Ports are the doors packets use to reach applications.
Every TCP and UDP packet carries source and destination port numbers (0–65535). Firewalls, DDoS filters and service hardening all start with knowing which ports should be open - and which should not.
8 min read
When two hosts communicate over IP, the operating system must deliver each packet to the correct application. Port numbers identify that application endpoint. A web server listening on port 443 receives HTTPS traffic; SSH listens on port 22.
Ports 0–1023 are well-known and assigned by IANA. Ports 1024–49151 are registered for specific services. Ports 49152–65535 are dynamic/ephemeral - browsers and clients use these temporarily.
TCP ports belong to connection-oriented sessions with handshakes and retransmissions - HTTP, SSH, SMTP. UDP ports are connectionless - DNS, NTP, QUIC, and most game protocols.
Many DDoS attacks target UDP because stateless handling is cheaper to flood. TCP attacks often abuse SYN floods or slow connections on ports 80/443. Good protection profiles ports separately.
The tables below list the ports operators see most often on hosting, transit and gaming networks. Use them when writing firewall rules, documenting services or explaining filter policy to customers.
| Port | TCP | UDP | Name | Description |
|---|---|---|---|---|
| 20 | ✓ | - | ftp-data | FTP data transfer |
| 21 | ✓ | ✓ | ftp | FTP control channel |
| 22 | ✓ | ✓ | ssh | Secure Shell remote access |
| 23 | ✓ | - | telnet | Unencrypted remote terminal |
| 25 | ✓ | - | smtp | Simple Mail Transfer Protocol |
| 53 | ✓ | ✓ | dns | Domain name resolution |
| 67 | - | ✓ | dhcp-server | DHCP server (BOOTP) |
| 68 | - | ✓ | dhcp-client | DHCP client |
| 69 | - | ✓ | tftp | Trivial File Transfer Protocol |
| 80 | ✓ | - | http | Hypertext Transfer Protocol |
| 110 | ✓ | - | pop3 | Post Office Protocol v3 |
| 123 | - | ✓ | ntp | Network Time Protocol |
| 143 | ✓ | ✓ | imap | Internet Message Access Protocol |
| 161 | - | ✓ | snmp | Simple Network Management Protocol |
| 179 | ✓ | - | bgp | Border Gateway Protocol |
| 443 | ✓ | - | https | HTTP over TLS |
| 465 | ✓ | - | smtps | SMTP over TLS (legacy) |
| 587 | ✓ | - | submission | Mail submission (STARTTLS) |
| 993 | ✓ | - | imaps | IMAP over TLS |
| 995 | ✓ | - | pop3s | POP3 over TLS |
Ports 0–1023 are well-known and typically require elevated privileges on Unix systems. IANA assigns official service names.
| Port | TCP | UDP | Name | Description |
|---|---|---|---|---|
| 1080 | ✓ | - | socks | SOCKS proxy |
| 1433 | ✓ | - | mssql | Microsoft SQL Server |
| 3306 | ✓ | ✓ | mysql | MySQL / MariaDB |
| 3389 | ✓ | - | rdp | Remote Desktop Protocol |
| 5432 | ✓ | - | postgresql | PostgreSQL database |
| 6379 | ✓ | - | redis | Redis in-memory store |
| 8080 | ✓ | - | http-alt | Common alternate HTTP |
| 8443 | ✓ | - | https-alt | Common alternate HTTPS |
| 27017 | ✓ | - | mongodb | MongoDB default |
| Port | TCP | UDP | Name | Description |
|---|---|---|---|---|
| 25565 | ✓ | ✓ | minecraft | Minecraft Java server |
| 27015 | ✓ | ✓ | source-engine | Counter-Strike / Source games |
| 30120 | ✓ | ✓ | fivem | FiveM (GTA V multiplayer) |
| 7777 | ✓ | ✓ | unreal | Unreal Engine / ARK (common) |
| 9987 | - | ✓ | teamspeak3 | TeamSpeak 3 voice |
| 19132 | - | ✓ | minecraft-bedrock | Minecraft Bedrock |
| 2456 | ✓ | ✓ | valheim | Valheim (common default) |
| 28015 | ✓ | ✓ | rust | Rust game server |
Game ports vary by host and mod - these are common defaults frequently targeted in UDP floods and amplification attacks.
On one IP address, only one process can bind a given port per protocol (TCP/UDP). Different IPs or NAT can reuse numbers. Load balancers terminate connections and forward internally.
Attackers probe ephemeral client ports or abuse reflection on UDP services (DNS/NTP) to amplify traffic toward a victim port. Filters match expected service ports and drop everything else.
Yes - minimum exposure is best practice. Allow only required TCP/UDP ports at edge firewalls and scrubbing policy. Document exceptions for panels, RCON and voice services.
TMW Shield ships protocol profiles for web, mail, DNS, BGP and 20+ game services - tuned per port, not one generic UDP rule.