Port Number Lookup
Free port number lookup. Fully offline, no network requests.
Loading tool...
What is Port Number Lookup?
The Port Number Lookup identifies what a TCP or UDP port is for, from a bundled dataset of 60+ well-known and commonly deployed services based on the IANA registry. Search by number or service name, filter by protocol, and read plain-language descriptions plus risk flags that explain why ports like SMB, RDP, Redis and Elasticsearch keep appearing in security reports — all computed locally with no network requests.
Key Benefits
- Instant identification of unknown ports in scan and netstat reports
- Risk flags with reasons, not just colours
- Protocol filtering across TCP, UDP and dual-stack services
- Works completely offline: the dataset ships with the page
- One consistent reference for mixed Windows, Linux and cloud teams
Common Use Cases
- •Investigating an unfamiliar listener found in a netstat output
- •Reviewing firewall rules before opening ports for a new service
- •Checking which database port a vendor tool connects to
- •Training new admins on which ports are dangerous to expose
- •Verifying that a hardening checklist covers the usual suspects
How to Look Up a Network Port
- Search by number or name: Type a port number like 3389 or a service name like ssh. Matching is instant against the bundled dataset.
- Filter by protocol: Switch between TCP, UDP and all protocols to narrow the list to the transport you care about.
- Read the risk flag: High-risk ports include a note explaining why they are abused, from cleartext credentials to unauthenticated databases, so you can decide whether the port should be reachable.
Key Features
- 60+ well-known and commonly deployed ports in a bundled dataset
- Search by port number prefix or by service name substring
- TCP, UDP or all-protocol filtering
- Low, medium and high risk flags with plain-language reasons
- Fully offline: embedded data, no network requests
Frequently Asked Questions
What is the difference between TCP and UDP ports?
Ports identify services within a transport protocol, and TCP and UDP are separate transports with separate port spaces. Port 53 over TCP carries DNS zone transfers and large responses, while port 53 over UDP carries ordinary queries. A service can use both, which is why some entries list TCP/UDP.
Which ports should never be exposed to the internet?
The high-risk flags in this lookup mark the usual suspects: telnet, SMB (445), RDP (3389), database listeners like 1433, 3306, 5432 and 27017, unauthenticated stores like Redis (6379) and Elasticsearch (9200), and container or device control APIs like 2375 and 5555. If one of these must be reachable, put it behind a VPN or an authenticated gateway.
Why does the same port sometimes list TCP/UDP?
Some services genuinely run over both transports: DNS answers small queries over UDP and falls back to TCP for large responses, Kerberos uses both, and NFS version 3 relies on UDP while version 4 prefers TCP. The combined label means the dataset documents both usages.
Is the risk flag a verdict that the service is insecure?
No. The flag describes how often the port is attacked or misconfigured, based on common incident patterns. SSH on port 22 is a secure protocol that still attracts constant brute force, so it is flagged medium; an open Redis instance is far more dangerous per exposure.
Featured in Collections:Network & DevOps Toolkit