यह टूल अभी अनूदित नहीं है, इसलिए अंग्रेज़ी में दिखाया जा रहा है।English

Common ports reference

What runs on each port, whether it is encrypted, and which ones should never face the internet.

Search by port, service or protocol

Try 443, ssh, database, or mail.

Port

Port	Protocol	Service	Exposure	Notes
20	tcp	FTP data	Never expose	Unencrypted. Use SFTP instead.
21	tcp	FTP control	Never expose	Sends credentials in clear text.
22	tcp	SSH / SFTP	Expose with care	Encrypted. Key-only authentication, and restrict the source addresses.
23	tcp	Telnet	Never expose	Everything in clear text, including the password. Obsolete.
25	tcp	SMTP	Expose with care	Server-to-server mail. Most home connections block it outbound.
53	tcp/udp	DNS	Expose with care	An open recursive resolver will be abused for amplification attacks.
67	udp	DHCP server	Never expose	Local network only.
68	udp	DHCP client	Never expose	Local network only.
69	udp	TFTP	Never expose	No authentication at all.
80	tcp	HTTP	Fine to expose	Unencrypted web. Normally redirected straight to 443.
110	tcp	POP3	Never expose	Unencrypted mail retrieval. Use 995.
111	tcp/udp	rpcbind / portmapper	Never expose	Used for NFS. A well-known amplification vector.
123	udp	NTP	Expose with care	Time sync. Open servers get abused for amplification.
135	tcp	Windows RPC	Never expose	Internal Windows networking.
137	udp	NetBIOS name	Never expose	Legacy Windows networking.
139	tcp	NetBIOS session	Never expose	Legacy Windows file sharing.
143	tcp	IMAP	Never expose	Unencrypted mail access. Use 993.
161	udp	SNMP	Never expose	Often left on the default community string "public".
389	tcp	LDAP	Never expose	Directory service, unencrypted. Use 636.
443	tcp	HTTPS	Fine to expose	Encrypted web. The one port nearly every site needs.
445	tcp	SMB	Never expose	Windows file sharing. The route WannaCry took. Never expose this.
465	tcp	SMTPS	Fine to expose	Mail submission over TLS.
500	udp	IKE / IPsec	Expose with care	VPN key exchange.
514	udp	syslog	Never expose	Unauthenticated log collection.
587	tcp	SMTP submission	Fine to expose	Mail submission with STARTTLS. The usual port for sending.
631	tcp	IPP / CUPS	Never expose	Printing. Local network only.
636	tcp	LDAPS	Expose with care	Directory service over TLS.
993	tcp	IMAPS	Fine to expose	Mail access over TLS.
995	tcp	POP3S	Fine to expose	Mail retrieval over TLS.
1080	tcp	SOCKS proxy	Never expose	An open proxy will be found and abused quickly.
1194	udp	OpenVPN	Expose with care	VPN. Designed to face the internet.
1433	tcp	Microsoft SQL Server	Never expose	Database. Private network or VPN only.
1521	tcp	Oracle database	Never expose	Database. Private network or VPN only.
1883	tcp	MQTT	Never expose	IoT messaging, unencrypted. Use 8883.
2049	tcp/udp	NFS	Never expose	File sharing with weak authentication.
2375	tcp	Docker API	Never expose	Unauthenticated root on the host. Exposing this gives the machine away.
2376	tcp	Docker API (TLS)	Never expose	Still full control of the host. Keep it private.
3000	tcp	Development server	Never expose	Node, Rails and Grafana default. Not meant for production exposure.
3306	tcp	MySQL / MariaDB	Never expose	Database. One of the most commonly exposed by mistake.
3389	tcp	RDP	Never expose	Windows remote desktop. Heavily attacked; put it behind a VPN.
4444	tcp	Metasploit default	Never expose	Common reverse-shell port. Seeing it listening is a bad sign.
5432	tcp	PostgreSQL	Never expose	Database. Private network or VPN only.
5601	tcp	Kibana	Never expose	Dashboards over your logs. Often left without authentication.
5672	tcp	AMQP / RabbitMQ	Never expose	Message broker. Private network only.
5900	tcp	VNC	Never expose	Remote desktop, often with weak or no password.
6379	tcp	Redis	Never expose	No authentication by default. Exposing it is a standard compromise route.
8000	tcp	Development server	Expose with care	Common alternative HTTP port.
8080	tcp	HTTP alternate	Expose with care	Proxies and app servers. Normally behind a reverse proxy.
8443	tcp	HTTPS alternate	Expose with care	Admin interfaces and app servers over TLS.
8883	tcp	MQTT over TLS	Expose with care	Encrypted IoT messaging.
9000	tcp	PHP-FPM / Portainer	Never expose	PHP-FPM must never be exposed; it executes what it is sent.
9090	tcp	Prometheus	Never expose	Metrics, usually unauthenticated.
9200	tcp	Elasticsearch	Never expose	Open by default in older versions. A frequent source of data leaks.
11211	tcp/udp	Memcached	Never expose	No authentication, and a severe UDP amplification vector.
27017	tcp	MongoDB	Never expose	Historically bound to all interfaces with no password. Keep it private.
51820	udp	WireGuard	Expose with care	VPN. Silent to unauthenticated probes by design.

Exposure guidance

Fine to expose: Designed to face the internet, and encrypted.
Expose with care: Sometimes needs to face the internet, but wants authentication, patching and rate limiting.
Never expose: Should only ever be reachable over a private network or a VPN. These are the ports that show up in breach reports.

Scanning your own machine

We do not provide a port scanner. A browser cannot open raw sockets, so any web-based scanner runs from its own servers, which means someone else’s machine sends unsolicited connections to your address on your behalf. To check your own machine, run a scanner locally where the results are accurate and the traffic is yours.

From another machine on your network:

nmap -Pn -sV 192.168.1.10

To list what is listening on the machine itself:

ss -tulpn

अक्सर पूछे जाने वाले सवाल

Why is there no port scanner here?

Because a browser has no way to open raw sockets, so every web-based port scanner actually scans from its own servers. That means a third party sends unsolicited connections to a host on your say-so. Done to your own machine that is merely inaccurate, because it tests their path rather than yours; done to anyone else’s it is unauthorised scanning, which breaches most hosting providers’ terms and is a criminal matter in several countries.

Running nmap yourself takes a minute, gives better results, and the traffic is honestly yours.

What is the difference between TCP and UDP?

TCP sets up a connection and guarantees that everything arrives, in order, resending what goes missing. UDP just sends, with no connection and no guarantee. TCP suits anything where missing data breaks the result — web pages, files, mail. UDP suits anything where late data is useless anyway, such as voice, video and games.

Which ports should be open on my server?

As few as possible. For a typical web server that is 80 and 443, plus SSH on 22 restricted to addresses you trust. Everything else — databases, caches, admin panels, container runtimes — belongs on a private network or behind a VPN. The ports marked “never expose” here are the ones that turn up again and again in breach reports, because they were left reachable by accident.

Does changing SSH off port 22 make it safer?

Only slightly, and not in the way people hope. It cuts the noise in your logs from untargeted scanning, but anyone actually looking will find it in seconds. Key-only authentication, a firewall and fail2ban do the real work. Moving the port is tidying, not security.

Port

Exposure guidance

Scanning your own machine

अक्सर पूछे जाने वाले सवाल

संबंधित टूल