Reference of common ports, protocols and troubleshooting context; a known port never means it should be exposed to the Internet.
Core infrastructure
- 22/TCP — SSH / SFTPRemote Unix/Linux administration; prefer keys and network filtering.
- 53/TCP+UDP — DNSUDP common, TCP for large responses/transfers and other cases.
- 67/68 UDP — DHCPv4 serveur/clientBroadcast/relay depending on architecture.
- 123/UDP — NTPCritical for Kerberos, logs and time correlation.
Monitoring & directory
- 161/162 UDP — SNMP / trapsPrefer SNMPv3 where possible.
- 389/TCP+UDP — LDAPActive Directory also requires RPC/Kerberos/DNS.
- 636/TCP — LDAPSLDAP over TLS; check certificate and trust chain.
- 3268/3269 TCP — Global Catalog / GC SSLUsed by Active Directory global catalog.
Web & administration
- 80/TCP — HTTPOften redirected to HTTPS but may still be required for some services.
- 443/TCP — HTTPSMajor application port; inspect TLS/SNI/Host beyond TCP.
- 5985/TCP — WinRM HTTPRemote PowerShell management on Windows.
- 5986/TCP — WinRM HTTPSWinRM over TLS; requires correct certificate/configuration.
- 25/TCP — SMTP between mail transfer agents. Server-to-server mail transport.
- 465/TCP — Submission TLS impliciteDepending on provider/service.
- 587/TCP — SMTP SubmissionCommon authenticated client/application submission port.
- 993/995 TCP — IMAPS / POP3SMailbox access, separate from SMTP sending.
Windows & Active Directory
- 88/TCP+UDP — KerberosAD authentication; also depends strongly on DNS and NTP.
- 135/TCP — RPC Endpoint MapperRPC then uses dynamic ports depending on OS/configuration.
- 445/TCP — SMB / SYSVOL / partagesHighly sensitive to Internet exposure.
- 49152-65535/TCP — RPC dynamique Windows moderneModern default dynamic RPC range, configurable.
Databases
- 1433/TCP — Microsoft SQL ServerDefault classic SQL Server port; named instances may differ.
- 3306/TCP — MySQL / MariaDBDo not expose publicly without strong justification and controls.
- 5432/TCP — PostgreSQLFilter DB access by source and authentication.
- 6379/TCP — RedisUnprotected exposure is especially risky.
VPN, VoIP & virtualization
- 500/UDP — IKE / IPsecIKE negotiation.
- 4500/UDP — IPsec NAT-TUsed when NAT is detected.
- 5060/5061 — SIP / SIP TLSDoes not cover RTP media, whose range depends on the platform.
- 443/902 TCP — VMware vSphere/ESXi — usages courantsExact requirements depend on components and flow direction.
Test without unnecessary exposure
- PowerShell — Test-NetConnection serveur -Port 443Tests TCP from the client point of view.
- Linux nc — nc -vz serveur 443Tests TCP if netcat is installed.
- Windows listeners — Get-NetTCPConnection -State ListenConfirms a local service is listening.
- Linux listeners — ss -lntupMaps ports and processes when permissions allow.
Key points
- A standard port does not prove which service is actually behind it.
- Do not globally disable firewalls to test a port; use targeted temporary tests.
- For Active Directory, think in required flow sets rather than only 389/636.
- For SIP/RTP, VPN and vendor products, use the port matrix for the deployed version.