Port No. | Protocol | Service |
Description |
6000-6063 | tcp/udp | x11 | X Window System |
6000 |
tcp |
# |
The Thing, Lovgate |
6006 |
tcp |
# |
Bad Blood |
6050 |
tcp/udp |
# |
ARCserv |
6051 |
tcp/udp |
# |
Zdemon, SysXXX |
6060 |
tcp |
# |
W32.Lovgate, W32.Spybot |
6064 | tcp/udp | ndl-ahp-svc | NDL-AHP-SVC |
6065 | tcp/udp | winpharaoh | WinPharaoh |
6066 | tcp/udp | ewctsp | EWCTSP |
6067 | tcp/udp | srb | SRB |
6068 | tcp/udp | gsmp | GSMP |
6069 | tcp/udp | trip | TRIP |
6070 | tcp/udp | messageasap | Messageasap |
6071 | tcp/udp | ssdtp | SSDTP |
6072 | tcp/udp | diagnose-proc | DIAGNOSE-PROC |
6073 | tcp/udp | directplay8 | DirectPlay8 |
6074 | tcp/udp | max | Microsoft Max |
6075-6084 | tcp/udp | # | Unassigned |
6085 | tcp/udp | konspire2b | konspire2b p2p network |
6086-6099 | tcp/udp | # | Unassigned |
6100 | tcp/udp | synchronet-db | SynchroNet-db |
6101 | tcp/udp | synchronet-rtc | SynchroNet-rtc |
6102 | tcp/udp | synchronet-upd | SynchroNet-upd |
6103 | tcp/udp | rets | RETS |
6104 | tcp/udp | dbdb | DBDB |
6105 | tcp/udp | primaserver | Prima Server |
6106 | tcp/udp | mpsserver | MPS Server |
6107 | tcp/udp | etc-control | ETC Control |
6108 | tcp/udp | sercomm-scadmin | Sercomm-SCAdmin |
6109 | tcp/udp | globecast-id | GLOBECAST-ID |
6110 | tcp/udp | softcm | HP SoftBench CM |
6111 | tcp/udp | spc | HP SoftBench Sub-Process Control |
6112 | tcp/udp | dtspcd | dtspcd |
6112 |
tcp/udp |
# |
BattleNet
The popular multiplayer game "Diablo" runs on this port. |
6113-6121 | tcp/udp | # | Unassigned |
6122 | tcp/udp | bex-webadmin | Backup Express Web Server |
6123 | tcp/udp | backup-express | Backup Express |
6124-6132 | tcp/udp | # | Unassigned |
6133 | tcp/udp | nbt-wol | New Boundary Tech WOL |
6134-6140 | tcp/udp | # | Unassigned |
6129 |
tcp/udp |
# |
W32.Mockbot. |
6141 | tcp/udp | meta-corp | Meta Corporation License Manager |
6142 | tcp/udp | aspentec-lm | Aspen Technology License Manager |
6143 | tcp/udp | watershed-lm | Watershed License Manager |
6144 | tcp/udp | statsci1-lm | StatSci License Manager - 1 |
6145 | tcp/udp | statsci2-lm | StatSci License Manager - 2 |
6146 | tcp/udp | lonewolf-lm | Lone Wolf Systems License Manager |
6147 | tcp/udp | montage-lm | Montage License Manager |
6148 | tcp/udp | ricardo-lm | Ricardo North America License Manager |
6149 | tcp/udp | tal-pod | tal-pod |
6150-6160 | tcp/udp | # | Unassigned |
6161 | tcp/udp | patrol-ism | PATROL Internet Srv Mgr |
6162 | tcp/udp | patrol-coll | PATROL Collector |
6163 | tcp/udp | pscribe | Precision Scribe Cnx Port |
6164-6252 | tcp/udp | # | Unassigned |
6187 |
tcp/udp |
# |
Tilser |
6253 | tcp/udp | crip | CRIP |
6254-6299 | tcp/udp | # | Unassigned |
6272 |
tcp |
# |
Secret Service |
6300 | tcp/udp | bmc-grx | BMC GRX |
6301-6320 | tcp/udp | # | Unassigned |
6321 | tcp/udp | emp-server1 | Empress Software Connectivity Server 1 |
6322 | tcp/udp | emp-server2 | Empress Software Connectivity Server 2 |
6323-6345 | tcp/udp | # | Unassigned |
6343 | tcp/udp | sflow | sFlow traffic monitoring |
6344-6345 | tcp/udp | # | Unassigned |
6346 | tcp/udp | gnutella-svc | gnutella-svc |
6347 | tcp/udp | gnutella-rtr | gnutella-rtr |
6348-6381 | tcp/udp | # | Unassigned |
6382 | tcp/udp | metatude-mds | Metatude Dialogue Server |
6383-6388 | tcp/udp | # | Unassigned |
6384 |
tcp |
# |
W32.HLLW.Gaobot |
6389 | tcp/udp | clariion-evr01 | clariion-evr01 |
6390-6399 | tcp/udp | # | Unassigned |
6394 |
tcp |
# |
W32.Spybot |
6400 | tcp/udp | info-aps | |
6400 |
tcp |
# |
The Thing |
6401 | tcp/udp | info-was | |
6402 | tcp/udp | info-eventsvr | |
6403 | tcp/udp | info-cachesvr | |
6404 | tcp/udp | info-filesvr | |
6405 | tcp/udp | info-pagesvr | |
6406 | tcp/udp | info-processvr | |
6407 | tcp/udp | reserved1 | |
6408 | tcp/udp | reserved2 | |
6409 | tcp/udp | reserved3 | |
6410 | tcp/udp | reserved4 | |
6411-6419 | tcp/udp | # | Unassigned |
6420 | tcp/udp | nim-vdrshell | NIM_VDRShell |
6421 | tcp/udp | nim-wan | NIM_WAN |
6422-6454 | tcp/udp | # | Unassigned |
6430 |
tcp/udp |
# |
Mirab File Transfer |
6455 | tcp | skip-cert-recv | SKIP Certificate Receive |
6456 | tcp | skip-cert-send | SKIP Certificate Send |
6457-6470 | tcp/udp | # | Unassigned |
6471 | tcp/udp | lvision-lm | LVision License Manager |
6472-6499 | tcp/udp | # | Unassigned |
6499-6500 |
tcp |
# |
Netscape CoolTalk Watchdog |
6500 | tcp/udp | boks | BoKS Master |
6501 | tcp/udp | boks_servc | BoKS Servc |
6502 | tcp/udp | boks_servm | BoKS Servm |
6502 |
tcp/udp |
# |
Netscape Conference |
6503 | tcp/udp | boks_clntd | BoKS Clntd |
6504 | tcp/udp | # | Unassigned |
6505 | tcp/udp | badm_priv | BoKS Admin Private Port |
6506 | tcp/udp | badm_pub | BoKS Admin Public Port |
6507 | tcp/udp | bdir_priv | "BoKS Dir Server, Private Port" |
6508 | tcp/udp | bdir_pub | "BoKS Dir Server, Public Port" |
6509 | tcp/udp | mgcs-mfp-port | MGCS-MFP Port |
6510 | tcp/udp | mcer-port | MCER Port |
6511-6542 | tcp/udp | # | Unassigned |
6543 | tcp/udp | lds-distrib | lds_distrib |
6544 | tcp/udp | lds-dump | LDS Dump Service |
6545-6546 | tcp/udp | # | Unassigned |
6547 | tcp/udp | apc-6547 | APC 6547 |
6548 | tcp/udp | apc-6548 | APC 6548 |
6549 | tcp/udp | apc-6549 | APC 6549 |
6550 | tcp/udp | fg-sysupdate | fg-sysupdate |
6551-6557 | tcp/udp | # | Unassigned |
6556 |
tcp/udp |
# |
W32.Toxbot |
6558 | tcp/udp | xdsxdm | |
6559-6579 | tcp/udp | # | Unassigned |
6564 |
tcp/udp |
# |
Sdbot |
6565 |
tcp |
# |
Nemog |
6566 | tcp/udp | sane-port | SANE Control Port |
6567-6578 | tcp/udp | # | Unassigned |
6579 | tcp/udp | affiliate | Affiliate |
6580 | tcp/udp | parsec-master | Parsec Masterserver |
6581 | tcp/udp | parsec-peer | Parsec Peer-to-Peer |
6582 | tcp/udp | parsec-game | Parsec Gameserver |
6583 | tcp/udp | joaJewelSuite | JOA Jewel Suite |
6584-6587 | tcp/udp | # | Unassigned |
6588 | tcp/udp | # | Unassigned
Unofficial use of port 6588 by AnalogX and Microsoft |
6589-6618 | tcp/udp | # | Unassigned |
6595 |
tcp/udp |
# |
Assasin |
6619 | tcp/udp | odette-ftps | ODETTE-FTP over TLS/SSL |
6620 | tcp/udp | kftp-data | Kerberos V5 FTP Data |
6621 | tcp/udp | kftp | Kerberos V5 FTP Control |
6622 | tcp/udp | mcftp | Multicast FTP |
6623 | tcp/udp | ktelnet | Kerberos V5 Telnet |
6624-6626 | tcp/udp | # | Unassigned |
6627 | tcp/udp | nexgen | Allied Electronics NeXGen |
6628 | tcp/udp | afesc-mc | AFE Stock Channel M/C |
6629-6630 | tcp/udp | # | Unassigned |
6631 | tcp/udp | # | Unassigned |
6631 |
tcp/udp |
# |
Sdbot |
6632-6664 | tcp/udp | # | Unassigned |
6660 |
tcp |
# |
W32.Spybot |
6661 |
tcp |
# |
TEMan, Weia-Meia |
6663 |
tcp |
# |
W32.Mytob |
6664-6665 |
tcp |
# |
Futro |
6664 |
tcp |
# |
W32.Zotob |
6665-6669 | tcp/udp | ircu | IRCU |
6666 |
tcp |
# |
AltaVista Tunnel server also uses this port. |
6666 |
tcp |
# |
Script kiddies trying to compromise
Real Server servers might mistakenly use this port. |
6666 |
tcp |
# |
Many sites running "napster" may use this port. |
6666 |
tcp |
# |
Dark Connection Inside, NetBus worm, W32.HLLW.Warpigs, BAT.Boohoo.Worm, Foobot |
6666 |
udp |
# |
Kali uses UDP 6666. |
6667 |
tcp |
# |
VocalTec Internet Phone
An alternate port other than 6670
used to connect to servers. |
6667 |
tcp |
# |
IRC Clients can connect to servers on this port. |
6667 |
tcp |
# |
Dark FTP, ScheduleAgent, SubSeven,
Subseven 2.1.4 DefCon 8, Trinity, WinSatan,
W32.HLLW.Gaobot, IrcContact, Deftcode, IRC.Flood
W32.HLLW.Nool, W32.HLLW.Warpigs, Spigot,
W32.HLLW.Studd, W32.Cissi, W32.Mimail W32.Opasa, Sdbot, W32.Korgo, Hacarmy, W32.Mota, W32.Spybot, Alnica, W32.Mydoom, Maxload, W32.Bofra, Lateda, W32.Protoride, W32.Blatic, Mindos, W32.Wallz, W32.Bropia, W32.Randex, W32.Mytob, W32.Stubbot, W32.Linkbot, W32.Zotob, W32.Ruland, IRC.Litebot, Kaiten |
6669 |
tcp |
# |
Host Control, Vampire |
6670 | tcp/udp | vocaltec-gold | Vocaltec Global Online Directory |
6670 |
tcp |
# |
BackWeb Server, Deep Throat, Foreplay,
WinNuke eXtreame |
6671 | tcp/udp | # | Unassigned |
6672 | tcp/udp | vision_server | vision_server |
6673 | tcp/udp | vision_elmd | vision_elmd |
6673 |
tcp |
# |
W32.Mytob |
6674-6700 | tcp/udp | # | Unassigned |
6697 |
tcp/udp |
# |
Feardoor |
6699 |
tcp |
# |
A program called "napster" for exchanging
MP3 files defaults to this port. |
6701 | tcp/udp | kti-icad-srvr | KTI/ICAD Nameserver |
6702 | tcp/udp | e-design-net | e-Design network |
6703 | tcp/udp | e-design-web | e-Design web |
6704-6713 | tcp/udp | # | Unassigned |
6711 |
tcp |
# |
BackDoor-G, SubSeven, VP Killer, Kilo |
6712 |
tcp |
# |
Funny trojan, SubSeven |
6713 |
tcp |
# |
SubSeven |
6714 | tcp/udp | ibprotocol | Internet Backplane Protocol |
6715 | tcp/udp | fibotrader-com | Fibotrader Communications |
6716-6766 | tcp/udp | # | Unassigned |
6718 |
tcp |
# |
Kilo |
6723 |
tcp |
# |
Mstream |
6754 |
tcp/udp |
# |
Mapsy |
6767 | tcp/udp | bmc-perf-agent | BMC PERFORM AGENT |
6768 | tcp/udp | bmc-perf-mgrd | BMC PERFORM MGRD |
6769 | tcp/udp | adi-gxp-srvprt | ADInstruments GxP Server |
6770 | tcp/udp | plysrv-http | PolyServe http |
6771 | tcp/udp | plysrv-https | PolyServe https |
6771 |
tcp |
# |
Deep Throat, Foreplay |
6772-6785 | tcp/udp | # | Unassigned |
6776 |
tcp/udp |
hnmp |
RAT:SubSeven
This port often seen as part of the Sub7
communication. You may see a steady
stream of connection attempts: this is
because it uses this port separately from
the command port in order to transfer
information. Sometimes the control-
connection thinks the agent is alive,
and will continue to attempt this
connection as well. Backdoor port in Sub7 |
6776 |
tcp |
# |
2000 Cracks, BackDoor-G, VP Killer |
6777 |
tcp |
# |
W32.Gaobot |
6786 | tcp/udp | smc-jmx | Sun Java Web Console JMX |
6787 | tcp/udp | smc-admin | Sun Web Console Admin |
6788 | tcp/udp | smc-http | SMC-HTTP |
6789 | tcp/udp | smc-https | SMC-HTTPS |
6789 |
tcp |
# |
W32.Netsky |
6790 | tcp/udp | hnmp | HNMP |
6791 | tcp/udp | hnm | Halcyon Network Manager |
6792-6830 | tcp/udp | # | Unassigned |
6831 | tcp/udp | ambit-lm | ambit-lm |
6832-6840 | tcp/udp | # | Unassigned |
6838 |
udp |
# |
Mstream |
6841 | tcp/udp | netmo-default | Netmo Default |
6842 | tcp/udp | netmo-http | Netmo HTTP |
6843-6849 | tcp/udp | # | Unassigned |
6850 | tcp/udp | iccrushmore | ICCRUSHMORE |
6851-6887 | tcp/udp | # | Unassigned |
6868 |
tcp |
# |
Darkmoon |
6883 |
tcp |
# |
Delta Source DarkStar |
6888 | tcp/udp | muse | MUSE |
6889-6945 | tcp/udp | # | Unassigned |
6912 |
tcp |
# |
Shit Heep |
6939 |
tcp |
# |
Indoctrination |
6946 | tcp/udp | bioserver | Biometrics Server |
6947-6960 | tcp/udp | # | Unassigned |
6961 | tcp/udp | jmact3 | JMACT3 |
6962 | tcp/udp | jmevt2 | jmevt2 |
6963 | tcp/udp | swismgr1 | swismgr1 |
6964 | tcp/udp | swismgr2 | swismgr2 |
6965 | tcp/udp | swistrap | swistrap |
6966 | tcp/udp | swispol | swispol |
6967-6968 | tcp/udp | # | Unassigned |
6969 | tcp/udp | acmsoda | acmsoda |
6969 |
tcp |
# |
GateCrasher, IRC 3, Net Controller, Priority, Robi, Sparta, Floodnet, Assasin, Khaos, Ratega,
Danton |
6970-6997 | tcp/udp | # | Unassigned |
6970 |
tcp |
# |
GateCrasher |
6970-6971 |
udp |
# |
RTP(RealTime Protocol) |
6998 | tcp/udp | iatp-highpri | IATP-highPri |
6999 | tcp/udp | iatp-normalpri | IATP-normalPri |