Windows Ports#
Historical Windows services and ports across versions. The operator uses this when fingerprinting a host, mapping discovery results to the service that owns a port, or planning lateral movement against known Windows infrastructure.
Dynamic#
Default dynamic port ranges.
Windows Vista and later, 49152 to 65535.
Windows 2000, XP, Server 2003, 1025 to 5000.
Services on ports#
Port |
TCP/UDP |
App / Protocol |
System Service |
|---|---|---|---|
7 |
TCP / UDP |
Echo |
Simple TCP/IP Services |
9 |
TCP / UDP |
Discard |
Simple TCP/IP Services |
13 |
TCP / UDP |
Daytime |
Simple TCP/IP Services |
17 |
TCP / UDP |
Quotd |
Simple TCP/IP Services |
19 |
TCP / UDP |
Chargen |
Simple TCP/IP Services |
20 |
TCP |
FTP default data |
FTP Publishing Service |
21 |
TCP |
FTP control |
FTP Publishing Service, Application Layer Gateway |
23 |
TCP |
Telnet |
Telnet |
25 |
TCP |
SMTP |
SMTP, Exchange Server |
42 |
TCP / UDP |
WINS Replication |
Windows Internet Name Service |
53 |
TCP / UDP |
DNS |
DNS Server |
67 |
UDP |
DHCP Server |
DHCP Server |
69 |
UDP |
TFTP |
Trivial FTP Daemon Service |
80 |
TCP |
HTTP |
WinRM 1.1 and earlier, World Wide Web Publishing Service, SharePoint, Windows Media Services |
88 |
TCP / UDP |
Kerberos |
Kerberos Key Distribution Center |
102 |
TCP |
X.400 |
Microsoft Exchange MTA Stacks |
110 |
TCP |
POP3 |
Microsoft POP3, Exchange Server |
119 |
TCP |
NNTP |
Network News Transfer Protocol |
123 |
UDP |
NTP / SNTP |
Windows Time |
135 |
TCP |
RPC |
Message Queuing, RPC endpoint mapper, Exchange Server, Cluster Service, DFS, Fax Service, File Replication, Group Policy, LSA, Remote Storage, SMS 2.0, Terminal Services, Certificate Services |
137 |
UDP |
NetBIOS Name Resolution |
Computer Browser, Server, WINS, Net Logon, SMS 2.0 |
138 |
UDP |
NetBIOS Datagram Service |
Computer Browser, Server, Net Logon, DFS, SMS 2.0, License Logging Service |
139 |
TCP |
NetBIOS Session Service |
Computer Browser, Fax Service, Performance Logs and Alerts, Print Spooler, Server, Net Logon, RPC Locator, DFS, SMS 2.0, License Logging Service |
143 |
TCP |
IMAP |
Exchange Server |
161 |
UDP |
SNMP |
SNMP Service |
162 |
UDP |
SNMP Traps Outgoing |
SNMP Trap Service |
389 |
TCP / UDP |
LDAP / DC Locator |
Local Security Authority, DFS Namespaces and Replication, Netlogon, Kerberos KDC |
443 |
TCP |
HTTPS / RPC over HTTPS |
WinRM 1.1 and earlier, Exchange 2003, WWW, SharePoint |
445 |
TCP |
SMB |
Fax Service, Print Spooler, Server, RPC Locator, DFS, License Logging, Net Logon |
464 |
TCP / UDP |
Kerberos Password V5 |
Kerberos Key Distribution Center |
500 |
UDP |
IPsec ISAKMP |
Local Security Authority |
515 |
TCP |
LPD |
TCP/IP Print Server |
554 |
TCP |
RTSP |
Windows Media Services |
563 |
TCP |
NNTP over SSL |
Network News Transfer Protocol |
593 |
TCP |
RPC over HTTPS endpoint mapper |
Remote Procedure Call, Exchange Server |
636 |
TCP / UDP |
LDAP SSL |
Local Security Authority |
647 |
TCP |
DHCP Failover |
DHCP Failover |
993 |
TCP |
IMAP over SSL |
Exchange Server |
995 |
TCP |
POP3 over SSL |
Exchange Server |
1067 / 1068 |
TCP |
Installation Bootstrap Service |
Installation Bootstrap protocol server / client |
1270 |
TCP |
MOM-Encrypted |
Microsoft Operations Manager 2000 |
1433 |
TCP |
SQL over TCP |
Microsoft SQL Server, MSSQL$UDDI |
1434 |
UDP |
SQL Probe |
Microsoft SQL Server, MSSQL$UDDI |
1645 / 1812 |
UDP |
Legacy / RADIUS Authentication |
Internet Authentication Service |
1646 / 1813 |
UDP |
Legacy / RADIUS Accounting |
Internet Authentication Service |
1701 |
UDP |
L2TP |
Routing and Remote Access |
1723 |
TCP |
PPTP |
Routing and Remote Access |
1755 |
TCP / UDP |
MMS |
Windows Media Services |
1801 |
TCP / UDP |
MSMQ |
Message Queuing |
1900 |
UDP |
SSDP |
SSDP Discovery Service |
2101 / 2103 / 2105 / 2107 |
TCP |
MSMQ-DCs / RPC / Mgmt |
Message Queuing |
2393 / 2394 |
TCP |
OLAP Services 7.0 |
SQL Server, Downlevel OLAP Client Support |
2460 |
UDP |
MS Theater |
Windows Media Services |
2535 |
UDP |
MADCAP |
DHCP Server |
2701 / 2702 / 2703 / 2704 |
TCP / UDP |
SMS Remote Control / Chat / File Transfer |
SMS Remote Control Agent |
2725 |
TCP |
SQL Analysis Services |
SQL Server Analysis Services |
2869 |
TCP |
UPNP / SSDP event notification |
UPnP Device Host, SSDP Discovery Service |
3268 / 3269 |
TCP |
Global Catalog |
Local Security Authority |
3343 |
UDP |
Cluster Services |
Cluster Service |
3389 |
TCP |
Terminal Services |
NetMeeting Remote Desktop Sharing, Terminal Services |
3527 |
UDP |
MSMQ-Ping |
Message Queuing |
4011 |
UDP |
BINL |
Remote Installation |
4500 |
UDP |
NAT-T |
Local Security Authority |
5000 |
TCP |
SSDP legacy event notification |
SSDP Discovery Service |
5004 / 5005 |
UDP |
RTP / RTCP |
Windows Media Services |
5722 |
TCP |
RPC |
Distributed File System Replication |
5985 |
TCP |
HTTP |
WinRM 2.0 |
5986 |
TCP |
HTTPS |
WinRM 2.0 |
6001 / 6002 / 6004 |
TCP |
Information Store / Directory Referral / DSProxy / NSPI |
Exchange Server 2003 |
42424 |
TCP |
ASP.Net Session State |
ASP.NET State Service |
51515 |
TCP |
MOM-Clear |
Microsoft Operations Manager 2000 |
1024-65535 |
TCP |
RPC |
Randomly allocated high TCP ports |
49152-65535 |
TCP |
Random allocated high TCP |
Hyper-V service |
6600 |
TCP |
Live Migration |
Hyper-V Live Migration |