This Port Lookup tool returns the registered service, common uses, intrusion detection rule references, and known malware activity for any TCP or UDP port. Enter a port number below to see results pulled from IANA, the Emerging Threats Open ruleset, Snort Community, and MITRE ATT&CK.
What a port number is
A port number is a 16-bit integer (0 to 65535) that identifies a specific application or service on a host. When traffic arrives at a server’s IP address, the port number tells the operating system which program should handle the data. Web browsers reach a web server on TCP port 443 for HTTPS. Mail clients reach mail servers on TCP port 587 for outgoing messages. The combination of an IP address and a port number identifies one endpoint of a network conversation.
TCP and UDP
TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) are the two transport protocols that carry most internet traffic. TCP guarantees delivery and orders packets, which suits applications where every byte matters: web pages, email, file transfer, secure shell. UDP is faster but does not guarantee delivery, which suits applications where latency matters more than completeness: DNS, video streaming, online gaming, voice calls.
Many port numbers are registered for both TCP and UDP, but most services only use one. Port 53, for example, is registered for DNS over both protocols, but DNS resolvers almost always use UDP for queries and only fall back to TCP for large responses. The Port Lookup returns separate results for TCP and UDP when both protocols are checked.
What the Port Lookup returns
For each port and protocol combination, the lookup pulls together four kinds of information.
- IANA assignment. The official service name and description from the Internet Assigned Numbers Authority’s Service Name and Transport Protocol Port Number Registry. This is the authoritative answer to what a port is officially registered for.
- Editorial summary. For commonly looked-up ports, a plain-language summary of the software that typically uses the port, the kind of traffic it carries, and the security considerations that operators should be aware of.
- Intrusion detection rule references. A count of rules in the Emerging Threats Open and Snort Community rulesets that reference the port, broken down by category (for example, trojan-activity, web-application-attack, attempted-recon).
- Malware activity tier. When a meaningful share of the IDS rules referencing the port involve malware indicators, the lookup flags the port as low, moderate, or high malware activity, and lists the most common malware families observed. Where the family has a corresponding entry in MITRE ATT&CK, the family name links directly to the upstream threat intelligence record.
Where the data comes from
The Port Lookup combines four upstream sources, all imported into a local database that is refreshed regularly. IANA provides the service registry. The Emerging Threats Open ruleset (BSD 2-Clause and GPLv2 per SID range) contributes signature-based detection rules covering malware, exploits, and policy violations. The Snort Community ruleset (GPLv2) adds further detection coverage. MITRE ATT&CK (Apache 2.0) provides the threat intelligence references for known malware families. Attribution for the specific sources contributing to each result is shown at the bottom of every lookup.
Port number ranges
IANA divides the 16-bit port number space into three ranges.
- Well-known ports (0 to 1023). Reserved for system services and standard protocols: HTTP on 80, HTTPS on 443, SSH on 22, SMTP on 25, DNS on 53. On most operating systems, binding a service to a well-known port requires elevated privileges.
- Registered ports (1024 to 49151). Assigned by IANA on request for specific software and services: Microsoft SQL Server on 1433, MySQL on 3306, PostgreSQL on 5432, RDP on 3389, MongoDB on 27017, and many thousands more.
- Dynamic or ephemeral ports (49152 to 65535). Allocated short-term by the operating system to client-side connections. When your browser opens a TCP connection to a web server on port 443, the local end of that connection uses a dynamic port chosen by your OS for the duration of the request.
The Port Lookup covers all three ranges. Many ports in the dynamic range have no official registration but still appear in intrusion detection rule sets because malware families use them for command and control or exfiltration.
Common reasons to use the Port Lookup
- Identifying unknown traffic. A firewall log or netstat output shows a connection to an unfamiliar port, and you want to know what software typically uses it.
- Hardening a server. You are reviewing which ports a host has open and want to confirm the registered service, expected traffic, and known threat patterns for each one.
- Triage during incident response. A suspicious process is communicating on a specific port, and you want a quick read on whether that port is associated with known malware families.
- Configuring network monitoring. You are tuning IDS rules or building dashboards and want to understand which detection categories are active on a given port.
- General curiosity. A scanning tool reports an open port on a home router or NAS, and you want to understand what it is for.
Whatever the reason, enter a port number into the form above to see what the database has on it.