Well-Known Port Numbers

An IP address gets a packet to the right machine. A port gets it to the right program on that machine. It is a 16-bit number in the TCP or UDP header, which is why the range stops at 65535, and it exists purely so one host can run a web server, a database, and an SSH daemon without them reading each other's mail.

A connection is identified by four things together — source IP, source port, destination IP, destination port — so thousands of browsers can all talk to port 443 on the same server without ambiguity. Each of them uses a different source port, drawn from the ephemeral range at the top.

TCP and UDP number their ports independently. Port 53/TCP and 53/UDP are technically different endpoints, even though DNS happens to use both. That is why the protocol column matters.

Internet-wide scanning finds every open port on every public address within hours. These are the ones that turn an exposed host into someone else's host:

• 445 (SMB) — the vector for WannaCry and NotPetya. There is no configuration that makes public SMB acceptable.
• 3389 (RDP) — among the most brute-forced ports on the internet and the most common ransomware entry point. Put it behind a VPN.
• 2375 (Docker API) — unauthenticated by design. Anyone who can reach it can start a privileged container and own the host.
• 6379 (Redis), 27017 (MongoDB), 9200 (Elasticsearch) — all historically shipped with no authentication and bound to every interface. Billions of records have leaked this way.
• 623 (IPMI) — out-of-band management with a long history of authentication bypasses. It grants power over the physical machine.
• 10250 (kubelet) — unauthenticated access allows executing commands inside any container on the node.

The general rule: databases, admin interfaces and orchestration APIs belong on a private network or behind a VPN. Binding to 127.0.0.1 instead of 0.0.0.0 is the single cheapest mitigation, and it prevents most accidental exposure outright.

HTTP/3 kept the number and changed the transport. It runs on 443/UDP via QUIC rather than 443/TCP. Firewalls that allow TCP 443 but block UDP 443 silently force clients back to HTTP/2, which is a common and hard-to-spot performance regression.

NAT made source ports scarce. Carrier-grade NAT shares one public address across thousands of subscribers by multiplexing source ports. Each device gets a slice of the 65k space, which is why aggressive connection-per-request patterns behave badly on mobile networks.

Containers remapped everything. A port inside a container is not the port outside it, and -p 8080:80 means the world sees 8080 while the process believes it is on 80. Most "the port is not open" incidents in container setups are a mapping mistake, not a firewall one.

SNI ended the one-IP-per-site era. Virtual hosting on 443 means the port no longer identifies the service — the TLS handshake does. Which is also why a single well-known port can front thousands of unrelated applications.