Well-known, registered, and dynamic ports explained

Every TCP or UDP connection is identified by a port number, and those numbers are not assigned at random. IANA, the Internet Assigned Numbers Authority, divides the port space into three ranges with different rules and expectations. Knowing where a number falls tells you a lot about the service behind it.

The 16-bit port space

A port number is a 16-bit unsigned integer, so the valid range runs from 0 to 65,535 — that is 2^16 values. A port alone does not identify a connection; the full identity is the four-tuple of source IP, source port, destination IP, and destination port, qualified by the transport protocol. Because TCP and UDP maintain separate spaces, port 53 over TCP and port 53 over UDP are different endpoints, which is exactly how DNS uses both.

Well-known ports (0-1023)

The first 1,024 ports are reserved for core, widely used services. On Unix-like systems, binding to one historically requires elevated privileges, which is a small security feature in itself. Almost every protocol you interact with daily lives here:

• port 22 — SSH
• port 25 — SMTP
• port 80 — HTTP
• port 110 — POP3
• port 143 — IMAP
• port 443 — HTTPS
• port 53 — DNS
• port 123 — NTP

You will also find infrastructure protocols here such as port 161 (SNMP), port 389 (LDAP), and port 636 (LDAPS).

Registered ports (1024-49151)

The registered range is assigned by IANA to specific applications and vendors, but ordinary, unprivileged users can bind to them. This is where most databases, message brokers, and application servers run:

• port 1433 — Microsoft SQL Server
• port 3306 — MySQL
• port 5432 — PostgreSQL
• port 6379 — Redis
• port 27017 — MongoDB
• port 5672 — AMQP (RabbitMQ)
• port 9092 — Apache Kafka
• port 8080 — HTTP alternate

Search and analytics stacks live here too, like port 9200 (Elasticsearch) and port 11211 (Memcached). An assignment in this range is a registration, not an exclusive lock — nothing physically stops a different program from grabbing the port if it is free.

Dynamic and private ports (49152-65535)

The top range is reserved for dynamic, private, or ephemeral use. IANA never assigns these to a named service. Instead the operating system hands them out temporarily, most often to the client side of a connection.

When your browser connects to a web server on port 443, your machine opens a source port from this dynamic range to receive the reply. That source port is the ephemeral port. It exists only for the life of the connection and is recycled afterward. This is why thousands of simultaneous outbound connections can share a single destination port — each one is distinguished by its unique ephemeral source port.

How ephemeral ports work in practice

The exact range an OS uses for ephemeral ports is configurable and sometimes wider than the strict IANA definition. On Linux you can inspect it:

cat /proc/sys/net/ipv4/ip_local_port_range

When that pool is exhausted — for example a busy proxy on port 3128 opening many backend connections — new outbound connections can fail until ports free up. Tuning the range and connection reuse is a common fix for high-throughput servers.

Why the distinction matters

The ranges are not just trivia. They shape real decisions:

• Firewalling. You typically allow specific well-known and registered destination ports inbound, while permitting the broad ephemeral range outbound for return traffic.
• Privilege. Running a service on a well-known port like port 631 (IPP) may require root, which influences how you package and deploy it.
• Conflict avoidance. Picking a registered port like port 5601 (Kibana) for your own app reduces the chance of clashing with system services.

Conclusion

The three IANA ranges — well-known, registered, and dynamic — turn a flat 16-bit number into a meaningful map of network services. Well-known ports anchor the core protocols, registered ports host applications, and the dynamic range keeps client connections flowing. To see the service behind any number, browse all ports on PortsDB.