Type a port number or a service name. Find out what is listening on 5432, which port Redis uses, and whether it should ever be reachable from the internet.
Runs entirely in your browser — nothing you enter here is sent to a server.
An IP address gets a packet to a machine; the port number gets it to the right program on that machine. A port is a 16-bit number, so there are 65,536 of them for TCP and the same again for UDP. A web server listens on 443, a database on 5432, and the operating system uses the pair "address and port" to deliver each connection to the process that asked for it.
The numbers are conventions, registered with IANA, not rules. Nothing stops you running SSH on port 2222 or a web server on 8080 — but clients assume the standard port unless told otherwise, and so do firewalls, scanners and attackers.
Assigned to core services: HTTP, SSH, DNS, SMTP. On Unix systems only root may listen on them.
Assigned to specific applications on request: MySQL 3306, PostgreSQL 5432, Redis 6379, RDP 3389.
Ephemeral ports the system picks for the client side of outgoing connections. Never used for a permanent service.
TCP 53 and UDP 53 are different ports that happen to share a number. A firewall rule must name the protocol.
As few as possible. A public web server needs 80 and 443, a mail server its mail ports — and that is normally the whole list. Databases, caches, message queues and admin interfaces should never be reachable from the internet: exposed Redis, MongoDB, Elasticsearch and Docker API ports are among the commonest causes of data breaches, because many of these services ship without authentication. Put them on a private network, and reach them through a VPN or an SSH tunnel.
The "exposure" column is a rule of thumb, not a verdict: public services are designed to face the internet, internal ones are not, and avoid marks protocols that send passwords in clear text and have an encrypted replacement.
They are separate number spaces for two transport protocols. TCP is connection-based and reliable, used for web, mail and databases; UDP is connectionless and used for DNS, VPNs, streaming and time sync. The same number can be in use on both.
TCP 443. HTTP/3 uses UDP 443 as well. Plain HTTP uses TCP 80, which normally just redirects to HTTPS.
From another machine, try nc -zv host port or telnet host port. On the server, ss -tlnp lists listening ports. An external port monitor tells you whether it is reachable from the internet.
It reduces noise from automated scans but is not a security measure — a port scan finds it in seconds. Key-based authentication and restricting access by source address are what actually protect SSH.
Upzilla's TCP and UDP monitors check any port on any host every minute and alert you when it stops responding. 10 monitors free.