# Common Port Numbers

> A reference for the ports you actually get stuck on: what listens there, whether it should face the internet, and the command that names the process holding it.

- URL: https://bytescope.dev/en/port/
- Locale: en · Also: [ja](https://bytescope.dev/ja/port.md) · [zh-Hant](https://bytescope.dev/zh-Hant/port.md)
- Runs: Everything runs locally in your browser — nothing is uploaded.
- Requires: Any modern browser (Chrome, Edge, Firefox, Safari), desktop and mobile.
- Updated: 2026-09-08

## What it does

### Built for the moment the port is the problem

Almost nobody searches a port number out of curiosity. They search it because a server will not start, a client will not connect, or a scan came back with something listening that nobody remembers turning on. So every page here leads with the thing that unblocks you — the exact command that names the process holding the port on macOS, Linux and Windows — and only then explains what the service on it is for.

### Three commands, one answer

The question "who has this port" has a different answer on each platform, and each answer has a trap. `lsof` on macOS shows only your own processes unless you run it with `sudo`, so a server started by Docker or by a system user looks invisible. `ss` on Linux hides the owning process for the same reason. `netstat` on Windows matches with `findstr`, which compares substrings, so a search for `:3306` also matches `:33060`. Every page spells out how to read the output, not just what to type.

### Assigned, conventional, or just habit

IANA maintains the Service Name and Transport Protocol Port Number Registry, which is the only authority on what a port number officially means. Plenty of everyday pairings are not in it, and plenty of registered pairings are ignored in practice, so each page says which of the two it is rather than blurring them. The registry also sets the three ranges: 0-1023 are system ports, which need privilege to bind on Unix; 1024-49151 are user ports; and 49152-65535 are dynamic ports meant for the client end of a connection. Operating systems do not all follow the last one — Linux hands out ephemeral ports from 32768-60999 by default.

## Limits

Does not scan ports on a host; it is a reference of well-known port numbers and the services behind them.

## FAQ

### How do I find out what is using a port?

On macOS, `sudo lsof -nP -iTCP:8080 -sTCP:LISTEN`. On Linux, `sudo ss -tlnp 'sport = :8080'`. On Windows, `netstat -ano | findstr :8080` and then `tasklist /FI "PID eq <pid>"` to turn the PID into a name. All three print the address the process bound to as well, which answers the follow-up question — whether it is reachable from another machine — at the same time.

### How do I free a port that is already in use?

Identify the owner first with the command above, because the answer is often "an earlier run of the same server" and stopping it properly is better than killing it. If the port frees itself a minute or two later, nothing was holding it: sockets closed with a connection still open sit in `TIME_WAIT` and refuse a new bind until the timer expires, unless the program sets `SO_REUSEADDR`. On Windows a bind can also fail with nothing listening at all, because Hyper-V, WSL2 or Docker reserved a block of ports at boot — `netsh interface ipv4 show excludedportrange protocol=tcp` lists them.

### Does the port number decide which protocol is spoken?

No. A port number is just a 16-bit label the kernel uses to route a packet to a socket; nothing enforces what is spoken over it. Anything can listen on 443 without speaking TLS, and a web server on 8080 is an ordinary HTTP server on an unusual number. The conventions are worth knowing because they tell you what is *probably* there, which is why `nmap -sV` exists — it reads the actual response instead of trusting the number.

### Which ports are safe to expose to the internet?

As a rule, the ones designed for hostile networks: HTTPS on 443, and SSH on 22 with password authentication switched off. Database ports are the ones that cause real incidents — 3306, 5432, 6379 and 27017 all authenticate, but exposing them puts that authentication in front of the whole internet, and public scanners find a new listener within hours. Reach those through a private network, a VPN or an SSH tunnel instead, and restrict them by source address at the firewall if they truly must be routable.

### What is the difference between a well-known, registered and dynamic port?

They are the three ranges in the IANA registry. System ports, 0-1023, are the well-known ones; on Unix-like systems binding them requires root or an explicitly granted capability, which is exactly why so much software defaults to 8080 instead of 80. User ports, 1024-49151, are registered on request. Dynamic ports, 49152-65535, are reserved for the temporary source port a client picks for an outgoing connection, and are never meant to be registered to anything.