| 7 | Echo Protocol | tcp, udp | Well-known |
| 19 | CharGEN (Character Generator Protocol) | udp, tcp | Well-known |
| 20 | FTP (File Transfer Protocol) data channel | tcp | Well-known |
| 21 | FTP (File Transfer Protocol) control channel | tcp | Well-known |
| 22 | SSH (Secure Shell) | tcp | Well-known |
| 23 | Telnet | tcp | Well-known |
| 25 | SMTP (Simple Mail Transfer Protocol) | tcp | Well-known |
| 49 | TACACS+ (Terminal Access Controller Access-Control System Plus) | tcp | Well-known |
| 53 | DNS (Domain Name System) | tcp, udp | Well-known |
| 67 | DHCP (Dynamic Host Configuration Protocol) server | udp | Well-known |
| 69 | TFTP (Trivial File Transfer Protocol) | udp | Well-known |
| 79 | Finger | tcp | Well-known |
| 80 | HTTP (Hypertext Transfer Protocol) | tcp | Well-known |
| 88 | Kerberos | tcp, udp | Well-known |
| 102 | S7comm (Siemens SIMATIC S7 PLC) | tcp | Well-known |
| 110 | POP3 (Post Office Protocol v3) | tcp | Well-known |
| 111 | RPCbind (portmapper) | tcp, udp | Well-known |
| 113 | Ident / Auth | tcp | Well-known |
| 119 | NNTP (Network News Transfer Protocol) | tcp | Well-known |
| 123 | NTP (Network Time Protocol) | udp | Well-known |
| 135 | MSRPC Endpoint Mapper | tcp | Well-known |
| 137 | NetBIOS Name Service (NBT-NS) | udp | Well-known |
| 139 | NetBIOS Session Service | tcp | Well-known |
| 143 | IMAP (Internet Message Access Protocol) | tcp | Well-known |
| 161 | SNMP (Simple Network Management Protocol) | udp | Well-known |
| 179 | BGP (Border Gateway Protocol) | tcp | Well-known |
| 194 | IRC (Internet Relay Chat) | tcp | Well-known |
| 389 | LDAP (Lightweight Directory Access Protocol) | tcp, udp | Well-known |
| 427 | SLP (Service Location Protocol) | udp, tcp | Well-known |
| 443 | HTTPS (HTTP over TLS) | tcp | Well-known |
| 445 | SMB / CIFS | tcp | Well-known |
| 465 | SMTPS (SMTP Submission over implicit TLS) | tcp | Well-known |
| 500 | IKE / ISAKMP (IPsec VPN key exchange) | udp | Well-known |
| 502 | Modbus TCP | tcp | Well-known |
| 512 | rexec (remote execution) | tcp | Well-known |
| 513 | rlogin (remote login) | tcp | Well-known |
| 514 | Syslog | udp | Well-known |
| 515 | LPD (Line Printer Daemon) | tcp | Well-known |
| 520 | RIP (Routing Information Protocol) | udp | Well-known |
| 547 | DHCPv6 (Dynamic Host Configuration Protocol for IPv6) server | udp | Well-known |
| 548 | AFP (Apple Filing Protocol) | tcp | Well-known |
| 554 | RTSP (Real Time Streaming Protocol) | tcp | Well-known |
| 563 | NNTPS (NNTP over TLS) | tcp | Well-known |
| 587 | SMTP Submission (STARTTLS) | tcp | Well-known |
| 593 | RPC over HTTP (MSRPC/EPMAP) | tcp | Well-known |
| 623 | IPMI / RMCP (BMC out-of-band management) | udp | Registered |
| 631 | IPP / CUPS (Internet Printing Protocol) | tcp, udp | Well-known |
| 636 | LDAPS (LDAP over TLS) | tcp | Well-known |
| 853 | DNS over TLS (DoT) | tcp | Well-known |
| 873 | rsync daemon | tcp | Well-known |
| 990 | FTPS (FTP over implicit TLS) | tcp | Well-known |
| 993 | IMAPS (IMAP over TLS) | tcp | Well-known |
| 995 | POP3S (POP3 over TLS) | tcp | Well-known |
| 1080 | SOCKS proxy | tcp | Registered |
| 1099 | Java RMI Registry | tcp | Registered |
| 1194 | OpenVPN | udp, tcp | Registered |
| 1433 | Microsoft SQL Server | tcp | Registered |
| 1434 | Microsoft SQL Server Resolution Service (SQL Server Browser) | udp | Registered |
| 1521 | Oracle Database TNS listener | tcp | Registered |
| 1524 | ingreslock (classic backdoor shell) | tcp | Registered |
| 1645 | RADIUS authentication (legacy) | udp | Registered |
| 1701 | L2TP (VPN) | udp | Registered |
| 1720 | H.323 (Q.931 call signaling) | tcp | Registered |
| 1723 | PPTP (Point-to-Point Tunneling Protocol) | tcp | Registered |
| 1812 | RADIUS authentication | udp | Registered |
| 1883 | MQTT | tcp | Registered |
| 1900 | SSDP / UPnP (Simple Service Discovery Protocol) | udp | Registered |
| 1911 | Tridium Niagara Fox | tcp | Registered |
| 2049 | NFS (Network File System) | tcp | Registered |
| 2082 | cPanel | tcp | Registered |
| 2087 | WHM (WebHost Manager, TLS) | tcp | Registered |
| 2123 | GTP-C (GPRS Tunnelling Protocol, control plane) | udp | Registered |
| 2181 | Apache ZooKeeper | tcp | Registered |
| 2375 | Docker Engine API (unencrypted) | tcp | Registered |
| 2376 | Docker Engine API (TLS) | tcp | Registered |
| 2379 | etcd Client API | tcp | Registered |
| 2404 | IEC 60870-5-104 (IEC-104) | tcp | Registered |
| 2525 | SMTP submission (alternate) | tcp | Registered |
| 3000 | Dev Server / Grafana | tcp | Registered |
| 3128 | Squid HTTP Proxy | tcp | Registered |
| 3260 | iSCSI target | tcp | Registered |
| 3268 | LDAP Global Catalog (Active Directory) | tcp | Registered |
| 3269 | LDAP Global Catalog over SSL/TLS (Secure Global Catalog) | tcp | Registered |
| 3306 | MySQL / MariaDB | tcp | Registered |
| 3389 | RDP (Remote Desktop Protocol) | tcp, udp | Well-known |
| 3478 | STUN / TURN (WebRTC NAT traversal) | udp, tcp | Registered |
| 3690 | Subversion (svnserve) | tcp | Registered |
| 3702 | WS-Discovery (Web Services Dynamic Discovery / WSD) | udp | Registered |
| 4222 | NATS messaging | tcp | Registered |
| 4369 | Erlang Port Mapper Daemon (epmd) | tcp | Registered |
| 4444 | Metasploit Meterpreter (default) / MSRPC Blaster | tcp | Registered |
| 4500 | IPsec NAT-T (IKE NAT traversal) | udp | Registered |
| 4505 | SaltStack Salt master (ZeroMQ) | tcp | Registered |
| 4840 | OPC UA | tcp | Registered |
| 4899 | Radmin (Remote Administrator) | tcp | Registered |
| 5000 | UPnP / common dev server (Flask, Docker registry) | tcp | Registered |
| 5004 | RTP (Real-time Transport Protocol) | udp | Registered |
| 5060 | SIP (Session Initiation Protocol) | tcp, udp | Registered |
| 5061 | SIP over TLS | tcp | Registered |
| 5353 | mDNS (Multicast DNS) | udp | Registered |
| 5355 | LLMNR (Link-Local Multicast Name Resolution) | udp | Registered |
| 5432 | PostgreSQL | tcp | Registered |
| 5555 | Android Debug Bridge (ADB) | tcp | Registered |
| 5601 | Kibana | tcp | Registered |
| 5631 | pcAnywhere (Symantec) | tcp | Registered |
| 5671 | AMQPS (AMQP over TLS) | tcp | Registered |
| 5672 | AMQP (RabbitMQ) | tcp | Registered |
| 5683 | CoAP (Constrained Application Protocol, IoT) | udp | Registered |
| 5684 | CoAPS (CoAP over DTLS) | udp | Registered |
| 5800 | VNC over HTTP (web client) | tcp | Registered |
| 5900 | VNC (Virtual Network Computing) | tcp | Registered |
| 5938 | TeamViewer | tcp | Registered |
| 5984 | Apache CouchDB | tcp | Registered |
| 5985 | WinRM (HTTP) | tcp | Registered |
| 5986 | WinRM over HTTPS | tcp | Registered |
| 6000 | X11 (X Window System) | tcp | Registered |
| 6379 | Redis | tcp | Registered |
| 6443 | Kubernetes API server | tcp | Registered |
| 6667 | IRC (Internet Relay Chat) | tcp | Registered |
| 6881 | BitTorrent (peer wire/DHT) | tcp, udp | Registered |
| 7000 | Apache Cassandra Inter-node | tcp | Registered |
| 7001 | Oracle WebLogic Server | tcp | Registered |
| 7474 | Neo4j HTTP / Browser | tcp | Registered |
| 7547 | TR-069 / CWMP (CPE WAN Management) | tcp | Registered |
| 7687 | Neo4j Bolt | tcp | Registered |
| 8000 | HTTP Alternate / Dev Server | tcp | Registered |
| 8006 | Proxmox VE Web UI | tcp | Registered |
| 8009 | AJP (Apache JServ Protocol, Tomcat) | tcp | Registered |
| 8080 | HTTP Alternate / Proxy | tcp | Registered |
| 8086 | InfluxDB HTTP API | tcp | Registered |
| 8089 | Splunk Management (splunkd) | tcp | Registered |
| 8140 | Puppet Server | tcp | Registered |
| 8161 | Apache ActiveMQ web console | tcp | Registered |
| 8388 | Shadowsocks proxy | tcp | Registered |
| 8443 | HTTPS Alternate (web admin / Tomcat SSL) | tcp | Registered |
| 8500 | HashiCorp Consul HTTP API | tcp | Registered |
| 8554 | RTSP (alternate streaming port) | tcp | Registered |
| 8883 | MQTT over TLS | tcp | Registered |
| 8888 | HTTP Alternate / Jupyter Notebook | tcp | Registered |
| 8983 | Apache Solr | tcp | Registered |
| 9000 | PHP-FPM / SonarQube / dev HTTP | tcp | Registered |
| 9042 | Apache Cassandra CQL | tcp | Registered |
| 9050 | Tor SOCKS proxy | tcp | Registered |
| 9090 | Prometheus / web admin | tcp | Registered |
| 9092 | Apache Kafka | tcp | Registered |
| 9100 | Printer JetDirect (raw print) / node_exporter | tcp | Registered |
| 9200 | Elasticsearch HTTP API | tcp | Registered |
| 9300 | Elasticsearch transport (node-to-node) | tcp | Registered |
| 9389 | ADWS (Active Directory Web Services) | tcp | Registered |
| 9418 | Git protocol (git daemon) | tcp | Registered |
| 10000 | Webmin | tcp | Registered |
| 10250 | Kubernetes kubelet API | tcp | Registered |
| 11211 | Memcached | tcp, udp | Registered |
| 12345 | NetBus (trojan/backdoor) | tcp | Registered |
| 16992 | Intel AMT / ME (out-of-band management) | tcp | Registered |
| 20000 | DNP3 | tcp | Registered |
| 25565 | Minecraft (Java Edition server) | tcp | Registered |
| 27015 | Source / Steam game server | udp, tcp | Registered |
| 27017 | MongoDB | tcp | Registered |
| 28017 | MongoDB HTTP Status (legacy) | tcp | Registered |
| 31337 | Back Orifice (trojan/backdoor) | udp | Registered |
| 32400 | Plex Media Server (HTTP API/web) | tcp | Registered |
| 32764 | Router backdoor (SerComm) | tcp | Registered |
| 44818 | EtherNet/IP (CIP) | tcp, udp | Registered |
| 47808 | BACnet | udp | Registered |
| 61613 | STOMP (ActiveMQ) | tcp | Dynamic / private |
| 61616 | ActiveMQ OpenWire | tcp | Dynamic / private |