Common Ports and What They're Used For

Every network service uses a port number so the OS knows which process receives incoming data. When you see an unfamiliar port in a port monitor or firewall log, knowing the common assignments saves you from guessing. This post is a reference for the most common port numbers grouped by category. Portie shows process names alongside port numbers in its live view; the paid remote scanner ($8.99) labels service names automatically. For a per-port breakdown of what listens on each one and whether it’s safe to kill, see the port reference hub.

Port numbers 0-1023 are well-known ports assigned by IANA and require elevated privileges to bind. Ports 49152-65535 are assigned dynamically for outgoing connections.

Port numbers run from 0 to 65535. IANA divides them into three ranges: well-known ports (0-1023, require root/admin to bind on most systems), registered ports (1024-49151, assigned to specific services by IANA but any process can bind them), and dynamic/ephemeral ports (49152-65535, assigned automatically for outgoing connections). A separate post covers ephemeral ports in depth.

Web and HTTP

Port	Protocol	Description
`80`	HTTP	Unencrypted web traffic. Browsers connect here when no HTTPS is specified.
`443`	HTTPS	Encrypted web traffic using TLS. Most web traffic today uses this port.
`8080`	HTTP (alt)	Common for development servers and HTTP proxies. Not reserved, so any app can use it.
`8443`	HTTPS (alt)	Development HTTPS servers and some web APIs.

Secure Shell and Remote Access

Port	Protocol	Description
`22`	SSH	Encrypted remote login and file transfer (SFTP runs over SSH). Also used for secure tunnels.
`3389`	RDP	Windows Remote Desktop Protocol. Used to connect to Windows machines remotely.

Email

Port	Protocol	Description
`25`	SMTP	Mail server to mail server delivery. ISPs often block outbound `25` from residential connections.
`587`	SMTP Submission	Your email client uses this to send mail through your provider (with authentication).
`465`	SMTPS	SMTP over TLS. Older than `587` but still common.
`143`	IMAP	Email retrieval without downloading; messages stay on the server.
`993`	IMAPS	IMAP over TLS.
`110`	POP3	Downloads email to your device and typically deletes from server.
`995`	POP3S	POP3 over TLS.

DNS and Network Infrastructure

Port	Protocol	Description
`53`	DNS	Domain name resolution (TCP and UDP). Used for every domain lookup.
`67` / `68`	DHCP	`67` is the server port, `68` is the client. Assigns IP addresses automatically.
`123`	NTP	Network Time Protocol. Keeps your system clock synchronized.

Databases

Port	Database	Notes
`3306`	MySQL / MariaDB
`5432`	PostgreSQL
`27017`	MongoDB
`6379`	Redis
`1433`	Microsoft SQL Server

Databases default to localhost only. If you see a database port in your firewall or accessible remotely, check your configuration.

Development Servers

Port	Common use
`3000`	Node.js, React (Create React App), Ruby on Rails default
`3001`	Common second instance when `3000` is taken
`5173`	Vite dev server default
`4200`	Angular CLI default
`8000`	Django, Python `http.server` default
`8080`	Many Java frameworks (Spring Boot), HTTP proxies

macOS-Specific Ports

5000 and 7000: AirPlay Receiver (macOS Monterey and later, process: ControlCenter). These frequently conflict with Flask and other dev servers that default to port 5000.
5353: mDNS / Bonjour, used for local network service discovery. You will see this in use by printers, AirPlay, and many Apple services.
49152-65535: Ephemeral/dynamic range, assigned automatically for outgoing connections. Seeing many of these in a port monitor is normal.

Port	Protocol	Description
`445`	SMB	Windows file sharing, also used by macOS for network drives.
`548`	AFP	Apple Filing Protocol, legacy Mac file sharing. Largely replaced by SMB.
`21`	FTP	Unencrypted file transfer. Rarely used today due to security concerns.
`22`	SFTP	Secure file transfer running over SSH (same port as SSH).

Portie’s remote scanner labels service names automatically when you scan a host, so you don’t have to cross-reference this list manually. For local ports, the grouped-by-app view shows the process owning each port. Combined with this reference, identifying unfamiliar port activity is quick. Portie