Kernaali ToolsDefault ports worth recognizing
| Service | Port / transport | What to check |
|---|---|---|
| SSH | 22/TCP | Encrypted remote administration |
| SMTP | 25/TCP | Server-to-server mail delivery |
| DNS | 53/UDP and TCP | TCP is also required; not only zone transfers |
| DHCPv4 | 67/UDP server, 68/UDP client | Broadcast and relay paths |
| HTTP | 80/TCP | Often redirects to HTTPS |
| NTP | 123/UDP | Time synchronization |
| SNMP | 161/UDP; traps 162/UDP | Version and access restrictions matter |
| BGP | 179/TCP | Routing sessions between peers |
| LDAP | 389/TCP | TLS may be negotiated with StartTLS |
| HTTPS | 443/TCP; HTTP/3 commonly 443/UDP | QUIC uses UDP |
| SMB | 445/TCP | File and related Windows services |
| IKE / IPsec NAT-T | 500/UDP, 4500/UDP | ESP itself is IP protocol 50, not a port |
| Mail submission | 587/TCP; implicit TLS 465/TCP | Distinct from relay port 25 |
| LDAPS | 636/TCP | LDAP with implicit TLS |
| IMAPS | 993/TCP | IMAP with implicit TLS |
| RDP | 3389/TCP and UDP | Remote desktop; restrict exposure |
| Syslog | 514/UDP; TLS 6514/TCP | Transport and reliability vary |
Use ports as clues
A listener on TCP 443 is not proof of HTTPS, and an application can use a different port. Confirm the process, protocol and configured endpoint. Opening both transports by habit can expose unnecessary services.
Firewall planning example
A DNS client normally needs queries to its designated resolver on UDP and TCP 53. That does not imply allowing arbitrary Internet hosts to query your own resolver. State direction, destination and purpose in the rule.
Port ranges
IANA divides port numbers into system (0–1023), user (1024–49151) and dynamic/private (49152–65535). Operating systems may choose different ephemeral ranges. This is a small manually curated factual reference, not a copy of the complete registry.
Technical references
Reviewed 9 September 2026. Found an issue? Send a correction with a reproducible example.