ByteScope

Common Port Numbers

What runs on a port, whether it belongs on the internet, and how to find the process holding it.

Your files never leave your browser — all processing is local.

Start from the port you are stuck on. Every page names the service, says whether it should ever be reachable from the internet, and gives the exact macOS, Linux and Windows command that tells you which process is holding it.

Filter by category
PortServiceTransportWhat runs there
21FTPTCPFTP's control connection — the port that carries the commands and the numbered replies, while the files themselves move over a second connection on a port nobody told your firewall about.
22SSHTCPThe port sshd listens on — and behind it `scp`, `rsync`, `git` over SSH, tunnels and SFTP, which is why one refused connection here breaks five different things at once.
23TelnetTCPThe plaintext remote-terminal port, still the default admin interface on switches, cameras and embedded boards — and the port people open by accident and get scanned on within minutes.
25SMTPTCPThe server-to-server mail relay port — the one your app should almost never dial, and the one that times out on a cloud VM because the provider blocks it, not because the mail server is down.
53DNSTCP/UDPThe name-resolution port, on UDP and TCP — and on most modern Linux desktops it is already taken by systemd-resolved, which is why your dnsmasq or Pi-hole will not start.
80HTTPTCPThe plain HTTP port. Mostly a redirect to 443 these days — but closing it breaks certificate renewal, and binding it as a normal user fails before your server ever starts.
443HTTPSTCP/UDPThe HTTPS port — and, since HTTP/3, a UDP port as well, so a TCP-only check can tell you nothing is listening while half your traffic is being served.
3306MySQLTCPThe port a MySQL, MariaDB or Percona server listens on for the classic client protocol — and the one your driver reports it cannot reach.
3389RDPTCP/UDPThe Remote Desktop listener on Windows — the port that is already taken when the service will not start, and silently dropped when the client just spins.
5432PostgreSQLTCPWhere a PostgreSQL cluster listens — and, when psql refuses, the port that is either loopback-only, occupied by a second cluster, or gated by pg_hba.conf.
5900VNCTCPThe base port of the RFB protocol that VNC speaks — and the reason a viewer refuses to connect while the server sits happily on 5901.
6379RedisTCPThe port a Redis server listens on for RESP — the one your client says it cannot reach, and the one an exposed cache gets found on within hours.
8080HTTP alternateTCPThe port a dev server, a Tomcat instance or a proxy grabs when 80 is taken — and the one that is already taken when you need it.
8443HTTPS alternateNot IANA assignedTCPThe unprivileged twin of 443: TLS on a port an ordinary user can bind, and the number Tomcat and most appliance admin consoles reach for.
27017MongoDBTCPWhere mongod and mongos listen by default — and the port a driver spends thirty silent seconds failing to select a server on.

About this tool

Built for the moment the port is the problem Almost nobody searches a port number out of curiosity. They search it because a server will not start, a client will not connect, or a scan came back with something listening that nobody remembers turning on. So every page here leads with the thing that unblocks you — the exact command that names the process holding the port on macOS, Linux and Windows — and only then explains what the service on it is for.

Three commands, one answer The question "who has this port" has a different answer on each platform, and each answer has a trap. lsof on macOS shows only your own processes unless you run it with sudo, so a server started by Docker or by a system user looks invisible. ss on Linux hides the owning process for the same reason. netstat on Windows matches with findstr, which compares substrings, so a search for :3306 also matches :33060. Every page spells out how to read the output, not just what to type.

Assigned, conventional, or just habit IANA maintains the Service Name and Transport Protocol Port Number Registry, which is the only authority on what a port number officially means. Plenty of everyday pairings are not in it, and plenty of registered pairings are ignored in practice, so each page says which of the two it is rather than blurring them. The registry also sets the three ranges: 0-1023 are system ports, which need privilege to bind on Unix; 1024-49151 are user ports; and 49152-65535 are dynamic ports meant for the client end of a connection. Operating systems do not all follow the last one — Linux hands out ephemeral ports from 32768-60999 by default.

Frequently asked questions

How do I find out what is using a port?

On macOS, sudo lsof -nP -iTCP:8080 -sTCP:LISTEN. On Linux, sudo ss -tlnp 'sport = :8080'. On Windows, netstat -ano | findstr :8080 and then tasklist /FI "PID eq <pid>" to turn the PID into a name. All three print the address the process bound to as well, which answers the follow-up question — whether it is reachable from another machine — at the same time.

How do I free a port that is already in use?

Identify the owner first with the command above, because the answer is often "an earlier run of the same server" and stopping it properly is better than killing it. If the port frees itself a minute or two later, nothing was holding it: sockets closed with a connection still open sit in TIME_WAIT and refuse a new bind until the timer expires, unless the program sets SO_REUSEADDR. On Windows a bind can also fail with nothing listening at all, because Hyper-V, WSL2 or Docker reserved a block of ports at boot — netsh interface ipv4 show excludedportrange protocol=tcp lists them.

Does the port number decide which protocol is spoken?

No. A port number is just a 16-bit label the kernel uses to route a packet to a socket; nothing enforces what is spoken over it. Anything can listen on 443 without speaking TLS, and a web server on 8080 is an ordinary HTTP server on an unusual number. The conventions are worth knowing because they tell you what is *probably* there, which is why nmap -sV exists — it reads the actual response instead of trusting the number.

Which ports are safe to expose to the internet?

As a rule, the ones designed for hostile networks: HTTPS on 443, and SSH on 22 with password authentication switched off. Database ports are the ones that cause real incidents — 3306, 5432, 6379 and 27017 all authenticate, but exposing them puts that authentication in front of the whole internet, and public scanners find a new listener within hours. Reach those through a private network, a VPN or an SSH tunnel instead, and restrict them by source address at the firewall if they truly must be routable.

What is the difference between a well-known, registered and dynamic port?

They are the three ranges in the IANA registry. System ports, 0-1023, are the well-known ones; on Unix-like systems binding them requires root or an explicitly granted capability, which is exactly why so much software defaults to 8080 instead of 80. User ports, 1024-49151, are registered on request. Dynamic ports, 49152-65535, are reserved for the temporary source port a client picks for an outgoing connection, and are never meant to be registered to anything.