port 1 - 99
port 100 - 199
port 200 - 299
port 300 - 399
port 400 - 499
port 500 - 599
port 600 - 699
port 700 - 1023
port 1024 - 1199 up
port 1200 - 1299
port 1300 - 1399
port 1400 - 1499
port 1500 - 1599
port 1600 - 1699
port 1700 - 1799
port 1800 - 1899 up
port 1900 - 1999
port 2000 - 2099
port 2100 - 2299
port 2300 - 2399
port 2400 - 2499
port 2500 - 2599
port 2600 - 2699
port 2700 - 2799
port 2800 - 2899
port 2900 - 2999
port 3000 - 3099
port 3100 - 3199
port 3200 - 3299
port 3300 - 3399
port 3400 - 3499
port 3500 - 3599
port 3600 - 3699
port 3700 - 3999 up
port 4000 - 4999 up
port 5000 - 5399
port 5400 - 5999 up
port 6000 - 6999 up
port 7000 - 7999 up
port 8000 - 8999
port 9000 - 9999 up
port 10000 - 12999 up
port 13000 - 19999 up
port 20000 - 29999 up
port 30000 - 39999
port 40000 -
http://www.iana.org/
assignments/port-numbers
(2006/3/3)
| Port No. | Protocol | Service | Description |
|---|---|---|---|
| 30000 | tcp/udp | # | Unassigned |
| 30000 | tcp | # | Infector |
| 30001 | tcp/udp | pago-services1 | Pago Services 1 |
| 30001 | tcp | # | ErrOr32, W32.Gaobot |
| 30002 | tcp/udp | pago-services2 | Pago Services 2 |
| 30003-31415 | tcp/udp | # | Unassigned |
| 30003 | tcp | # | Lamers Death |
| 30029 | tcp | # | AOL Admin 1.1 |
| 30100 | tcp | # | RAT: NetSphere |
| 30101 | tcp | # | RAT: NetSphere An FTP service is run at TCP port 30101 in order to download the keylogger files and recorded WAV files. |
| 30102 | tcp | # | RAT: NetSphere (TCP) An FTP service is run at TCP port 30102 in order to download screen captures. |
| 30103 | tcp/udp | # | RAT: NetSphere |
| 30133 | tcp | # | NetSphere |
| 30303 | tcp/udp | # | Sockets de Troie (A French Trojan Horse and virus) |
| 30464 | tcp | # | SMTP ETRN overflow A known Netwin ESMTP exploit binds a root shell to TCP port 30464. |
| 30722 | tcp | # | W32.Esbot |
| 30947 | tcp | # | Intruse |
| 30999 | tcp | # | Kuang2, Novacal |
| 31113 | tcp | # | W32.Mytob |
| 31320 | tcp/udp | # | LittleWitch |
| 31332 | tcp/udp | # | Grobodor |
| 31335 | tcp/udp | # | Trinoo slave->master port. The packet contains the string "*HELLO*" on notification, or "PONG" when responding to a broadcast. |
| 31336 | tcp | # | Bo Whack, Butt Funnel |
| 31337 | tcp | # | Back Fire, Back Orifice 1.20 patches, Back Orifice,Back Orifice russian, Baron Night, Beeone, BO client, BO Facil, BO spy, BO2, cron / crontab, Freak88, Freak2k, icmp_pipe.c, Sockdmini, W32.HLLW.Gool, Emcommander |
| 31337 | udp | # | Back Orifice Back Orifice is a backdoor program that commonly runs at this port. Scans on this port are usually looking for Back Orifice. |
| 31337-31388 | udp | # | Deep BO |
| 31388 | tcp | # | Back Orifice, Butt Funnel, NetSpy (DK) |
| 31339 | tcp | # | NetSpy (DK) |
| 31416 | tcp/udp | xqosd | XQoS network monitor |
| 31417-31456 | tcp/udp | # | Unassigned |
| 31457 | tcp/udp | tetrinet | TetriNET Protocol |
| 31458-31764 | tcp/udp | # | Unassigned |
| 31556 | tcp/udp | # | Zdemon, SysXXX |
| 31620 | tcp/udp | lm-mon | lm mon |
| 31621-31764 | tcp/udp | # | Unassigned |
| 31666 | tcp | # | BOWhack |
| 31693 | tcp/udp | # | Turkojan |
| 31765 | tcp/udp | gamesmith-port | GameSmith Port |
| 31766-32248 | tcp/udp | # | Unassigned |
| 31785 | tcp | # | Hack-a-Tack |
| 31787-31792 | tcp | # | Hack-a-Tack |
| 32001 | tcp | # | Donald Dick |
| 32100 | tcp | # | Peanut Brittle, Project nEXT |
| 32121 | tcp | # | Berbew |
| 32249 | tcp/udp | t1distproc60 | T1 Distributed Processor |
| 32250-32482 | tcp/udp | # | Unassigned |
| 32418 | tcp | # | Acid Battery |
| 32440 | tcp | # | Alets |
| 32483 | tcp/udp | apm-link | Access Point Manager Link |
| 32484-32634 | tcp/udp | # | Unassigned |
| 32635 | tcp/udp | sec-ntb-clnt | SecureNotebook-CLNT |
| 32636-32767 | tcp/udp | # | Unassigned |
| 32768 | tcp/udp | filenet-tms | Filenet TMS |
| 32769 | tcp/udp | filenet-rpc | Filenet RPC |
| 32770 | tcp/udp | filenet-nch | Filenet NCH |
| 32771 | tcp/udp | filenet-rmi | FileNET RMI |
| 32771 | tcp/udp | # | Ghost Portmapper. Some SunOS machines listen at this port for portmapper. Since firewalls frequently don't filter at high ports, it can allow the attacker access to portmapper even when port 111 is blocked. |
| 32772 | tcp/udp | filenet-pa | FileNET Process Analyzer |
| 32773 | tcp/udp | filenet-cm | FileNET Component Manager |
| 32774 | tcp/udp | filenet-re | FileNET Rules Engine |
| 32773 | tcp/udp | #rpc.ttdbserverd | Sun puts RPC services in this region. Scans against this port might be looking for any RPC service, or maybe the rpc.ttdbserverd or rpc.sadmind service. |
| 32775 | tcp/udp | filenet-pch | Performance Clearinghouse |
| 32776-32895 | tcp/udp | # | Unassigned |
| 32776 | tcp/udp | #rpc.spray | Sun puts RPC services in this region. Scans against this port might be looking for any RPC service, or maybe the rpc.spray service. |
| 32777 | tcp/udp | #rpc.walld | Sun puts RPC services in this region. Scans against this port might be looking for any RPC service, or maybe the rpc.walld service. |
| 32779 | tcp/udp | #rpc.cmsd | Sun puts RPC services in this region. Scans against this port might be looking for any RPC service, or maybe the rpc.cmsd service. |
| 33270 | tcp | # | Trinity |
| 32896 | tcp/udp | idmgratm | Attachmate ID Manager |
| 32897-33330 | tcp/udp | # | Unassigned |
| 33322 | tcp | # | Lodeight |
| 33331 | tcp/udp | diamondport | DiamondCentral Interface |
| 33332-33433 | tcp/udp | # | Unassigned |
| 33333 | tcp | # | Blakharaz, Prosiak, Selka, W32.Zotob |
| 33434 | tcp/udp | traceroute | traceroute use |
| 33435-33655 | tcp/udp | # | Unassigned |
| 33577 | tcp | # | Son of PsychWard |
| 33656 | tcp/udp | snip-slave | SNIP Slave |
| 33657-34248 | tcp/udp | # | Unassigned |
| 33777 | tcp | # | Son of PsychWard |
| 33911 | tcp | # | Spirit 2000, Spirit 2001 |
| 34249 | tcp/udp | turbonote-2 | TurboNote Relay Server Default Port |
| 34250-34377 | tcp/udp | # | Unassigned |
| 34324 | tcp | # | Big Gluck, TN |
| 34330 | tcp | # | W32.Myfip |
| 34378 | tcp/udp | p-net-local | P-Net on IP local |
| 34379 | tcp/udp | p-net-remote | P-Net on IP remote |
| 34380-34961 | tcp/udp | # | Unassigned |
| 34444 | tcp | # | Donald Dick |
| 34555 | udp | # | Windows Trin00 Trojan |
| 34962 | tcp/udp | profinet-rt | PROFInet RT Unicast |
| 34963 | tcp/udp | profinet-rtm | PROFInet RT Multicast |
| 34964 | tcp/udp | profinet-cm | PROFInet Context Manager |
| 34965-34979 | tcp/udp | # | Unassigned |
| 34980 | tcp/udp | ethercat | EtherCAT Port |
| 34981-36864 | tcp/udp | # | Unassigned |
| 35555 | udp | # | Windows Trin00 Trojan |
| 36183 | tcp | # | Lifefournow |
| 36865 | tcp/udp | kastenxpipe | KastenX Pipe |
| 36866-37474 | tcp/udp | # | Unassigned |
| 36963 | tcp | # | W32.Mytob |
| 37237 | tcp | # | Mantis |
| 37475 | tcp/udp | neckar | science + computing's Venus Administration Port |
| 37476-37653 | tcp/udp | # | Unassigned |
| 37651 | tcp | # | Yet Another Trojan - YAT |
| 37654 | tcp/udp | unisys-eportal | Unisys ClearPath ePortal |
| 37655-38200 | tcp/udp | # | Unassigned |
| 37737 | tcp | # | Tixanbot |
| 38036 | tcp/udp | #timestep | The Timestep VPN from Saytek can run at this port. |
| 38201 | tcp/udp | galaxy7-data | Galaxy7 Data Tunnel |
| 38202 | tcp/udp | fairview | Fairview Message Service |
| 38203 | tcp/udp | agpolicy | AppGate Policy Server |
| 38204-39680 | tcp/udp | # | Unassigned |
| 39681 | tcp/udp | turbonote-1 | TurboNote Default Port |
| 39682-39999 | tcp/udp | # | Unassigned |
| 39112 | tcp/udp | # | Upfudoor |
| 39581 | tcp/udp | # | Winshell |
| 39780 | tcp/udp | # | Nibu |
| 39872 | tcp/udp | # | Drator |