TCP & UDP Port Number Directory & Security Guide

01.The Three Port Ranges Defined by IANA (RFC 6335)

In TCP/IP networking, transport layer endpoints are identified by 16-bit integer port numbers ranging from 0 to 65,535:

• Well-Known Ports (0 – 1023): Assigned to universal system services by the Internet Assigned Numbers Authority (IANA). On POSIX systems (Linux/BSD/macOS), binding to these ports requires root/superuser capabilities (or CAP_NET_BIND_SERVICE). Examples: 22 (SSH), 80 (HTTP), 443 (HTTPS).
• Registered Ports (1024 – 49151): Registered for vendor applications and database servers (e.g., 3306 for MySQL, 5432 for PostgreSQL, 6379 for Redis, 27017 for MongoDB).
• Dynamic / Ephemeral Ports (49152 – 65535): Allocated dynamically by operating systems for outbound client sockets when making connections.

02.Critical Ports You Must NEVER Expose to the Public Internet

Automated botnets continuously scan the entire IPv4 address space for vulnerable exposed ports. The following services should be strictly bound to 127.0.0.1 or protected within an isolated VPC:

• Port 445 (SMB): Vector for remote kernel exploits like WannaCry and NotPetya.
• Port 3389 (RDP): High target for brute-force credential stuffing and ransomware payload deployment.
• Port 6379 (Redis) & 11211 (Memcached): Frequently lack authentication by default, allowing attackers to write arbitrary files or execute amplified UDP DDoS attacks.
• Port 2375 (Docker Socket): Grants unauthenticated root level execution on host servers.

03.TCP vs. UDP: Key Behavioral Differences

Network protocols operate over either connection-oriented TCP or connectionless UDP:

• TCP (Transmission Control Protocol): Performs a 3-way handshake (SYN, SYN-ACK, ACK) ensuring delivery, ordering, and flow control. Ideal for HTTP, SSH, and databases.
• UDP (User Datagram Protocol): Fire-and-forget packets without handshake overhead. Ideal for low-latency voice (SIP), streaming, DNS queries, and modern HTTP/3 (QUIC). Because UDP source IPs can be easily spoofed, exposed UDP services are susceptible to reflection/amplification attacks.

04.Testing Open Ports from the Terminal

Verify listening ports on remote servers without installing heavy GUI scanners: