Port No. | Protocol | Service | Description |
9000 | tcp/udp | cslistener | CSlistener |
9000 |
tcp |
# |
AltaVista HTTP Server
The may be an attempt to compromise
an AltaVista HTTP (web) server. |
9000 |
tcp |
# |
Sendmail Switch SDAP
Sendmail's "Switch" protocol listens on
this TCP port. It also listens on port 8890. |
9000 |
tcp |
# |
Netministrator, W32.Randex, W32.Mytob,
W32.Esbot |
9000 |
udp |
# |
Asheron's Call
This port is used in Microsoft's massively-
multiplayer game called "Asheron's Call".
The game can continue to contact the
player even after the player has logged out. |
9001 | tcp/udp | etlservicemgr | ETL Service Manager |
9002 | tcp/udp | dynamid | DynamID authentication |
9003-9005 | tcp/udp | # | Unassigned |
9006 | tcp/udp | # | "De-Commissioned Port 02/24/00, ms" |
9007-9008 | tcp/udp | # | Unassigned |
9009 | tcp/udp | pichat | Pichat Server |
9010-9019 | tcp/udp | # | Unassigned |
9010 |
tcp |
# |
Tumag |
9020 | tcp/udp | tambora | TAMBORA |
9021 | tcp/udp | panagolin-ident | Pangolin Identification |
9022 | tcp/udp | paragent | PrivateArk Remote Agent |
9023 | tcp/udp | swa-1 | Secure Web Access - 1 |
9024 | tcp/udp | swa-2 | Secure Web Access - 2 |
9025 | tcp/udp | swa-3 | Secure Web Access - 3 |
9026 | tcp/udp | swa-4 | Secure Web Access - 4 |
9027-9079 | tcp/udp | # | Unassigned |
9030 |
tcp |
# |
W32.Beagle |
9035 |
tcp |
# |
W32.Beagle |
9040 |
tcp |
# |
Mitglieder |
9059 |
tcp |
# |
W32.Esbot |
9080 | tcp/udp | glrpc | Groove GLRPC |
9081-9087 | tcp/udp | # | Unassigned |
9088 | tcp/udp | sqlexec | IBM Informix SQL Interface |
9089 | tcp/udp | sqlexec-ssl | IBM Informix SQL Interface - Encrypted |
9090 | tcp/udp | websm | WebSM |
9091 | tcp/udp | xmltec-xmlmail | xmltec-xmlmail |
9092 | tcp/udp | XmlIpcRegSvc | Xml-Ipc Server Reg |
9093-9099 | tcp/udp | # | Unassigned |
9100 | tcp/udp | hp-pdl-datastr | PDL Data Streaming Port |
9100 | tcp/udp | pdl-datastream | Printer PDL Data Stream |
9101 | tcp/udp | bacula-dir | Bacula Director |
9102 | tcp/udp | bacula-fd | Bacula File Daemon |
9103 | tcp/udp | bacula-sd | Bacula Storage Daemon |
9104 | tcp/udp | peerwire | PeerWire |
9105-9118 | tcp/udp | # | Unassigned |
9119 | tcp/udp | mxit | MXit Instant Messaging |
9120-9130 | tcp/udp | # | Unassigned |
9125 |
tcp |
# |
Nibu |
9131 | tcp/udp | dddp | Dynamic Device Discovery |
9132-9159 | tcp/udp | # | Unassigned |
9136 |
tcp |
# |
Sdbot |
9148 |
tcp |
# |
W32.HLLW.Nautic |
9160 | tcp/udp | netlock1 | NetLOCK1 |
9161 | tcp/udp | netlock2 | NetLOCK2 |
9162 | tcp/udp | netlock3 | NetLOCK3 |
9163 | tcp/udp | netlock4 | NetLOCK4 |
9164 | tcp/udp | netlock5 | NetLOCK5 |
9165-9190 | tcp/udp | # | Unassigned |
9191 | tcp/udp | sun-as-jpda | Sun AppSvr JPDA |
9192-9199 | tcp/udp | # | Unassigned |
9200 | tcp/udp | wap-wsp | WAP connectionless session service |
9200 |
tcp/udp |
# |
Lexmark printers open both TCP and
UDP port 9200 for some unknown purpose. |
9201 | tcp/udp | wap-wsp-wtp | WAP session service |
9202 | tcp/udp | wap-wsp-s | WAP secure connectionless session service |
9203 | tcp/udp | wap-wsp-wtp-s | WAP secure session service |
9204 | tcp/udp | wap-vcard | WAP vCard |
9205 | tcp/udp | wap-vcal | WAP vCal |
9206 | tcp/udp | wap-vcard-s | WAP vCard Secure |
9207 | tcp/udp | wap-vcal-s | WAP vCal Secure |
9208 | tcp/udp | rjcdb-vcards | rjcdb vCard |
9209 | tcp/udp | almobile-system | ALMobile System Service |
9210 | tcp/udp | oma-mlp | OMA Mobile Location Protocol |
9211 | tcp/udp | oma-mlp-s | OMA Mobile Location Protocol Secure |
9212 | tcp/udp | serverviewdbms | Server View dbms access |
9213 | tcp/udp | serverstart | ServerStart RemoteControl |
9214 | tcp/udp | ipdcesgbs | IPDC ESG BootstrapService |
9215 | tcp/udp | insis | Integrated Setup and Install Service |
9216 | tcp/udp | # | Unassigned |
9217 | tcp/udp | fsc-port | FSC Communication Port |
9218-9221 | tcp/udp | # | Unassigned |
9222 | tcp/udp | teamcoherence | QSC Team Coherence |
9223-9280 | tcp/udp | # | Unassigned |
9281 | tcp/udp | swtp-port1 | SofaWare transport port 1 |
9282 | tcp/udp | swtp-port2 | SofaWare transport port 2 |
9283 | tcp/udp | callwaveiam | CallWaveIAM |
9284 | tcp/udp | visd | VERITAS Information Serve |
9285 | tcp/udp | n2h2server | N2H2 Filter Service Port |
9286 | tcp/udp | # | Unassigned |
9287 | tcp/udp | cumulus | Cumulus |
9288-9291 | tcp/udp | # | Unassigned |
9292 | tcp/udp | armtechdaemon | ArmTech Daemon |
9293-9317 | tcp/udp | # | Unassigned |
9318 | tcp/udp | secure-ts | PKIX TimeStamp over TLS |
9319-9320 | tcp/udp | # | Unassigned |
9321 | tcp/udp | guibase | guibase |
9322-9342 | tcp/udp | # | Unassigned |
9325 |
udp |
# |
Mstream |
9343 | tcp/udp | mpidcmgr | MpIdcMgr |
9344 | tcp/udp | mphlpdmc | Mphlpdmc |
9345 | tcp/udp | # | Unassigned |
9346 | tcp/udp | ctechlicensing | C Tech Licensing |
9347-9373 | tcp/udp | # | Unassigned |
9374 | tcp/udp | fjdmimgr | fjdmimgr |
9375-9395 | tcp/udp | # | Unassigned |
9396 | tcp/udp | fjinvmgr | fjinvmgr |
9397 | tcp/udp | mpidcagt | MpIdcAgt |
9398-9417 | tcp/udp | # | Unassigned |
9400 |
tcp |
# |
InCommand |
9418 | tcp/udp | git | git pack transfer service |
9419-9499 | tcp/udp | # | Unassigned |
9500 | tcp/udp | ismserver | ismserver |
9501-9534 | tcp/udp | # | Unassigned |
9515 |
tcp |
# |
W32.Loxbot |
9535 | tcp/udp | mngsuite | Management Suite Remote Control |
9536-9554 | tcp/udp | # | Unassigned |
9555 | tcp/udp | trispen-sra | Trispen UDP tunnel |
9556-9591 | tcp/udp | # | Unassigned |
9592 | tcp/udp | ldgateway | LANDesk Gateway |
9593 | tcp/udp | cba8 | LANDesk Management Agent |
9594 | tcp/udp | msgsys | Message System |
9595 | tcp/udp | pds | Ping Discovery Service |
9596 | tcp/udp | mercury-disc | Mercury Discovery |
9597 | tcp/udp | pd-admin | PD Administration |
9598 | tcp/udp | vscp | Very Simple Ctrl Protocol |
9599 | tcp/udp | robix | Robix |
9600 | tcp/udp | micromuse-ncpw | MICROMUSE-NCPW |
9601-9611 | tcp/udp | # | Unassigned |
9604 |
tcp |
# |
W32.Kibuv.Worm |
9612 | tcp/udp | streamcomm-ds | StreamComm User Directory |
9613-9699 | tcp/udp | # | Unassigned |
9696-9697 |
tcp |
# |
Gholame |
9704 |
tcp |
# |
A popular Linux rpc.statd exploit
will drop a root shell on this port. |
9700 | tcp/udp | board-roar | Board M.I.T. Service |
9701-9746 | tcp/udp | # | Unassigned |
9704 |
tcp/udp |
# |
A popular wu-fptd exploit drops
a root shell on this port. |
9747 | tcp/udp | l5nas-parchan | L5NAS Parallel Channel |
9748-9749 | tcp/udp | # | Unassigned |
9750 | tcp/udp | board-voip | Board M.I.T. Synchronous Collaboration |
9751-9752 | tcp/udp | # | Unassigned |
9753 | tcp/udp | rasadv | rasadv |
9754-9799 | tcp/udp | # | Unassigned |
9777-9778 |
tcp/udp |
# |
StealthEye |
9800 | tcp/udp | davsrc | WebDav Source Port |
9801 | tcp/udp | sstp-2 | Sakura Script Transfer Protocol-2 |
9802 | tcp/udp | davsrcs | WebDAV Source TLS/SSL |
9803-9874 | tcp/udp | # | Unassigned |
9832 |
tcp |
# |
W32.Mytob |
9867 |
tcp/udp |
# |
Sokeven |
9870 |
tcp/udp |
# |
Recerv, R3C |
9871 |
tcp |
# |
Theef |
9872-9875 |
tcp |
# |
Portal of Doom |
9875 | tcp/udp | sapv1 | Session Announcement v1 |
9876 | tcp/udp | sd | Session Director |
9876 |
tcp/udp |
# | A Norton Commander lookalike
for UNIX. The client portion can
browse files on the hard disk, in
tar files, and across the network
with this server component. This
protocol is Sun RPC based and
registers with portmapper. |
9876 |
tcp |
# |
Cyber Attacker, Rux, Lolok |
9878 |
tcp |
# |
TransScout |
9888 | tcp/udp | cyborg-systems | CYBORG Systems |
9898 | tcp/udp | monkeycom | MonkeyCom |
9898 |
tcp/udp |
# |
CrashCool, W32.Dabber |
9899 | tcp/udp | sctp-tunneling | SCTP TUNNELING |
9900 | tcp/udp | iua | IUA |
9900 |
tcp/udp |
# |
W32.HLLW.Gaobot |
9901-9908 | tcp/udp | # | Unassigned |
9909 | tcp/udp | domaintime | domaintime |
9910 | tcp/udp | # | Unassigned |
9911 | tcp/udp | sype-transport | SYPECom Transport Protocol |
9912-9949 | tcp/udp | # | Unassigned |
9950 | tcp/udp | apc-9950 | APC 9950 |
9951 | tcp/udp | apc-9951 | APC 9951 |
9952 | tcp/udp | apc-9952 | APC 9952 |
9953 | tcp/udp | acis | 9953 |
9954-9988 | tcp/udp | # | Unassigned |
9955 |
tcp |
# |
W32.Reatle |
9958 |
tcp |
# |
W32.Reatle |
9989 |
tcp |
# |
RAT:IniKiller
Destroys basic files, like .ini files |
9990 | tcp/udp | osm-appsrvr | OSM Applet Server |
9991 | tcp/udp | osm-oev | OSM Event Server |
9992 | tcp/udp | palace-1 | OnLive-1 |
9993 | tcp/udp | palace-2 | OnLive-2 |
9994 | tcp/udp | palace-3 | OnLive-3 |
9995 | tcp/udp | palace-4 | Palace-4 |
9996 | tcp/udp | palace-5 | Palace-5 |
9996 |
tcp/udp |
# |
W32.Sasser |
9997 | tcp/udp | palace-6 | Palace-6 |
9998 | tcp/udp | distinct32 | Distinct32 |
9999 | tcp/udp | distinct | distinct |
9999 |
tcp |
# |
The Prayer, Beasty, Lateda |