Windows port lookup
What a port number means on a Windows PC: which program or Windows service normally uses it, what it is for, and whether it is safe to block. Type a port number or a name to filter.
| Port | Protocol | What it is | On Windows | Risk if open to the internet |
|---|---|---|---|---|
| 21, 20 | TCP | FTP | Not part of Windows | High |
| 22 | TCP | SSH | sshd.exe (OpenSSH Server, an optional Windows feature) | High |
| 23 | TCP | Telnet | Not part of Windows | High |
| 25 | TCP | SMTP (server to server) | Not part of Windows | Medium |
| 53 | TCP/UDP | DNS | svchost.exe (DNS Client service, Dnscache) | Medium |
| 67, 68 | UDP | DHCP | svchost.exe (DHCP Client service) | Low |
| 80 | TCP | HTTP | System (PID 4) when a Windows service uses the HTTP Server API | Medium |
| 88 | TCP/UDP | Kerberos | lsass.exe (talking to a domain controller) | Medium |
| 110, 995 | TCP | POP3 (995: POP3 over TLS) | Not part of Windows | Low |
| 123 | UDP | NTP (time sync) | svchost.exe (Windows Time service, W32Time) | Low |
| 135 | TCP | RPC Endpoint Mapper | svchost.exe (RPC Endpoint Mapper, RpcEptMapper) | High |
| 137, 138 | UDP | NetBIOS name and datagram service | System (PID 4, NetBIOS over TCP/IP) | High |
| 139 | TCP | NetBIOS session (old SMB) | System (PID 4) | High |
| 143, 993 | TCP | IMAP (993: IMAP over TLS) | Not part of Windows | Low |
| 161, 162 | UDP | SNMP | Not part of Windows | High |
| 389, 636 | TCP/UDP | LDAP (636: LDAP over TLS) | lsass.exe and domain tools | High |
| 443 | TCP/UDP | HTTPS | Not part of Windows | Low |
| 445 | TCP | SMB (file and printer sharing) | System (PID 4, the Server service, LanmanServer) | High |
| 465 | TCP | SMTP over TLS (mail sending) | Not part of Windows | Low |
| 500, 4500 | UDP | IKE / IPsec (VPN) | svchost.exe (IKE and AuthIP IPsec Keying Modules, IKEEXT) | Medium |
| 554 | TCP/UDP | RTSP (video streams) | Not part of Windows | High |
| 587 | TCP | SMTP submission (mail sending) | Not part of Windows | Low |
| 853 | TCP | DNS over TLS | Not part of Windows | Low |
| 1080 | TCP | SOCKS proxy | Not part of Windows | High |
| 1194 | UDP | OpenVPN | Not part of Windows | Low |
| 1433, 1434 | TCP | Microsoft SQL Server | sqlservr.exe | High |
| 1688 | TCP | KMS activation | Not part of Windows | Medium |
| 1723, 1701 | TCP | PPTP VPN (1701: L2TP) | svchost.exe (Remote Access Connection Manager) | Medium |
| 1883, 8883 | TCP | MQTT (smart home) | Not part of Windows | High |
| 1900 | UDP | SSDP (UPnP discovery) | svchost.exe (SSDP Discovery service, SSDPSRV) | High |
| 2179 | TCP | Hyper-V VM Connect | vmms.exe (Hyper-V Virtual Machine Management) | Medium |
| 2869 | TCP | UPnP event notification | System (PID 4, via http.sys for SSDP and UPnP Device Host) | High |
| 3074 | TCP/UDP | Xbox network (games) | Not part of Windows | Low |
| 3306 | TCP | MySQL / MariaDB | mysqld.exe | High |
| 3389 | TCP/UDP | Remote Desktop (RDP) | svchost.exe (Remote Desktop Services, TermService) | High |
| 3478, 3479, 3480, 3481 | UDP | STUN / TURN (calls) | Not part of Windows | Low |
| 3702 | UDP | WS-Discovery | svchost.exe (Function Discovery, fdPHost and FDResPub) | High |
| 4444 | TCP | No standard use; often seen in attacks | Not part of Windows | High |
| 5040 | TCP | Connected Devices Platform | svchost.exe (Connected Devices Platform Service, CDPSvc) | Low |
| 5060, 5061 | TCP/UDP | SIP (internet phone calls) | Not part of Windows | High |
| 5222 | TCP | XMPP (chat) | Not part of Windows | Low |
| 5228, 5229, 5230 | TCP | Google push messaging | Not part of Windows | Low |
| 5353 | UDP | mDNS (local device discovery) | svchost.exe (DNS Client) and browsers | Medium |
| 5355 | UDP | LLMNR | svchost.exe (DNS Client, Dnscache) | Medium |
| 5357, 5358 | TCP | WSDAPI (network discovery) | System (PID 4, Web Services on Devices via http.sys) | High |
| 5900 | TCP | VNC (remote control) | Not part of Windows | High |
| 5938 | TCP/UDP | TeamViewer | TeamViewer_Service.exe | Medium |
| 5985, 5986 | TCP | WinRM (PowerShell remoting) | System (PID 4, Windows Remote Management via http.sys) | High |
| 6667 | TCP | IRC | Not part of Windows | Medium |
| 6881–6889 | TCP/UDP | BitTorrent | Not part of Windows | Medium |
| 7680 | TCP | Delivery Optimization | svchost.exe (Delivery Optimization, DoSvc) | Low |
| 8080 | TCP | HTTP (alternate) | Not part of Windows | Medium |
| 8530, 8531 | TCP | WSUS (company Windows Update) | svchost.exe (Windows Update) | Low |
| 9001 | TCP | Tor relay | Not part of Windows | Low |
| 9100 | TCP | Printing (RAW / JetDirect) | spoolsv.exe (Print Spooler) | High |
| 10243 | TCP | Windows Media Player network sharing | wmpnetwk.exe (Windows Media Player Network Sharing Service) | Medium |
| 27015–27050 | TCP/UDP | Steam and Source games | Not part of Windows | Low |
| 49152–65535 | TCP/UDP | Dynamic (temporary) port | Any program | Low |
| 51820 | UDP | WireGuard | Not part of Windows | Low |
Not in this list. Ports above 49151 are usually temporary ports Windows picks for a connection; see ports 49152–65535. To see which program owns a port on your PC, use the netstat explainer.
See which ports are open on your PC
Open PowerShell and run this. It lists every port something on your PC is listening on, with the program:
Get-NetTCPConnection -State Listen | Select-Object LocalAddress,LocalPort,@{n='Process';e={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}} | Sort-Object LocalPortAn address of 0.0.0.0 or :: means the port accepts connections from your network, subject to Windows Firewall. 127.0.0.1 or ::1 means only programs on this PC can reach it. For everything your PC is connected to, not just what it listens on, paste the output into the netstat explainer.