention is not enforced — anything can listen anywhere — but it is followed closely enough that a surprise is worth investigating.
How to use it
- Search by number or by nameType 8080 to find out what commonly uses it, or type "postgres" to find the port it expects.
- Check the transportTCP and UDP number their ports independently, so the same number can be assigned to different services on each. DNS famously uses both, for different purposes.
- Treat it as conventionAn assignment says what normally listens there, not what is listening on your machine. Confirm with lsof or ss before concluding anything.
Frequently asked questions
Why do ports below 1024 need root?
On Unix systems they are privileged, historically so that an ordinary user could not impersonate a system service on a shared machine. It is why web servers are typically started as root and immediately drop privileges, and why containers often run the application on 8080 and map 80 to it from outside.
What is the difference between 80, 443 and 8080?
80 is HTTP and 443 is HTTPS, both well-known and both privileged. 8080 is an unofficial convention for an HTTP service run without privileges — a development server, or an application behind a reverse proxy. Nothing enforces any of it; they are agreements about where to look.
What are ephemeral ports?
The temporary source ports the operating system assigns to outbound connections. IANA suggests 49152 to 65535, though Linux defaults to a wider range starting around 32768. A connection is identified by the full four-tuple of both addresses and both ports, which is why many concurrent connections to the same server are possible.
Can two services share a port?
Not on the same address and transport at once — the second bind fails with "address already in use". They can share a number across different transports, or bind to different addresses on the same host. SO_REUSEPORT allows multiple processes to share a listening socket deliberately, which is how some servers spread load across workers.
Which ports should never be exposed to the internet?
Database and admin ports above all: 3306, 5432, 6379, 27017, 9200, along with 445 for SMB and 3389 for RDP. Internet-wide scanners find an open Redis or Elasticsearch within minutes, and both have historically shipped without authentication. Put them behind a firewall or bind them to localhost.