| Port No. | Protocol | Service | Description |
| 20000 | tcp/udp | dnp | DNP |
| 20000 |
tcp |
# |
Millenium |
| 20001 | tcp/udp | microsan | MicroSAN |
| 20002 | tcp/udp | commtact-http | Commtact HTTP |
| 20003 | tcp/udp | commtact-https | Commtact HTTPS |
| 20004-20013 | tcp/udp | # | Unassigned |
| 20014 | tcp/udp | opendeploy | OpenDeploy Listener |
| 20015-20033 | tcp/udp | # | Unassigned |
| 20034 | tcp/udp | nburn_id | NetBurner ID Port |
| 20035-20201 | tcp/udp | # | Unassigned |
| 20001 |
tcp |
# |
Millenium, Millenium (Lm) |
| 20002 |
tcp |
# |
AcidkoR |
| 20005 |
tcp |
# |
Mosucker |
| 20023 |
tcp |
# |
VP Killer |
| 20034 |
tcp |
# |
NetBus 2.0 Pro Hidden, NetRex, Whack Job |
| 20168 |
tcp |
# |
Lovgate |
| 20192 |
tcp |
# |
Ranky |
| 20202 | tcp/udp | ipdtp-port | IPD Tunneling Port |
| 20203-20221 | tcp/udp | # | Unassigned |
| 20203 |
tcp |
# |
Chupacabra |
| 20222 | tcp/udp | ipulse-ics | iPulse-ICS |
| 20223-20669 | tcp/udp | # | Unassigned |
| 20226 |
tcp |
# |
AntiLam |
| 20331 |
tcp |
# |
BLA trojan |
| 20432 |
tcp |
# |
Shaft |
| 20433 |
udp |
# |
Shaft |
| 20670 | tcp/udp | track | Track |
| 20671-20998 | tcp/udp | # | Unassigned |
| 20999 | tcp/udp | athand-mmp | At Hand MMP |
| 21000 | tcp/udp | irtrans | IRTrans Control |
| 21001-21589 | tcp/udp | # | Unassigned |
| 21157 |
udp |
# |
Activision gaming protocol |
| 21211 |
tcp/udp |
# |
W32.Dasher |
| 21217 |
tcp/udp |
# |
Asniffer |
| 21544 |
tcp |
# |
GirlFriend, Kid Terror |
| 21554 |
tcp |
# |
Exploiter, Kid Terror, Schwindler, Winsp00fer |
| 21590 | tcp/udp | vofr-gateway | VoFR Gateway |
| 21591-21799 | tcp/udp | # | Unassigned |
| 21800 | tcp/udp | tvpm | TVNC Pro Multiplexing |
| 21801-21844 | tcp/udp | # | Unassigned |
| 21845 | tcp/udp | webphone | webphone |
| 21846 | tcp/udp | netspeak-is | NetSpeak Corp. Directory Services |
| 21847 | tcp/udp | netspeak-cs | NetSpeak Corp. Connection Services |
| 21848 | tcp/udp | netspeak-acd | NetSpeak Corp. Automatic Call Distribution |
| 21849 | tcp/udp | netspeak-cps | NetSpeak Corp. Credit Processing System |
| 21850-21999 | tcp/udp | # | Unassigned |
| 22000 | tcp/udp | snapenetio | SNAPenetIO |
| 22001 | tcp/udp | optocontrol | OptoControl |
| 22002-22272 | tcp/udp | # | Unassigned |
| 22222 |
tcp |
# |
Donald Dick, Prosiak, Ruler, RUX The TIc.K |
| 22273 | tcp/udp | wnn6 | wnn6 |
| 22274-22554 | tcp/udp | # | Unassigned |
| 22311 |
tcp/udp |
# |
Simali |
| 22555 | tcp | vocaltec-wconf | Vocaltec Web Conference |
| 22555 | udp | vocaltec-phone | Vocaltec Internet Phone |
| 22556-22792 | tcp/udp | # | Unassigned |
| 22703 |
tcp |
# |
WebTV is vulnerable to an exploit
on this port that can reboot the machine.. |
| 22793 |
tcp |
vocaltec-wconf |
VocalTec Internet Phone
TCP connection to VocalTec's Addressing servers. |
| 22794-22799 | tcp/udp | # | Unassigned |
| 22800 | tcp/udp | aws-brf | Telerate Information Platform LAN |
| 22801-22950 | tcp/udp | # | Unassigned |
| 22951 | tcp/udp | brf-gw | Telerate Information Platform WAN |
| 22952-23399 | tcp/udp | # | Unassigned |
| 23005-23006 |
tcp |
# |
NetTrash, Platrash |
| 23023 |
tcp |
# |
Logged |
| 23032 |
tcp |
# |
Amanda |
| 23213-23214 |
tcp/udp |
# |
PowWow
by Tribal Voice |
| 23232 |
tcp |
# |
Berbew |
| 23400 | tcp/udp | novar-dbase | Novar Data |
| 23401 | tcp/udp | novar-alarm | Novar Alarm |
| 23402 | tcp/udp | novar-global | Novar Global |
| 23403-23999 | tcp/udp | # | Unassigned |
| 23422 |
tcp |
# |
W32.Beagle |
| 23432 |
tcp |
# |
Asylum |
| 23435 |
tcp |
# |
Frango, Framar |
| 23456 |
tcp/udp |
# |
Trojan:EvilFTP, Ugly FTP, Whack Job |
| 23476 |
tcp/udp |
# |
Donald Dick |
| 23477 |
tcp |
# |
Donald Dick |
| 23523 |
tcp |
# |
W32.Mytob |
| 23560 |
tcp |
# |
Sparta |
| 23666 |
tcp/udp |
# |
Beasty |
| 23777 |
tcp |
# |
InetSpy |
| 24000 | tcp/udp | med-ltp | med-ltp |
| 24000 |
tcp |
# |
Infector |
| 24001 | tcp/udp | med-fsp-rx | med-fsp-rx |
| 24002 | tcp/udp | med-fsp-tx | med-fsp-tx |
| 24003 | tcp/udp | med-supp | med-supp |
| 24004 | tcp/udp | med-ovw | med-ovw |
| 24005 | tcp/udp | med-ci | med-ci |
| 24006 | tcp/udp | med-net-svc | med-net-svc |
| 24007-24241 | tcp/udp | # | Unassigned |
| 24242 | tcp/udp | filesphere | fileSphere |
| 24243-24248 | tcp/udp | # | Unassigned |
| 24249 | tcp/udp | vista-4gl | Vista 4GL |
| 24250-24320 | tcp/udp | # | Unassigned |
| 24300 |
tcp |
# |
W32.Randex |
| 24321 | tcp/udp | ild | Isolv Local Directory |
| 24322-24385 | tcp/udp | # | Unassigned |
| 24386 | tcp/udp | intel_rci | Intel RCI |
| 24387-24553 | tcp/udp | # | Unassigned |
| 24554 | tcp/udp | binkp | BINKP |
| 24554-24676 | tcp/udp | # | Unassigned |
| 24677 | tcp/udp | flashfiler | FlashFiler |
| 24678 | tcp/udp | proactivate | Turbopower Proactivate |
| 24679-24921 | tcp/udp | # | Unassigned |
| 24681 |
tcp |
# |
Lowtaper |
| 24759 |
tcp |
# |
Zinx |
| 24922 | tcp/udp | snip | Simple Net Ident Protocol |
| 24923-24999 | tcp/udp | # | Unassigned |
| 25000 | tcp/udp | icl-twobase1 | icl-twobase1 |
| 25001 | tcp/udp | icl-twobase2 | icl-twobase2 |
| 25002 | tcp/udp | icl-twobase3 | icl-twobase3 |
| 25003 | tcp/udp | icl-twobase4 | icl-twobase4 |
| 25004 | tcp/udp | icl-twobase5 | icl-twobase5 |
| 25005 | tcp/udp | icl-twobase6 | icl-twobase6 |
| 25006 | tcp/udp | icl-twobase7 | icl-twobase7 |
| 25007 | tcp/udp | icl-twobase8 | icl-twobase8 |
| 25008 | tcp/udp | icl-twobase9 | icl-twobase9 |
| 25009 | tcp/udp | icl-twobase10 | icl-twobase10 |
| 25010-25792 | tcp/udp | # | Unassigned |
| 25025-25026 |
tcp |
# |
Kodalo |
| 25044 |
tcp |
# |
Kodalo |
| 25685-25686 |
tcp |
# |
Moonpie |
| 25793 | tcp/udp | vocaltec-hos | Vocaltec Address Server |
| 25794-25899 | tcp/udp | # | Unassigned |
| 25900 | tcp/udp | tasp-net | TASP Network Comm |
| 25901 | tcp/udp | niobserver | NIObserver |
| 25902 | tcp/udp | # | Unassigned |
| 25903 | tcp/udp | niprobe | NIProbe |
| 25904-25999 | tcp/udp | # | Unassigned |
| 25982 |
tcp |
# |
Moonpie |
| 26000 | tcp/udp | quake | quake |
| 26001-26207 | tcp/udp | # | Unassigned |
| 26208 | tcp/udp | wnn6-ds | wnn6-ds |
| 26209-26259 | tcp/udp | # | Unassigned |
| 26260 | tcp/udp | ezproxy | eZproxy |
| 26261 | tcp/udp | ezmeeting | eZmeeting |
| 26262 | tcp/udp | k3software-svr | K3 Software-Server |
| 26263 | tcp/udp | k3software-cli | K3 Software-Client |
| 26264 | tcp/udp | gserver | Gserver |
| 26265-26999 | tcp/udp | # | Unassigned |
| 26274 |
udp |
# |
Trinoo |
| 26418 |
udp |
# |
W32.Mytob |
| 26681 |
tcp |
# |
Voice Spy |
| 27000-27009 | tcp/udp | flex-lm | FLEX LM (1-10) |
| 27000 |
tcp/udp |
# |
May be used as part of a Quake related game. |
| 27001 |
tcp/udp |
# |
QuakeWorld |
| 27010-27344 | tcp/udp | # | Unassigned |
| 27010 |
tcp |
# |
Half-Life(Server) |
| 27015 |
tcp |
# |
Half-Life |
| 27328 |
tcp |
# |
Nibu |
| 27345 | tcp/udp | imagepump | ImagePump |
| 27346-27503 | tcp/udp | # | Unassigned |
| 27374 |
tcp/udp |
# |
Bad Blood, Ramen, Seeker, SubSeven,
Subseven 2.1.4 DefCon 8, SubSeven Muie, Ttfloader, Baste |
| 27379 |
tcp/udp |
# |
Optix |
| 27444 |
udp |
# |
Trinoo slave port |
| 27504 | tcp/udp | kopek-httphead | Kopek HTTP Head Port |
| 27505-27781 | tcp/udp | # | Unassigned |
| 27551 |
tcp/udp |
# |
Amitis |
| 27573 |
tcp |
# |
SubSeven Trojan |
| 27665 |
tcp |
# |
Trinoo master port |
| 27782 | tcp/udp | ars-vista | ARS VISTA Application |
| 27783-27998 | tcp/udp | # | Unassigned |
| 27910 |
tcp/udp |
# |
May be used as part of a Quake related game. |
| 27960 |
tcp/udp |
# |
QuakeIII |
| 27999 | tcp | tw-auth-key | TW Authentication/Key Distribution and |
| 27999 | udp | tw-auth-key | Attribute Certificate Services |
| 27999 |
tcp |
# |
W32.Mytob |
| 28000 | tcp/udp | nxlmd | NX License Manager |
| 28000-28008 |
udp |
# |
Starsiege TRIBES |
| 28001-28239 | tcp/udp | # | Unassigned |
| 28240 | tcp/udp | siemensgsm | Siemens GSM |
| 28241-29166 | tcp/udp | # | Unassigned |
| 28253 |
tcp |
# |
Berbew |
| 28678 |
tcp |
# |
Exploiter |
| 28876 |
tcp |
# |
Globe |
| 28882-28883 |
tcp |
# |
Mitglieder |
| 29104 |
tcp |
# |
NetTrojan |
| 29147 |
tcp |
# |
Sdbot |
| 29167 | tcp/udp | otmp | ObTools Message Protocol |
| 29168-29999 | tcp/udp | # | Unassigned |
| 29369 |
tcp |
# |
ovasOn |
| 29559 |
tcp/udp |
# |
Antilam |
| 29891 |
tcp |
# |
The Unexplained |