Common Ports & Services (2026)

[!important]+ The Rule That Prevents Bad Findings A port number is a convention, not proof of the application behind it. TCP and UDP are separate namespaces, services move to non-standard ports, and multiple products reuse popular ports such as 443, 8080, and 9000. Confirm with nmap -sV, a protocol handshake, TLS certificate/SNI, and application behaviour.

Pairs with: Nmap Cheatsheet 2026, Nmap NSE Scripts Cheatsheet 2026, and NSE Guide.

Port Number Ranges

[!note]+ Same Number, Different Transport 53/tcp and 53/udp are different endpoints. DNS uses both; 514/udp usually means syslog while 514/tcp historically maps to the remote-shell service. Always record port/protocol, not the number alone.

Core Internet and Infrastructure Services

Windows and Active Directory

# Targeted AD/DC service confirmation
sudo nmap -sS -sU -Pn -sV \
  -p T:53,88,135,139,389,445,464,593,636,3268,3269,3389,5985,5986,9389,U:53,88,123,137,138,389,464 \
  <target>

[!tip]+ Recognizing a Domain Controller The combination of DNS, Kerberos, LDAP, SMB, Global Catalog, and AD Web Services is much more meaningful than any one open port. Use -sV, LDAP RootDSE, SMB discovery, DNS SRV records, and TLS certificates to confirm the role.

Remote Administration, AAA, Proxies, and VPNs

File Sharing, Storage, and Printing

Databases, Search, and Caches

[!warning]+ Databases Should Rarely Be Internet-Facing An open database port is not automatically unauthenticated. Confirm binding scope, TLS, authentication, authorization, and network policy with approved credentials rather than inferring exposure from the port alone.

Containers, Orchestration, and DevOps

Messaging, Queues, and Service Discovery

Email and Collaboration

Voice, Video, and Real-Time Communications

Monitoring and Logging

ICS / OT and Building Automation

[!danger]+ Fragile Environments Do not assume ordinary IT scan rates are safe for PLCs, safety systems, field devices, printers, or building controllers. Prefer passive asset data and vendor-approved, rate-limited probes under explicit OT rules of engagement.

Frequently Ambiguous Web and Application Ports

# Identify an ambiguous service instead of trusting the port label
nmap -Pn -n -sV --version-all --reason -p3000,5000,8000,8080,8443,9000,9100 <target>

# Add web/TLS metadata where applicable
nmap -Pn -n -sV -p3000,5000,8000,8080,8443,9000,9100 \
  --script=http-title,http-headers,ssl-cert <target>

High-Value UDP Triage List

sudo nmap -sU -Pn -n -sV --reason \
  -p53,67,68,69,88,111,123,137,138,161,162,389,500,514,520,521,623,1434,1701,1812,1813,1900,2049,3478,3702,4500,4789,5060,5353,5355,5683,11211,20000,34962-34964,44818,47808,51820 \
  <target>

IP Protocol Numbers Are Not Ports

# Scan IP protocol numbers rather than TCP/UDP ports
sudo nmap -sO --reason <target>

From an Open Port to the Right Next Tool

Quick Reference Scan Sets

# Common TCP infrastructure and administration
sudo nmap -sS -Pn -n -sV \
  -p21,22,23,25,49,53,80,88,110,111,135,139,143,179,389,443,445,464,514,515,548,554,587,631,636,873,990,993,995,1080,1194,1433,1521,1723,2049,2375,2376,3000,3128,3260,3268,3269,3306,3389,5432,5672,5900,5985,5986,6379,6443,8080,8443,8883,9000,9090,9100,9200,10000,10250,11211,27017 \
  <target>

# Core UDP infrastructure
sudo nmap -sU -Pn -n -sV \
  -p53,67,68,69,88,111,123,137,138,161,162,389,500,514,520,521,623,1434,1701,1812,1813,1900,2049,3478,3702,4500,4789,5060,5353,5355,5683,51820 \
  <target>

References

1. IANA Service Name and Transport Protocol Port Number Registry
2. RFC 6335 — Service Name and Port Number Procedures
3. Nmap nmap-services Database
4. Nmap Service and Version Detection
5. Nmap Port Specification