A comprehensive list of TCP/IP ports (TCP and UDP), including both legitimate and illegitimate (hacker/cracker) ports.

1. Author:
Razorpoint Security Team
Version:
1.6
Date of current version:
2006-05/22
Date of original version:
2001-04/10
Copyright © 2001-2006 Razorpoint Security Technologies, Inc.
All Rights Reserved.
TCP/IP Ports List
™
[ WHITE PAPER ]

2. Table of Contents.
TCP/IP Ports List .......................................................................................................................................... 1
Valid Ports ..................................................................................................................................................... 2
Trojan / Backdoor Ports ................................................................................................................................... 24
™
May 22, 2006 TCP/IP Ports List [v1.6]
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

3. TCP/IP Ports List
TCP/IP (Transmission Control Protocol / Internet Protocol) is the primary packet type on the Internet. It uses an assigned list
of ports (numbered services used to accept connections) for valid Internet services. This TCP/IP ports list covers both TCP and
UDP (Universal Datagram Packet) port assignments used by authorized services like email (SMTP), news (NNTP), and the World
Wide Web (HTTP), in addition to illegitimate hacker/cracker backdoor, or trojan, ports.
Authorized (legitimate) port numbers are divided into three ranges: the Well Known Ports, the Registered Ports, and the Dynamic
and/or Private Ports. Well Known Ports are those from 0 through 1023, Registered Ports are those from 1024 through 49151,
and the Dynamic and/or Private Ports are those from 49152 through 65535. The Well Known Ports are assigned by the IANA
(Internet Assigned Numbers Authority) and on most systems can only be used by system (root level) processes or by programs
executed by privileged users. Ports for the TCP are defined in RFC 793, and ports for the UDP are defined in RFC 768. Where
ever possible, port assignments are the same for TCP and UDP packet types.
Razorpoint Security Technologies, Inc. continues to update this list on a regular basis and attempts to keep it as one of the
most comprehensive TCP/IP ports list available. This list contains TCP/IP ports used by most operating systems and network
technologies, including: Sun Solaris, Linux, BSD Unix (MacOS X, OpenBSD, FreeBSD, NetBSD, etc.), Windows, Cisco, Nortel and
3Com.
For more information, please contact Razorpoint Security Technologies, Inc. at (www.razorpointsecurity.com).
™
May 22, 2006 TCP/IP Ports List [v1.6] Page 1 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

4. Valid TCP/IP Ports
Service Name TCP Port UDP Port Description
<reserved> 0 0 Reserved
tcpmux 1 1 TCP Port Service Multiplexer (RFC-1078)
compressnet 2 2 Management Utility
compressnet 3 3 Compression Process
<unassigned> 4 4 Unassigned
rje 5 5 Remote Job Entry
<unassigned> 6 6 Unassigned
echo 7 7
discard 9 9 sink null
<unassigned> 10 10 Unassigned
systat 11 11 Active Users
<unassigned> 12 12 Unassigned
daytime 13 13 Daytime (RFC 867)
<unassigned> 14 14 Unassigned
<unassigned> 15 15 Unassigned <formerly netstat>
<unassigned> 16 16 Unassigned
qotd 17 17 Quote of the Day
msp 18 18 Message Send Protocol
chargen 19 19 Character Generator
FTP-data 20 20 File Transfer [Default Data]
FTP 21 21 File Transfer [Control]
SSH 22 22 Secure Shell (ssh / scp)
Telnet 23 23
priv-mail 24 24 Any private mail system
SMTP 25 25 Simple Mail Transfer Protocol
<unassigned> 26 26 Unassigned
nsw-fe 27 27 NSW User System FE
msg-icp 29 29 MSG ICP
msg-auth 31 31 MSG Authentication
<unassigned> 32 32 Unassigned
dsp 33 33 Display Support Protocol
<unassigned> 34 34 Unassigned
priv-print 35 35 any private printer server
time 37 37 timserver
rap 38 38 Route Access Protocol
rlp 39 39 Resource Location Protocol
<unassigned> 40 40 Unassigned
graphics 41 41 Graphics
nameserver 42 42 Host Name Server
nicname 43 43 Who Is
mpm-flags 44 44 MPM FLAGS Protocol
mpm 45 45 Msg Processing Module [recv]
mpm-snd 46 46 MPM [default send]
ni-ftp 47 47 NI FTP
auditd 48 48 Digital Audit Daemon
tacacs 49 49 Login Host Protocol (TACACS)
re-mail-ck 50 50 Remote Mail Checking Protocol
la-maint 51 51 IMP Logical Address Maintenance
xns-time 52 52 XNS Time Protocol
domain 53 53 Domain Name Server
xns-ch 54 54 XNS Clearinghouse
isi-gl 55 55 ISI Graphics Language
xns-auth 56 56 XNS Authentication
MTP 57 57 Any private terminal access
xns-mail 58 58 XNS Mail
priv-file 59 59 any private file service
<unassigned> 60 60 Unassigned
ni-mail 61 61 NI MAIL
acas 62 62 ACA Services
May 22, 2006 TCP/IP Ports List [v1.6] Page 2 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

5. whois 63 63 Whois++
VIA Systems - FTP
covia 64 64 Communications Integrator (CI)
tacacs-ds 65 65 TACACS-Database Service
sql*net 66 66 Oracle SQL*NET
bootps 67 Bootstrap Protocol Server
bootpc 68 Bootstrap Protocol Client
tftp 69 Trivial File Transfer
gopher 70 70
netrjs-1 71 71 Remote Job Service
netrjs-2 72 72 Remote Job Service
netrjs-3 73 73 Remote Job Service
netrjs-4 74 74 Remote Job Service
priv-dial 75 75 Any private dial out service
deos 76 76 Distributed External Object Store
priv-rje 77 77 any private RJE service, netjrs
vettcp 78
finger 79
http 80 World Wide Web HTTP
hosts2-ns 81 81 HOSTS2 Name Server
xfer 82 82 XFER Utility
mit-ml-dev 83 83 MIT ML Device
ctf 84 84 Common Trace Facility
mit-ml-dev 85 85 MIT ML Device
mfcobol 86 86 Micro Focus Cobol
priv-term-l 87 any private terminal link, ttylink
kerberos-sec 88 88 Kerberos (v5)
su-mit-tg 89 89 SU/MIT Telnet Gateway
dnsix 90 90 DNSIX Securit Attribute Token Map
mit-dov 91 91 MIT Dover Spooler
npp 92 Network Printing Protocol
dcp 93 Device Control Protocol
objcall 94 Tivoli Object Dispatcher
supdup 95 BSD supdupd
dixie 96 96 DIXIE Protocol Specification
swift-rvf 97 Swift Remote Virtural File Protocol
linuxconf 98 linuxconf
98 TAC News
metagram 99 Metagram Relay
irc 100 Internet Relay Chat
hostname 101 hostnames NIC Host Name Server
Internet Relay Chat
iso-tsap 102 tsap ISO-TSAP Class 0
gppitnp 103 Genesis Point-to-Point Trans Net, or x400 ISO
Email
acr-nema 104 ACR-NEMA Digital Imag. & Comm. 300
csnet-ns 105 Mailbox Name Nameserver
pop3pw 106 Eudora compatible PW changer
106 3Com TSMux
rtelnet 107 Remote Telnet
snagas 108 SNA Gateway Access Server
pop-2 109 PostOffice V.2
pop-3 110 PostOffice V.3
Internet Relay Chat (Fserve)
sunrpc 111 portmapper, rpcbind
Internet Relay Chat (Fserve)
mcidas 112 McIDAS Data Transmission Protocol
auth 113 ident, tap, Authentication Service
Internet Relay Chat (DCC)
irc 113 Internet Relay Chat (Ident)
audionews 114 Audio News Multicast
sftp 115 Secure File Transfer Protocol
ansanotify 116 ANSA REX Notify
uucp-path 117 UUCP Path Service
May 22, 2006 TCP/IP Ports List [v1.6] Page 3 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

6. sqlserv 118 SQL Services
nntp 119 Network News Transfer Protocol
irc 120 Internet Relay Chat (Send)
erpc 121 Encore Expedited Remote Pro.Call
Internet Relay Chat (Send)
smakynet 122
ntp 123 123 Network Time Protocol
ansatrader 124 ANSA REX Trader
ansatrader 124 ANSA REX Trader
locus-map 125 Locus PC-Interface Net Map Ser
locus-map 125 Locus PC-Interface Net Map Ser
unitary 126 Unisys Unitary Login
locus-con 127 Locus PC-Interface Conn Server
gss-xlicen 128 GSS X License Verification
pwdgen 129 Password Generator Protocol
cisco-fna 130 cisco FNATIVE
Internet Relay Chat (Get)
cisco-tna 131 cisco TNATIVE
Internet Relay Chat (Get)
cisco-sys 132 cisco SYSMAINT
Internet Relay Chat (Get)
statsrv 133 Statistics Service
ingres-net 134 INGRES-NET Service
loc-srv 135 NCS local location broker
profile 136 PROFILE Naming System
netbios-ns 137 137 NETBIOS Name Service
netbios-dgm 138 138 NETBIOS Datagram Service
netbios-ssn 139 139 NETBIOS Session Service
emfis-data 140 EMFIS Data Service
emfis-cntl 141 EMFIS Control Service
bl-idm 142 Britton-Lee IDM
imap2 143 Inernet Mail Access Protocol v2
news 144 NewS window system
uaac 145 UAAC Protocol
iso-tp0 146
iso-ip 147
cronus 148 CRONUS-SUPPORT
aed-512 149 AED 512 Emulation Service
sql-net 150
hems 151
bftp 152 Background File Transfer Program
sgmp 153
netsc-prod 154
netsc-dev 155
sqlsrv 156 SQL Service
knet-cmp 157 KNET/VM Command/Message Protocol
pcmail-srv 158 PCMail Server
nss-routing 159
sgmp-traps 160
snmp 161 Simple Network Management Protocol
snmptrap 162 snmp-trap
cmip-man 163 CMIP Manager
smip-agent 164 CMIP Agent
xns-courier 165 Xerox
s-net 166 Sirius Systems
namp 167
namp 167
rsvd 168
rsvd 168
send 169
print-srv 170 Network PostScript
multiplex 171 Network Innovations Multiplex
cl-1 172 Network Innovations CL/1
xyplex-mux 173
mailq 174
May 22, 2006 TCP/IP Ports List [v1.6] Page 4 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

7. vmnet 175
genrad-mux 176
xdmcp 177 X Display Manager Control Protocol
nextstep 178 NextStep Window Server
bgp 179 Border Gateway Protocol
ris 180 Intergraph
unify 181
audit 182 Unisys Audit SITP
ocbinder 183
ocserver 184
remote-kis 185
kis 186 KIS Protocol
aci 187 Application Communication Interface
mumps 188 Plus Fives MUMPS
qft 189 Queued File Transport
gacp 190 Gateway Access Control Protocol
prospero 191 Prospero Directory Service
osu-nms 192 OSU Network Monitoring System
srmp 193 Spider Remote Monitoring Protocol
irc 194 Internet Relay Chat
dn6-nlm-aud 195 DNSIX Network Level Module Audit
dn6-smm-red 196 DNSIX Session Mgt Module Audit Redir
dls 197 Directory Location Service
dls-mon 198 Directory Location Service Monitor
smux 199 SNMP Unix Multiplexer
src 200 IBM System Resource Controller
at-rtmp 201 AppleTalk Routing Maintenance
at-nbp 202 AppleTalk Name Binding
at-3 203 AppleTalk Unused
at-echo 204 AppleTalk Echo
at-5 205 AppleTalk Unused
at-zis 206 AppleTalk Zone Information
at-7 207 AppleTalk Unused
at-8 208 AppleTalk Unused
tam 209 Trivial Authenticated Mail Protocol
z39.50 210 wais, ANSI Z39.50
914c-g 211 Texas Instruments 914C/G Terminal
anet 212 ATEXSSTR
ipx 213
vmpwscs 214
softpc 215 Insignia Solutions
atls 216 Access Technology License Server
dbase 217 dBASE Unix
mpp 218 Netix Message Posting Protocol
uarps 219 Unisys ARPs
imap3 220 Interactive Mail Access Protocol v3
fln-spx 221 Berkeley rlogind with SPX auth
rsh-spx 222 Berkeley rshd with SPX auth
cdc 223 Certificate Distribution Center
masqdialer 224 224 Masqdialer
direct 242
sur-meas 243 Survey Measurement
dayna 244
link 245
dsp3270 246 Display Systems Protocol
subntbcst_tftp 247
bhfhs 248
rap 256
set 257 secure electronic transaction
yak-chat 258 yak winsock personal chat
fw1-vpn 259 Check Point FireWall-1/VPN-1 Secure Port
openport 260
nsiiops 261 iiop name service over tls/ssl
arcisdms 262
May 22, 2006 TCP/IP Ports List [v1.6] Page 5 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

8. hdap 263
bgmp 264
x-bone-ctl 265 265 X-Bone CTL
mom 270 http://www.Microsoft.com/mom/
http-mgmt 280 280
personal-link 281
cableport-ax 282 cable port a/x
fxp 286 286 FXP Communication
novastorbakcup 308 novastor backup
entrusttime 309
bhmds 310
bhmds 310
asip-webadmin 311 appleshare ip webadmin
vslmp 312
magenta-logic 313
opalis-robot 314
dpsi 315
decauth 316
zannet 317
pkix-timestamp 318 318 PKIX Timestamp
pip 321
rtsps 322 322 RTSPS
pdap 344 Prospero Data Access Protocol
pawserv 345 Perf Analysis Workbench
zserv 346 Zebra server
fatserv 347 Fatmen Server
csi-sgwp 348 Cabletron Management Protocol
mftp 349
matip-type-a 350 MATIP Type A
matip-type-b 351 MATIP Type B or bhoetty
dtag-ste-sb 352 DTAG, or bhoedap4
ndsauth 353
bh611 354
datex-asn 355
cloanto-net-1 356 Cloanto Net 1
bhevent 357
shrinkwrap 358
tenebris_nts 359 Tenebris Network Trace Service
scoi2odialog 360
semantix 361
srssend 362 SRS Send
rsvp_tunnel 363
aurora-cmgr 364
dtk 365 Deception Tool Kit (lame -- see www.all.net)
odmr 366
mortgageware 367
qbikgdp 368
rpc2portmap 369
codaauth2 370
clearcase 371
ulistserv 372 Unix Listserv
legent-1 373 Legent Corporation (Computer Associates)
legent-1 373 Legent Corporation (Computer Associates)
legent-2 374 Legent Corporation (Computer Associates)
hassle 375
nip 376 Amiga Envoy Network Inquiry Proto
tnETOS 377 NEC Corporation
dsETOS 378 NEC Corporation
is99c 379 TIA/EIA/IS-99 modem client
is99s 380 TIA/EIA/IS-99 modem server
hp-collector 381 hp performance data collector
hp-managed-node 382 hp performance data managed node
hp-alarm-mgr 383 hp performance data alarm manager
arns 384 A Remote Network Server System
ibm-app 385 IBM Application
May 22, 2006 TCP/IP Ports List [v1.6] Page 6 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

9. asa 386 ASA Message Router Object Def.
aurp 387 Appletalk Update-Based Routing Pro.
unidata-ldm 388 Unidata LDM Version 4
ldap 389 Lightweight Directory Access Protocol
uis 390
synotics-relay 391 SynOptics SNMP Relay Port
synotics-broker 392 SynOptics Port Broker Port
dis 393 Data Interpretation System
embl-ndt 394 EMBL Nucleic Data Transfer
netcp 395 NETscout Control Protocol
netware-ip 396 Novell Netware over IP
mptn 397 Multi Protocol Trans. Net.
kryptolan 398
iso-tsap-c2 399 ISO-TSAP Class 2
work-sol 400 Workstation Solutions
ups 401 Uninterruptible Power Supply
genie 402 Genie Protocol
decap 403
nced 404
ncld 405
imsp 406 Interactive Mail Support Protocol
timbuktu 407
prm-sm 408 Prospero Resource Manager Sys. Man.
prm-nm 409 Prospero Resource Manager Node Man.
decladebug 410 DECLadebug Remote Debug Protocol
rmt 411 Remote MT Protocol
synoptics-trap 412 Trap Convention Port
smsp 413
infoseek 414
bnet 415
silverplatter 416
onmux 417
hyper-g 418
ariel1 419
smpte 420
ariel2 421
ariel3 422
opc-job-start 423 IBM Operations Planning and Control Start
opc-job-track 424 IBM Operations Planning and Control Track
icad-el 425
smartsdp 426
svrloc 427 Server Location
ocs_cmu 428
ocs_amu 429
utmpsd 430
utmpcd 431
iasd 432
nnsp 433 Usenet, Network News Transfer
mobileip-agent 434
mobilip-mn 435
dna-cml 436
comscm 437
dsfgw 438
dasp 439
sgcp 440
decvms-sysmgt 441
cvc_hostd 442
https 443 secure http (SSL)
snpp 444 Simple Network Paging Protocol
microsoft-ds 445
ddm-rdb 446
ddm-dfm 447
ddm-ssl 448 ddm-byte
as-servermap 449 AS Server Mapper
May 22, 2006 TCP/IP Ports List [v1.6] Page 7 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

10. tserver 450
sfs-smp-net 451 Cray Network Semaphore server
sfs-config 452 Cray SFS config server
creativeserver 453
contentserver 454
creativepartnr 455
macon-tcp 456
scohelp 457
appleqtc 458 apple quick time
ampr-rcmd 459
skronk 460
datasurfsrv 461
datasurfsrvsec 462
alpes 463
kpasswd5 464 Kerberos (v5)
smtps 465 smtp protocol over TLS/SSL (was ssmtp)
digital-vrc 466
mylex-mapd 467
photuris 468 Photuris Key Management
rcp 469 Radio Control Protocol
scx-proxy 470
mondex 471
ljk-login 472
hybrid-pop 473
tn-tl-w1 474
tcpnethaspsrv 475
tn-tl-fd1 476
ss7ns 477
spsc 478
iafserver 479
loadsrv 480
iafdbase 480
dvs 481
ph 481
bgs-nsi 482
xlog 482
ulpnet 483
integra-sme 484 Integra Software Management Environment
powerburst 485 Air Soft Power Burst
sstats 486
avian 486
saft 487 saft Simple Asynchronous File Transfer
gss-http 488
nest-protocol 489
micom-pfs 490
go-login 491
ticf-1 492 Transport Independent Convergence for FNA
ticf-2 493 Transport Independent Convergence for FNA
pov-ray 494
intecourier 495
pim-rp-disc 496
Dantz Retrospect 497 MacOS Backup Software System
siam 498
iso-ill 499 ISO ILL Protocol
isakmp 500 ISA/KMP Encryption Key Exchange
500 Baynetworks VPN
stmf 501
asa-appl-proto 502
intrinsa 503
citadel 504
mailbox-lm 505
ohimsrv 506
crs 507
xvttp 508
snare 509
May 22, 2006 TCP/IP Ports List [v1.6] Page 8 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

11. fcp 510 FirstClass Server
passgo 511
exec 512 BSD rexecd
biff 512 comsat
login 513 BSD rlogind
who 513 BSD rwhod
shell 514 BSD rshd
syslog 514 BSD syslogd
printer 515 spooler (lpr/lpd)
videotex 516
talk 517 BSD talkd
ntalk 518 (talkd)
utime 519 unixtime
route 520 router routed (RIP), or extended file name server
ripng 521
ulp 522
ibm-db2 523
ncp 524
timed 525 timeserver
tempo 526 newdate
stx 527 Stock IXChange
custix 528 Customer IXChange
irc-serv 529
courier 530 rpc
conference 531 chat
netnews 532 readnews
netwall 533 for emergency broadcasts
mm-admin 534 MegaMedia Admin
iiop 535
opalis-rdv 536
nmsp 537 Networked Media Streaming Protocol
gdomap 538
apertus-ldp 539 Apertus Technologies Load Determination
uucp 540 uucpd
uucp-rlogin 541
commerce 542
klogin 543 Kerberos (v4/v5)
AppleShare over IP
kshell 544 krcmd Kerberos (v4/v5)
ekshell 545 Kerberos encrypted remote shell -kfall
dhcpv6-client 546 DHCPv6 Client
dhcpv6-server 547 DHCPv6 Server
afpovertcp 548 AFP (AppleShare) over TCP, also iDisk
idfp 549
new-rwho 550 new-who
cybercash 551
deviceshare 552
pirp 553
rtsp 554 Real Time Streaming Protocol
dsf 555
remotefs 556 rfs, rfs_server, Brunhoff remote filesystem
openvms-sysipc 557
sdnskmp 558
teedtap 559
rmonitor 560 rmonitord
monitor 561
chshell 562 chcmd
snews 563 NNTP over SSL
9pfs 564 Plan 9 file service
whoami 565
streettalk 566
banyan-rpc 567
ms-shuttle 568 Microsoft shuttle
ms-rome 569 Microsoft rome
meter 570 demon
May 22, 2006 TCP/IP Ports List [v1.6] Page 9 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

12. umeter 571 udemon
sonar 572
banyan-vip 573
ftp-agent 574 FTP Software Agent System
vemmi 575
ipcd 576
vnas 577
ipdd 578
decbsrv 579
sntp-heartbeat 580
bdp 581 Bundle Discovery Protocol
scc-security 582
philips-vc 583 Philips Video-Conferencing
keyserver 584
imap4-ssl 585 IMAP4+SSL (use port 993 instead)
password-chg 586
submission 587
cal 588
eyelink 589
tns-cml 590
http-alt 591 FileMaker Pro - HTTP Alternate
eudora-set 592 Eudora Settings Server
http-rpc-epmap 593 HTTP RPC Ep Map
tpip 594
cab-protocol 595
smsd 596
ptcnameservice 597 PTC Name Service
sco-websrvrmg3 598 SCO Web Server Manager 3
acp 599 Aeolon Core Protocol
ipcserver 600 Sun IPC server
syslog-conn 601 601 Reliable Syslog Service
xmlrpc-beep 602 602 XML-RPC over BEEP
idxp 603 603 IDXP
tunnel 604 604 TUNNEL
soap-beep 605 605 SOAP over BEEP
urm 606 Cray Unified Resource Manager
nqs 607
sift-uft 608 Sender-Initiated/Unsolicited File Transfer
npmp-trap 609
npmp-local 610
npmp-gui 611
sshell 614 614 SSLshell
sco-inetmgr 615 615 Internet Configuration Manager
sco-sysmgr 616 616 SCO System Administration Server
sco-dtmgr 617 617 SCO Desktop Administration Server
nlservd 617 http://www.arkeia.com
cryptoadmin 624 624 Crypto Admin
IMAP Admin 626
qmqp 628 Qmail Quick Mail Queueing
cups 631 Common UNIX Printing System
ginad 634
mount 635 NFS Mount Service
ldapssl 636 LDAP over SSL
pcnfs 640 PC-NFS DOS Authentication
sanity 643 643 SANity
ldp 646 646 LDP
dhcp-failover 647 647 DHCP Failover
rrp 648 NSI Registry Registrar Protocol
bwnfs 650 BW-NFS DOS Authentication
AppleShare IP Admin 660 AppleShare Web & File Services
pftp 662 662 PFTP
purenoise 663 663 PureNoise
doom 666 Doom(Id Software)
vpp 677 677 Virtual Presence Protocol
MacOS Users & Groups 687
May 22, 2006 TCP/IP Ports List [v1.6] Page 10 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

13. nmap 689 689 NMAP
resvc 691 Microsoft Exchange 2000 Server Routing
ha-cluster 694 694 ha-cluster
BuddyPhone 700 BuddyPhone Communication (No FTP)
BuddyPhone 701 BuddyPhone Communication (No FTP)
elcsd 704 errlog copy/server daemon
entrustmanager 709 EntrustMgr - NorTel DES auth network
cisco-tdp 711 711 Cisco TDP
netviewdm1 729 IBM NetView DM/6000 Server/Client
netviewdm2 730 IBM NetView DM/6000 send
netviewdm3 731 IBM NetView DM/6000 receive
sometimes-rpc2 737 Rusersd(OpenBSD)
netcp 740 NETscout Control Protocol
netgw 741
netrcs 742 Network based Rev. Cont. Sys.
flexlm 744 Flexible License Manager
fujitsu-dev 747 Fujitsu Device Control
ris-cm 748 Russell Info Sci Calendar Manager
kerberos-adm 749 Kerberos 5 admin/changepw
kerberos 750 kdc Kerberos (v4)
kerberos_master 751 Kerberos `kadmin (v4)
qrh 752
rrh 753
krb_prop 754 kerberos/v5 server propagation
nlogin 758
nlogin 758
con 759
krbupdate 760 kreg Kerberos (v4) registration
kpasswd 761 kpwd Kerberos (v4) “passwd”
quotad 762
cycleserv 763
omserv 764
webster 765
phonebook 767 phone
vid 769
cadlock 770
rtip 771
cycleserv2 772
submit 773
rpasswd 774
acmaint_dbd 774
entomb 775
acmaint_transd 775
wpages 776
wpages 776
multiling-http 777 777 Multiling HTTP
wpgs 780
wpgs 780
hp-collector 781 hp performance data collector
hp-managed-node 782 hp performance data managed node
hp-alarm-mgr 783 hp performance data alarm manager
concert 786
controlit 799
mdbs_daemon 800
device 801
iscsi 860 860 iSCSI
supfilesrv 871 SUP server
rsync 873 Rsync server ( http://rsync.samba.org )
accessbuilder 888 Accessbuilder, or Audio CD Database
samba-swat 901 Samba SWAT tool.Also used by ISS RealSecure.
oftep-rpc 950 Often RPC.statd (on Redhat Linux)
rndc 953 RNDC is used by BIND 9 (& probably other NS)
ftps-data 989 FTP protocol (data) over TLS/SSL
ftps 990 FTP protocol (control) over TLS/SSL
telnets 992 Telnet protocol over TLS/SSL
May 22, 2006 TCP/IP Ports List [v1.6] Page 11 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

14. imaps 993 IMAP4 protocol over TLS/SSL
ircs 994 IRC protocol over TLS/SSL
pop3s 995 POP3 protocol over TLS/SSL
xtreelic 996 XTREE License Server
vsinet 996
maitrd 997
busboy 998
puparp 998
garcon 999
applix 999 Applix ac
cadlock 1000
silencer 1001
webex 1001
blackice-port-1002 1002
ufsd 1008 UFS-aware server
sometimes-rpc1 1012 rstatd (OpenBSD)
kdm 1024 K Display Manager (KDE version of xdm)
Dwyco Video Conferencing (Range: 1024-5000)
listen 1025 listener RFS remote_file_sharing
network blackjack
nterm 1026 remote_login network_terminal
windows-messenger-service 1026 http://www.lurhq.com/popup_spam.html
icq 1027 ICQ
icq 1029 ICQ
icq 1032 ICQ
iad1 1030 BBN IAD
iad2 1031 BBN IAD
iad3 1032 BBN IAD
netspy 1033
w2k-printer-port-monitor 1033
fpitp 1045 1045 Fingerprint Image Transfer Protocol
wfremotertm 1046 1046 WebFilter Remote Monitor
startron 1057 1057 STARTRON
nim 1058
nimreg 1059
polestar 1060 1060 POLESTAR
kiosk 1061 1061 KIOSK
veracity 1062 1062 Veracity
syscomlan 1065 1065 SYSCOMLAN
instl_boots 1067 Installation Bootstrap Proto. Serv.
instl_bootc 1068 Installation Bootstrap Proto. Cli.
socks 1080 Socks/Wingate
ansoft-lm-1 1083 Anasoft License Manager
ansoft-lm-2 1084 Anasoft License Manager
xaudio 1103 Xaserver # X Audio Server
xrl 1104 1104 XRL
kpop 1109 Pop with Kerberos
nfsd-status 1110 NFS Cluster status/Keep-Alive info
msql 1112 mini-sql server
mini-sql 1114 1114 Mini SQL
sacred 1118 1118 SACRED
supfiledbg 1127 SUP debugging
nfa 1155 Network File Access
nfa 1155 Network File Access
oracle-oms 1159 1159 Oracle OMS
phone 1167 conference calling
vchat 1168 1168 VChat Conference Service
tripwire 1169 1169 TripWire
streamingaudio 1170 1170 streamingaudio
skkserv 1178 SKK (kanji input)
mysql-cluster 1186 1186 MySQL Cluster Manager
hp-webadmin 1188 1188 HP Web Admin
openvpn 1194 1194 OpenVPN
lupa 1212
May 22, 2006 TCP/IP Ports List [v1.6] Page 12 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

15. kazaa 1214 1214 KAZAA
nerv 1222 SNI R&D network
vpnz 1224 1224 VPNz
dns2go 1227 1227 DNS2Go
florence 1228 1228 FLORENCE
periscope 1230 1230 Periscope
hotline 1234
nessus 1241 nessus client-to-server port
remote message server
voodoo 1245
hermes 1248
emc-gateway 1273 1273 EMC-Gateway
emperion 1282 1282 Emperion
boomerang 1304 1304 Boomerang
bmc_patroldb 1313 1313 BMC_PATROLDB
alta-ana-lm 1346 Alta Analytics License Manager
bbn-mmc 1347 multi media conferencing
bbn-mmx 1348 multi media conferencing
sbook 1349 Registration Network Protocol
editbench 1350 Registration Network Protocol
equationbuilder 1351 Digital Tool Works (MIT)
lotusnotes 1352 Lotus Notes
relief 1353 Relief Consulting
relief 1353 Relief Consulting
rightbrain 1354 RightBrain Software
rightbrain 1354 RightBrain Software
intuitive-edge 1355 Intuitive Edge
cuillamartin 1356 CuillaMartin Company
pegboard 1357 Electronic PegBoard
connlcli 1358
ftsrv 1359
mimer 1360
linx 1361
timeflies 1362
ndm-requester 1363 Network DataMover Requester
ndm-server 1364 Network DataMover Server
adapt-sna 1365 Network Software Associates
netware-csp 1366 Novell NetWare Comm Service Platform
dcs 1367
screencast 1368
gv-us 1369 GlobalView to Unix Shell
us-gv 1370 Unix Shell to GlobalView
fc-cli 1371 Fujitsu Config Protocol
fc-ser 1372 Fujitsu Config Protocol
chromagrafx 1373
molly 1374 EPI Software Systems
bytex 1375
ibm-pps 1376 IBM Person to Person Software
cichlid 1377 Cichlid License Manager
elan 1378 Elan License Manager
dbreporter 1379 Integrity Solutions
telesis-licman 1380 Telesis Network License Manager
apple-licman 1381 Apple Network License Manager
gwha 1383 GW Hannaway Network License Manager
os-licman 1384 Objective Solutions License Manager
atex_elmd 1385 Atex Publishing License Manager
checksum 1386 CheckSum License Manager
cadsi-lm 1387 Computer Aided Design Software Inc LM
objective-dbc 1388 Objective Solutions DataBase Cache
iclpv-dm 1389 Document Manager
iclpv-sc 1390 Storage Controller
iclpv-sas 1391 Storage Access Server
iclpv-pm 1392 Print Manager
iclpv-nls 1393 Network Log Server
May 22, 2006 TCP/IP Ports List [v1.6] Page 13 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

16. iclpv-nlc 1394 Network Log Client
iclpv-wsm 1395 PC Workstation Manager software
dvl-activemail 1396 DVL Active Mail
audio-activmail 1397 Audio Active Mail
video-activmail 1398 Video Active Mail
cadkey-licman 1399 Cadkey License Manager
cadkey-tablet 1400 Cadkey Tablet Daemon
goldleaf-licman 1401 Goldleaf License Manager
prm-sm-np 1402 Prospero Resource Manager
prm-nm-np 1403 Prospero Resource Manager
igi-lm 1404 Infinite Graphics License Manager
ibm-res 1405 IBM Remote Execution Starter
netlabs-lm 1406 NetLabs License Manager
dbsa-lm 1407 DBSA License Manager
sophia-lm 1408 Sophia License Manager
here-lm 1409 Here License Manager
hiq 1410 HiQ License Manager
af 1411 AudioFile
innosys 1412
innosys-acl 1413
ibm-mqseries 1414 IBM MQSeries
1414 CUSeeMe Vdeo/Audio Server
dbstar 1415
novell-lu6.2 1416 Novell LU6.2
timbuktu-srv1 1417 Timbuktu Service 1 Port
timbuktu-srv2 1418 Timbuktu Service 2 Port
timbuktu-srv3 1419 Timbuktu Service 3 Port
timbuktu-srv4 1420 Timbuktu Service 4 Port
gandalf-lm 1421 Gandalf License Manager
autodesk-lm 1422 Autodesk License Manager
essbase 1423 Essbase Arbor Software
hybrid 1424 Hybrid Encryption Protocol
1424 CUSeeMe Vdeo/Audio Server
zion-lm 1425 Zion Software License Manager
sas-1 1426 Satellite-data Acquisition System 1
mloadd 1427 mloadd monitoring tool
informatik-lm 1428 informatik License Manager
nms 1429 Hypercom NMS
tpdu 1430 Hypercom TPDU
rgtp 1431 Reverse Gossip Transport
blueberry-lm 1432 Blueberry Software License Manager
ms-sql-s 1433 Microsoft-SQL-Server
ms-sql-m 1434 Microsoft-SQL-Monitor
ibm-cics 1435
sas-2 1436 Satellite-data Acquisition System 2
tabula 1437
eicon-server 1438 Eicon Security Agent/Server
eicon-x25 1439 Eicon X25/SNA Gateway
eicon-slp 1440 Eicon Service Location Protocol
cadis-1 1441 Cadis License Management
cadis-2 1442 Cadis License Management
WebSTAR/SSL Admin 1443 4D WebStar Web Server Admin
marcam-lm 1444 Marcam License Management
proxima-lm 1445 Proxima License Manager
ora-lm 1446 Optical Research Associates License Manager
apri-lm 1447 Applied Parallel Research LM
oc-lm 1448 OpenConnect License Manager
peport 1449
dwf 1450 Tandem Distributed Workbench Facility
infoman 1451 IBM Information Management
gtegsc-lm 1452 GTE Government Systems License Man
genie-lm 1453 Genie License Manager
interhdl_elmd 1454 interHDL License Manager
esl-lm 1455 ESL License Manager
May 22, 2006 TCP/IP Ports List [v1.6] Page 14 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

17. dca 1456
valisys-lm 1457 Valisys License Manager
nrcabq-lm 1458 Nichols Research Corp.
proshare1 1459 Proshare Notebook Application
proshare2 1460 Proshare Notebook Application
ibm_wrless_lan 1461 IBM Wireless LAN
world-lm 1462 World License Manager
nucleus 1463
msl_lmd 1464 MSL License Manager
pipes 1465
oceansoft-lm 1466 Ocean Software License Manager
csdmbase 1467
csdm 1468
aal-lm 1469 Active Analysis Limited License Manager
uaiact 1470 Universal Analytics
csdmbase 1471
csdm 1472
openmath 1473
telefinder 1474
taligent-lm 1475 Taligent License Manager
clvm-cfg 1476
ms-sna-server 1477
ms-sna-base 1478
dberegister 1479
pacerforum 1480
airs 1481
miteksys-lm 1482 Miteksys License Manager
afs 1483 AFS License Manager
confluent 1484 Confluent License Manager
lansource 1485
nms_topo_serv 1486
localinfosrvr 1487
docstor 1488
dmdocbroker 1489
insitu-conf 1490
anynetgateway 1491
stone-design-1 1492
netmap_lm 1493
citrix-ica 1494 Citrix MetaFrame
cvc 1495
liberty-lm 1496
rfx-lm 1497
watcom-sql 1498
fhc 1499 Federico Heinz Consultora
vlsi-lm 1500 VLSI License Manager
sas-3 1501 Satellite-data Acquisition System 3
shivadiscovery 1502 Shiva
imtc-mcs 1503 Databeam
evb-elm 1504 EVB Software Engineering License Manager
funkproxy 1505 Funk Software, Inc.
utcd 1506 Universal Time daemon (utcd)
symplex 1507
diagmond 1508
robcad-lm 1509 Robcad, Ltd. License Manager
mvx-lm 1510 Midland Valley Exploration Ltd. License Mgr
3l-l1 1511
wins 1512 Microsofts Windows Internet Name Service
fujitsu-dtc 1513 Fujitsu Systems Business of America, Inc
fujitsu-dtcns 1514 Fujitsu Systems Business of America, Inc
ifor-protocol 1515
vpad 1516 Virtual Places Audio data
vpac 1517 Virtual Places Audio control
vpvd 1518 Virtual Places Video data
vpvc 1519 Virtual Places Video control
May 22, 2006 TCP/IP Ports List [v1.6] Page 15 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

18. atm-zip-office 1520 atm zip office
oracle-sql 1521 Oracle SQLNet
nCube License Manager
rna-lm 1522 Ricardo North America License Manager
cichild-lm 1523
ingreslock 1524 ingres
pdap 1525 Prospero
pdap-np 1526 Prospero Data Access Prot non-priv
tlisrv 1527 Oracle
mciautoreg 1528
coauthor 1529 Oracle
rap-service 1530
rap-listen 1531
miroconnect 1532
virtual-places 1533 Virtual Places Software
micromuse-lm 1534
ampr-info 1535
ampr-inter 1536
sdsc-lm 1537
3ds-lm 1538
intellistor-lm 1539 Intellistor License Manager
rds 1540
rds2 1541
gridgen-elmd 1542
simba-cs 1543
aspeclmd 1544
vistium-share 1545
abbaccuray 1546
laplink 1547
axon-lm 1548 Axon License Manager
shivasound 1549 Shiva Sound
3m-image-lm 1550 Image Storage license manager 3M Company
hecmtl-db 1551
pciarray 1552
livelan 1555 1555 livelan
veritas_pbx 1556 1556 Veritas Private Branch Exchange
web2host 1559 1559 web2host
ets 1569 1569 ets
orbixd 1570 1570 orbixd
oraclenames 1575 1575 oraclenames
simbaexpress 1583 1583 simbaexpress
dialpad 1584 Dialpad
dialpad 1585 Dialpad
issd 1600
citrix-ica 1604 Citrix ICA, MS Terminal Server
skytelnet 1618 1618 skytelnet
softdataphone 1621 1621 softdataphone
ontime 1622 1622 ontime
radius 1645 radius authentication
radacct 1646 radius accounting
kermit 1649 1649 kermit
nkd 1650
shiva_confsrvr 1651
xnmp 1652
netview-aix-1 1661
netview-aix-2 1662
netview-aix-3 1663
netview-aix-4 1664
netview-aix-5 1665
netview-aix-6 1666
netview-aix-7 1667
netview-aix-8 1668
netview-aix-9 1669
netview-aix-10 1670
May 22, 2006 TCP/IP Ports List [v1.6] Page 16 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

19. netview-aix-11 1671
netview-aix-12 1672
groupwise 1677 1677 groupwise
prolink 1678 1678 prolink
carboncopy 1680 CarbonCopy Server
snaresecure 1684 1684 SnareSecure
groupwise 1686 1686 http://www.Novell.com/products/groupwise/
cuseeme 1720 CUSeeMe Vdeo/Audio Server
H.323/Q.931
pptp 1723 Point-to-Point Tunnelling Protocol
wm-asf 1755 Windows Media (.asf)
tftp-multi 1758 TFTP Multicast
radius 1812 RADIUS authentication protocol (RFC 2138)
1812 CUSeeMe Vdeo/Audio Server
radacct 1813 RADIUS accounting protocol (RFC 2139)
1813 CUSeeMe Vdeo/Audio Server
pcm 1827 PCM Agent (AutoSecure Policy Compliance Mgr)
sugp 1905 1905 Secure UP.Link Gateway Protocol
licensedaemon 1986 cisco license management
tr-rsrb-p1 1987 cisco RSRB Priority 1 port
tr-rsrb-p2 1988 cisco RSRB Priority 2 port
tr-rsrb-p3 1989 cisco RSRB Priority 3 port
stun-p1 1990 cisco STUN Priority 1 port
stun-p2 1991 cisco STUN Priority 2 port
stun-p3 1992 cisco STUN Priority 3 port
snmp-tcp-port 1993 cisco SNMP TCP port
stun-port 1994 cisco serial tunnel port
perf-port 1995 cisco perf port
tr-rsrb-port 1996 cisco Remote SRB port
gdp-port 1997 cisco Gateway Discovery Protocol
x25-svc-port 1998 cisco X.25 service (XOT)
tcp-id-port 1999 cisco identification port
callbook 2000
wizard 2001 curry
globe 2002
cfingerd 2003 GNU finger
mailbox 2004
emce 2004 CCWS mm conf
deslogin 2005 encrypted symmetric telnet/login
oracle 2005
invokator 2006
raid-cc 2006 raid
dectalk 2007
raid-am 2007
conf 2008
terminaldb 2008
news 2009
whosockami 2009
search 2010 or, nfr411
pipe_server 2010
raid-cc 2011 raid
servserv 2011
ttyinfo 2012
raid-ac 2012
raid-am 2013
raid-cd 2013
troff 2014
raid-sf 2014
cypress 2015
raid-cs 2015
bootserver 2016
bootserver 2016
cypress-stat 2017
bootclient 2017
May 22, 2006 TCP/IP Ports List [v1.6] Page 17 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

20. terminaldb 2018
rellpack 2018
whosockami 2019
about 2019
xinupageserver 2020
servexec 2021
xinuexpansion1 2021
xinuexpansion2 2022
xinuexpansion3 2023
xinuexpansion4 2024
ellpack 2025
xribs 2025
scrabble 2026
shadowserver 2027
submitserver 2028
device2 2030
blackboard 2032
glogger 2033
scoremgr 2034
imsldoc 2035
objectmanager 2038
lam 2040
interbase 2041
isis 2042
isis-bcast 2043
rimsl 2044
cdfunc 2045
sdfunc 2046
dls 2047
dls-monitor 2048
nfs 2049 Network File System
distrib-net-rsa 2064 distributed.net RSA crypto decipher tool
dlsrpn 2065 Data Link Switch Read Port Number
dlswpn 2067 Data Link Switch Write Port Number
go2call 2090 2090 Go2Call
go2call 2091 Go2Call
zephyr-clt 2103 Zephyr serv-hm connection
zephyr-hm 2104 Zephyr hostmanager
eklogin 2105 Kerberos (v4) encrypted rlogin
ekshell 2106 Kerberos (v4) encrypted rshell
rkinit 2108 Kerberos (v4) remote initialization
kx 2111 X over kerberos
kip 2112 IP over kerberos
kauth 2120 Remote kauth
ats 2201 Advanced Training System Program
ivs-video 2232 IVS Video default
shiva-vpn 2233
ivsd 2241 IVS Daemon
mysql-im 2273 2273 MySql Instance Manager
compaqdiag 2301 Compaq Insight Management Web Agents
pehelp 2307
netscape-conf 2327 Netscape Conference
apple-ug 2336 Apple UG Control
ms-olap3 2382 2382 Microsoft OLAP
ms-olap4 2383 2383 Microsoft OLAP
fmpro-fdal 2399 2399 Filemaker, Inc. -- Data Access Layer
cvspserver 2401 CVS network server
g-talk 2421 2421 G-Talk
venus 2430
venus-se 2431
codasrv 2432
codasrv-se 2433
rtsserv 2500 Resource Tracking system server
rtsclient 2501 Resource Tracking system client
wlbs 2504
May 22, 2006 TCP/IP Ports List [v1.6] Page 18 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

21. citrixima 2512 2512 Citrix IMA
hp-3000-telnet 2564 HP 3000 NS/VT block mode telnet
zebrasrv 2600 zebra service
zebra 2601 zebra vty
ripd 2602 RIPd vty
ripngd 2603 RIPngd vty
ospfd 2604 OSPFd vty
bgpd 2605 BGPd vty
webster 2627 Network dictionary
sybase 2638 Sybase database
cp-udp-encap 2746 Check Point UDP Encapsulation
listen 2766 System V listener port
iss-realsec 2998 ISS RealSecure IDS Remote Console Admin port
active-ppp 3000 Active Worlds Msging
Deerfield MDaemon Email Server
User-level ppp daemon
3000 Calista IP Phone (Inbound)
nessusd 3001 Nessus Security Scanner Daemon
Deerfield MDaemon Email Server
deslogin 3005 Encrypted symmetric telnet/login
deslogind 3006
Program Linking 3031 MacOS Apple Events / AgentVU
cfs 3049 cryptographic file system (nfs)
distrib-net-proxy 3064 proxy port (distributed.net)
sj3 3086 SJ3 (kanji input)
squid-http 3128
squid-ipc 3130
vmodem 3141
viavideo 3230 3230 Polycom ViaVideo (H.323)
viavideo 3231 3231 Polycom ViaVideo (H.323)
viavideo 3232 3232 Polycom ViaVideo (H.323)
viavideo 3233 3233 Polycom ViaVideo (H.323)
viavideo 3234 3234 Polycom ViaVideo (H.323)
viavideo 3235 3235 Polycom ViaVideo (H.323)
ccmail 3264 cc:Mail/Lotus
MacOS Net Assistant 3283
mysql 3306 mySQL
dec-notes 3333 DEC Notes
msrdp 3389 Microsoft Remote Display (Terminal) Protocol
bmap 3421 Bull Apprise portmapper
bungie-myth 3453 Bungie Myth and Myth II Server
prsvp 3455 RSVP Port
vat 3456 VAT default data
vat-control 3457 VAT default control
track 3462 software distribution
udt_os 3900 Unidata UDT OS
mapper-nodemgr 3984 MAPPER network node manager
mapper-mapethd 3985 MAPPER TCP/IP server
mapper-ws_ethd 3986 MAPPER workstation server
netcheque 4008 NetCheque accounting
lockd 4045 NFS lock daemon/manager
aol-aim-2 4099 AOL Instant Messanger (Outbound)
nuts_dem 4132 NUTS Daemon
nuts_bootp 4133 NUTS Bootp Server
wincim 4144 Windows Compuserve Protocol
EIMS Admin 4199
rwhois 4321 Remote Who Is
msql 4333 mini-sql server
unicall 4343
krb524 4444 Kerberos v5 -> v4 ticket translator
sae-urn 4500
fax 4557 FlexFax FAX transmission service
hylafax 4559 HylaFAX client-server protocol
rfa 4672 Remote file access server
May 22, 2006 TCP/IP Ports List [v1.6] Page 19 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

22. commplex-main 5000
Yahoo Messenger Chat
Free Internet Chess Server
commplex-link 5001
Yahoo Messenger Chat
rfe 5002 Radio Free Ethernet
FileMaker Pro 5003 5003 FileMaker Pro over IP
telelpathstart 5010
telelpathattack 5011
mmcc 5050 multimedia conference control tool
rmonitor_secure 5145 RMonitor Secure
aol-aim-1 5190 AOL Instant Messanger (Inbound)
Calista IP Phone (Outbound)
aol-1 5191 AmericaOnline1
aol-2 5192 AmericaOnline2
aol-3 5193 AmericaOnline3
sgi-dgl 5232 SGI Distributed Graphics
padl2sim 5236
hacl-hb 5300 HA cluster heartbeat
hacl-gs 5301 HA cluster general services
hacl-cfg 5302 HA cluster configuration
hacl-probe 5303 HA cluster probing
hacl-local 5304
hacl-test 5305
cfengine 5308
pcduo-old 5400 RemCon PC-Duo - old port
pcduo 5405 RemCon PC-Duo - new port
postgres 5432 postgres database server
hotline 5499 Hotline Server
securid 5500 SecurID
VNC Server
Hotline Server
hotline 5501 Hotline Server
hotline 5502 Hotline Server
hotline 5503 Hotline Server
secureidprop 5510 SecurID ACE/Server services
sdlog 5520 SecurID ACE/Server services
sdserv 5530 SecurID ACE/Server services
sdxauthd 5540 SecurID ACE/Server services
sdadmind 5550 SecurID ACE/Server services
rplay 5555
pcAnywhereData 5631
pcAnywhereStat 5632
active-worlds 5670 Active Worlds Messaging & Conferencing
canna 5680 Canna (Japanese Input)
proshareaudio 5713 proshare conf audio
prosharevideo 5714 proshare conf video
prosharedata 5715 proshare conf data
prosharerequest 5716 proshare conf request
prosharenotify 5717 proshare conf notify
vnc 5800 Virtual Network Computer
vnc 5801 Virtual Network Computer
vnc 5900 Virtual Network Computer
vnc-1 5901 Virtual Network Computer Display :1
vnc-2 5902 Virtual Network Computer Display :2
ncd-pref-tcp 5977 NCD preferences tcp port
ncd-diag-tcp 5978 NCD diagnostic tcp port
ncd-conf-tcp 5979 NCD configuration tcp port
ncd-pref 5997 NCD preferences telnet port
ncd-diag 5998 NCD diagnostic telnet port
ncd-conf 5999 NCD configuration telnet port
X11 6000 X Window server
X11:1 6001 X Window server
X11:2 6002 X Window server
May 22, 2006 TCP/IP Ports List [v1.6] Page 20 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

23. X11:3 6003 X Window server
X11:4 6004 X Window server
X11:5 6005 X Window server
X11:6 6006 X Window server
X11:7 6007 X Window server
X11:8 6008 X Window server
X11:9 6009 X Window server
arcserve 6050 ARCserve agent
isdninfo 6105 isdninfo
isdninfo 6106 i4lmond
softcm 6110 HP SoftBench CM
spc 6111 HP SoftBench Sub-Process Control
dtspc 6112 CDE subprocess control
meta-corp 6141 Meta Corporation License Manager
aspentec-lm 6142 Aspen Technology License Manager
watershed-lm 6143 Watershed License Manager
statsci1-lm 6144 StatSci License Manager - 1
statsci2-lm 6145 StatSci License Manager - 2
lonewolf-lm 6146 Lone Wolf Systems License Manager
montage-lm 6147 Montage License Manager
ricardo-lm 6148 Ricardo North America License Manager
gnutella 6346 6346 GNUtella Peer-to-Peer File Sharing System
netop-rc 6502 NetOp Remote Control (by Danware Data A/S)
xdsxdm 6558
irc-serv 6666 internet relay chat server
irc 6667 Internet Relay Chat
irc 6668 Internet Relay Chat
napster 6699 Napster Music Sharing System
acmsoda 6969
napster 6699 Napster file (MP3) sharing software
quicktime 6970 6970 QuickTime Server (UDP Range: 6970-7000)
RealMedia Server (UDP Range: 6970-7170)
dwyco-video 6700 Dwyco Video Conferencing
dwyco-video 6701 Dwyco Video Conferencing
dwyco-video 6702 Dwyco Video Conferencing
net2phone 6801 Net2Phone
net2phone 6802 Net2Phone
net2phone 6803 Net2Phone
dwyco-video 6880 Dwyco Video Conferencing
afs3-fileserver 7000 afs file server
Internet Relay Chat
ActiveWorlds (Range: 7000-7100)
afs3-callback 7001 callbacks to cache managers
afs3-prserver 7002 users & groups database
afs3-vlserver 7003 volume location database
afs3-kaserver 7004 AFS/Kerberos authentication service
afs3-volser 7005 volume managment server
afs3-errors 7006 error interpretation service
afs3-bos 7007 basic overseer process
afs3-update 7008 server-to-server updater
afs3-rmtsys 7009 remote cache manager service
ups-onlinet 7010 onlinet uninterruptable power supplies
realmedia 7070 RealMedia (Audio/Video)
font-service 7100 X Font Service
dialpad 7175 Dialpad
fodms 7200 FODMS FLIP
dlip 7201
icb 7326 Internet Citizens Band
qaz 7597 Quaz trojan worm
CUSeeMe 7640 CUSeeMe Video/Audio Server
CUSeeMe 7642 CUSeeMe Video/Audio Server
CUSeeMe-1 7648 7648 CUSeeMe Video/Audio Server
CUSeeMe-2 7649 CUSeeMe Video/Audio Server
CUSeeMe-3 7650 CUSeeMe Video/Audio Server
CUSeeMe-4 7651 CUSeeMe Video/Audio Server
May 22, 2006 TCP/IP Ports List [v1.6] Page 21 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

24. active-worlds-2 7777 Active Worlds Messaging & Conferencing
shoutcast 8000 Shoucast Streaming MP3 Server
shoutcast 8001 Shoucast Streaming MP3 Server
shoutcast 8002 Shoucast Streaming MP3 Server
shoutcast 8003 Shoucast Streaming MP3 Server
shoutcast 8004 Shoucast Streaming MP3 Server
shoutcast 8005 Shoucast Streaming MP3 Server
jserv 8007 Apache JServ module
ajp13 8009
http-proxy 8080 Common HTTP proxy/second web server port
blackice-icecap 8081 ICECap user console
blackice-alerts 8082 BlackIce Alerts sent to this port
cp-cluster 8116 8116 Check Point Clustering
dialpad 8680 Dialpad (Range: 8680-8686)
sun-answerbook 8888 Sun Answerbook HTTP server
seosload 8892 Computer Associates eTrust ACX
zeus-admin 9090 Zeus Admin Server
jetdirect 9100 HP JetDirect
man 9535
sd 9876 Session Director
ivisit 9943 Ivisit
issa 9991 ISS System Scanner Agent
issc 9992 ISS System Scanner Console
palace-chat 9997 Palace Chat Server
palace-chat 9998 Palace Chat Server
stel 10005 Secure telnet
amanda 10080 Amanda Backup Util
amandaidx 10082 Amanda indexing
amidxtape 10083 Amanda tape indexing
pksd 11371 PGP Public Key Server
dwyco-video 12000 Dwyco Video Conference (Range: 12000-16090)
delta3pc2phone 12053 Delta Three PC to Phone
delta3pc2phone 12080 Delta Three PC to Phone
delta3pc2phone 12083 Delta Three PC to Phone
delta3pc2phone 12120 Delta Three PC to Phone
delta3pc2phone 12122 Delta Three PC to Phone
isode-dua 17007
biimenu 18000 Beckman Instruments, Inc.
liquid-au 18888 LiquidAudio
btx 20005 xcept4 (German Telekoms CEPT videotext service)
wnn6 22273 Wnn6 (Japanese input)
wnn6_Cn 22289 Wnn6 (Chinese input)
wnn6_Kr 22305 Wnn6 (Korean input)
wnn6_Tw 22321 Wnn6 (Taiwanse input)
hpnpd 22370 Hewlett-Packard Network Printer daemon
hpnpd 22370 Hewlett-Packard Network Printer daemon
internetphone 22555 Internet Phone
delta3pc2phone 24150 Delta Three PC to Phone (Range: 24150 - 24179)
wnn6_DS 26208 Wnn6 (Dserver)
halflife 27015 Half Life Game Server
Quake3Server 27660 Quake 3 Arena Server (for first player)
Quake2Server 27910 Quake 2 Server
Quake3Server 27960 Quake 3 Arena Server
heretic2 28910 Heretic II Game Server
Solaris RPC port 32770 Solaris RPC port
Solaris RPC port 32771 Solaris RPC port (rusersd)
Solaris RPC port 32772 Solaris RPC port (status)
Solaris RPC port 32773 Solaris RPC port (rquotad)
Solaris RPC port 32774 Solaris RPC port (rusersd)
Solaris RPC port 32775 Solaris RPC port (status)
Solaris RPC port 32776 Solaris RPC port (sprayd)
Solaris RPC port 32777 Solaris RPC port (walld)
Solaris RPC port 32778 Solaris RPC port (rstatd)
Solaris RPC port 32779 Solaris RPC port
May 22, 2006 TCP/IP Ports List [v1.6] Page 22 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

25. May 22, 2006 TCP/IP Ports List [v1.6] Page 23 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
Solaris RPC port 32780 Solaris RPC port
Solaris RPC port 32786 Solaris RPC port (mountd)
Solaris RPC port 32787 Solaris RPC port dmispd (DMI Service Provider)
timestep 38036
sygatefw 39213 SyGate Firewall Mgmt port v3.0 build 521 and <
novell 40193
reachout 43188
coldfusion-auth 44442 ColdFusion Advanced Security/Siteminder Auth
coldfusion-auth 44443 ColdFusion Advanced Security/Siteminder Auth
ciscopop 45000 Cisco PostOffice Protocol for NetRanger (IDS)
dbbrowse 47557 Databeam Corporation
dialpad 51200 Dialpad
dialpad 51201 Dialpad
dialpad 51210 Dialpad
ivisit 56768 Ivisit
cuseeme 56800 CUSeeMe
pcAnywhere 65301 pcAnywhere
###

26. Trojan / Backdoor Ports
The following ports should be considered as hostile ports as they are mostly used for trojans or backdoor programs. Hackers/crackers
that break into systems often start processes running on one of the following ports and then use them to either regain entry or launch
attacks against other sites.
Service Name TCP Port UDP Port Description
0 Click attack (ICMP)
1 Sockets des Troie
2 Death
8 Ping Attack (ICMP)
9 Chargen
19 Chargen
20 Senna Spy FTP server
21 Back Construction
Blade Runner
Cattivik FTP Server
CC Invader
Dark FTP
Dolly Trojan
Fore
Invisible FTP
Juggernaut 42
Larva
MotIv FTP
Net Administrator
Ramen
Senna Spy FTP server
The Flu
Traitor 21
WebEx
WinCrash
22 Shaft
23 Fire HacKer
Tiny Telnet Server - TTS
Truva Atl
25 Ajan
Antigen
Barok
Email Password Sender (EPS) & EPS II
Gip
Gris
Happy99
Hpteam mail
Hybris
I love you
Kuang2
Magic Horse
MBT (Mail Bombing Trojan)
Moscow Email trojan
Naebi
NewApt worm
ProMail trojan
Shtirlitz
Stealth
Tapiras
Terminator
WinSpy
30 Agent 40421
31 Agent 31
Hackers Paradise
Masters Paradise
May 22, 2006 TCP/IP Ports List [v1.6] Page 24 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

27. 41 Deep Throat
Foreplay
48 DRAT
50 DRAT
58 DMSetup
59 DMSetup
79 CDK
Firehotcker
80 711 trojan (Seven Eleven)
AckCmd
Back End
Back Orifice 2000 Plug-Ins
Cafeini
CGI Backdoor
Executor
God Message
God Message Creator
Hooker
IISworm
MTX
NCX
Reverse WWW Tunnel Backdoor
RingZero
Seeker
WAN Remote
Web Server CT
WebDownloader
81 RemoConChubo
90 Hidden Port 2.0
99 Hidden Port
NCX
110 ProMail trojan
113 Invisible Identd Deamon
Kazimas
119 Happy99
121 Attack Bot
God Message
JammerKillah
123 Net Controller
129 Password Generator Protocol
133 Farnaz
137 Netbios name (DoS attacks)
Chode
137 Netbios name (DoS attacks)
Msinit
138 Chode
139 Netbios session (DoS attacks)
Chode
God Message worm
Msinit
Netlog
Network
Qaz
139 Netbios session (DoS attacks)
142 NetTaxi
146 146 Infector 1.3
170 A-trojan
334 Backage
411 Backage
420 Breach
Incognito
421 TCP Wrappers trojan
455 Fatal Connections
456 Hackers Paradise
May 22, 2006 TCP/IP Ports List [v1.6] Page 25 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

28. 513 Grlogin
514 RPC Backdoor
531 Net666
Rasmin
555 711 trojan (Seven Eleven)
Ini-Killer
Net Administrator
Phase Zero
Stealth Spy
605 Secret Service
666 Attack FTP
Back Construction
BLA trojan
Cain & Abel
NokNok
Satans Back Door - SBD
ServU
Shadow Phyre
th3r1pp3rz (Therippers)
667 SniperNet
669 DP trojan
692 GayOL
777 AIM Spy Application
Undetected
808 WinHole
911 Dark Shadow
999 Deep Throat
Foreplay
WinSatan
1000 Der SpSher / Der Spaeher
Direct Connection
1001 Der SpSher / Der Spaeher
Le Guardien
Silencer
WebEx
1010 Doly Trojan
1011 Doly Trojan
1012 Doly Trojan
1015 Doly Trojan
1016 Doly Trojan
1020 Vampire
1024 Jade
Latinus
NetSpy
1025 Remote Storm
1025 Mavericks Matrix 1.2 - 2.0
Remote Storm
1033 NetSpy
1035 Multidropper
1042 BLA trojan
1045 Rasmin
1049 /sbin/initd
1050 MiniCommand
1053 The Thief
1054 AckCmd
1080 WinHole
1081 WinHole
1082 WinHole
1083 WinHole
1090 Xtreme
1095 Remote Administration Tool - RAT
1097 Remote Administration Tool - RAT
1098 Remote Administration Tool - RAT
May 22, 2006 TCP/IP Ports List [v1.6] Page 26 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

29. 1099 Blood Fest Evolution
Remote Administration Tool - RAT
1150 Orion
1151 Orion
1170 Psyber Stream Server - PSS
Streaming Audio Server
Voice
1200 NoBackO
1201 NoBackO
1207 SoftWAR
1208 Infector
1212 Kaos
1234 SubSeven Java client
Ultors Trojan
1243 BackDoor-G
SubSeven Apocalypse
Tiles
Sub Seven
1245 VooDoo Doll
1255 Scarab
1256 Project nEXT
1269 Mavericks Matrix
1272 The Matrix
1313 NETrojan
1338 Millenium Worm
1349 BackOrifice DLL Comm
1394 GoFriller
Backdoor G-1
1441 Remote Storm
1492 FTP99CMP
1524 Trinoo
1568 Remote Hack
1600 Direct Connection
Shivka-Burka
1703 Exploiter
1777 Scarab
1807 SpySender
1966 Fake FTP
1967 WM FTP Server
1969 OpC BO
1981 Bowl
Shockrave
1999 Back Door
SubSeven
TransScout
2000 Der SpSher / Der Spaeher
Insane Network
Last 2000
Remote Explorer 2000
Senna Spy Trojan Generator
2001 Der SpSher / Der Spaeher
Trojan Cow
2002 TransScout
2003 TransScout
2004 TransScout
2005 TransScout
2023 Ripper Pro
2080 WinHole
2115 Bugs
2130 Mini Backlash
2140 The Invasor
2140 Deep Throat
Foreplay
May 22, 2006 TCP/IP Ports List [v1.6] Page 27 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

30. 2155 Illusion Mailer
2255 Nirvana
2283 HLV Rat5
2300 Xplorer
2311 Studio 54
2330 Contact
2331 Contact
2332 Contact
2333 Contact
2334 Contact
2335 Contact
2336 Contact
2337 Contact
2338 Contact
2339 Contact
Voice Spy
2339 Voice Spy
2345 Doly Trojan
2565 Striker trojan
2583 WinCrash
2600 Digital RootBeer
2716 The Prayer 1.2 -1.3
2721 Phase Zero
2773 SubSeven
SubSeven 2.1 Gold
2774 SubSeven
SubSeven 2.1 Gold
2801 Phineas Phucker
2989 Remote Administration Tool - RAT
3000 Remote Shut
3024 WinCrash
3028 Ring Zero
3031 Microspy
3128 Reverse WWW Tunnel Backdoor
RingZero
3129 Masters Paradise
3150 The Invasor
3150 Deep Throat
Foreplay
Mini Backlash
3456 Terror trojan
3459 Eclipse 2000
Sanctuary
3700 Portal of Doom
3777 PsychWard
3791 Total Solar Eclypse
3801 Total Solar Eclypse
4000 SkyDance
4092 WinCrash
4100 Watchguard Firebox Admin DoS
4242 Virtual Hacking Machine - VHM
4321 BoBo
4444 Prosiak
Swift Remote
4567 File Nail
4590 ICQ Trojan
4950 ICQ Trogen (Lm)
5000 Back Door Setup
Blazer5
Bubbel
ICKiller
Ra1d
Sockets des Troie
5001 Back Door Setup
May 22, 2006 TCP/IP Ports List [v1.6] Page 28 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

31. Sockets des Troie
5002 cd00r
Shaft
5010 Solo
5011 One of the Last Trojans - OOTLT
modified
5025 WM Remote KeyLogger
5031 Net Metropolitan 1.0
5032 Net Metropolitan 1.04
5321 Firehotcker
5333 Backage
NetDemon
5343 wCrat - WC Remote Administration Tool
5400 Back Construction
Blade Runner
5401 Back Construction
Blade Runner
5402 Back Construction
Blade Runner
5512 Illusion Mailer
Xtcp
5521 Illusion Mailer
5534 The Flu
5550 Xtcp
5555 ServeMe
5556 BO Facil
5557 BO Facil
5569 Robo-Hack
5637 PC Crasher
5638 PC Crasher
5742 WinCrash
5760 Portmap Remote Root Linux Exploit
5880 Y3K RAT
5882 5882 Y3K RAT
5888 5888 Y3K RAT
5889 Y3K RAT
6000 The Thing 1.6
6006 Bad Blood
6272 Secret Service
6400 The Thing
6661 TEMan, Weia-Meia
6666 Dark Connection Inside
NetBus worm
6667 Sub-7 Trojan (new icq notification)
Subseven 2.1.4 DefCon 8
SubSeven
Dark FTP
ScheduleAgent
Trinity
WinSatan
6669 Host Control
Vampyre
6670 BackWeb Server
Deep Throat
Foreplay
WinNuke eXtreame
6671 Deep Throat
6711 BackDoor-G
SubSeven
VP Killer
6712 Funny trojan
SubSeven
6713 SubSeven
6723 Mstream attack-handler
May 22, 2006 TCP/IP Ports List [v1.6] Page 29 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

32. 6771 Deep Throat
Foreplay
6776 2000 Cracks
BackDoor-G
SubSeven
VP Killer
6838 Mstream Agent-handler
6883 Delta Source DarkStar
6912 Sh*t Heap (not 69123)
6939 Indoctrination
6969 GateCrasher
IRC 3
Net Controller
Priority
6970 GateCrasher
7000 Exploit Translation Server
Kazimas
Remote Grab
SubSeven
SubSeven 2.1 Gold
7001 Freak88
Freak2k
7028 7028 Unknown Trojan
7215 SubSeven
SubSeven 2.1 Gold
7300 NetMonitor
7301 NetMonitor
7306 NetMonitor
7307 NetMonitor
7308 NetMonitor
7424 7424 Host Control
7597 QaZ (Remote Access Trojan)
7626 Glacier
7777 God Message
Tini
7789 Back Door Setup
ICKiller
7891 The ReVeNgEr
7983 MStream handler-agent
8080 Brown Orifice
RemoConChubo
Reverse WWW Tunnel Backdoor
RingZero
8787 Back Orifice 2000
8879 8879 Back Orifice 2000
8988 BacHack
8989 Rcon
Recon
Xcon
9000 Netministrator
9325 MStream Agent-handler
9400 InCommand
9872 Portal of Doom
9873 Portal of Doom
9874 Portal of Doom
9875 Portal of Doom
9876 Cyber Attacker
Rux
9878 TransScout
9989 ini-Killer
9999 The Prayer 1.2 -1.3
10000 OpwinTRojan
10005 OpwinTRojan
10067 Portal of Doom
May 22, 2006 TCP/IP Ports List [v1.6] Page 30 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

33. 10085 Syphillis
10086 Syphillis
10100 Control Total, Gift trojan
10101 BrainSpy, Silencer
10167 Portal of Doom
10498 Mstream handler-agent
10520 Acid Shivers
10528 Host Control
10607 Coma
10666 Ambush
11000 Senna Spy Trojan Generator
11050 Host Control
11051 Host Control
11223 Progenic trojan
Secret Agent
12076 Gjamer
12223 Hack 99 KeyLogger
12345 Ashley
cron / crontab
Fat Bitch trojan,
GabanBus
icmp_client.c
icmp_pipe.c
Mypic
NetBus
NetBus Toy
NetBus worm
Pie Bill Gates
Ultors Trojan
Whack Job
X-bill
12346 Fat Bitch trojan
GabanBus
NetBus
X-bill
12349 BioNet
12361 Whack-a-mole
12362 Whack-a-mole
12363 Whack-a-mole
12623 DUN Control
12456 NetBus
12624 ButtMan
12631 Whack Job
12701 Eclypse 2000
12754 Mstream attack-handler
13000 Senna Spy Trojan Generator
13010 Hacker Brasil - HBR
13013 PsychWard
13014 PsychWard
13223 Hack 99 KeyLogger
13473 Chupacabra
13700 Kuang2 the Virus
14500 PC Invader
14501 PC Invader
14502 PC Invader
14503 PC Invader
15000 NetDemon
15092 Host Control
15104 Mstream attack-handler
15382 SubZero
15858 CDK
16484 Mosucker
16660 Stacheldraht
16772 ICQ Revenge
May 22, 2006 TCP/IP Ports List [v1.6] Page 31 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

34. 16959 SubSeven
Subseven 2.1.4 DefCon 8
16969 Priority
17166 Mosaic
17300 Kuang2 the virus
17449 Kid Terror
17499 CrazzyNet
17500 CrazzyNet
17569 Infector
17593 Audiodoor
17777 Nephron
18753 18753 Shafthandler to Agent
19864 ICQ Revenge
20000 Millenium
20001 Millenium
Millenium (Lm)
20002 AcidkoR
20005 Mosucker
20023 VP Killer
20034 NetBus 2.0 Pro
NetBus 2.0 Pro Hidden
NetRex
Whack Job
20203 Chupacabra
Logged!
20331 BLA trojan
20432 Shaft Client to handlers
20433 Shaft Agent to handlers
21544 GirlFriend
Kid Terror
21554 Exploiter
Kid Terror
Schwindler
Winsp00fer
22222 Donald Dick
Prosiak
Ruler
RUX The TIc.K
23005 NetTrash
23006 NetTrash
23023 Logged
23032 Amanda
23432 Asylum
23456 Evil FTP
Ugly FTP
Whack Job
23476 23476 Donald Dick
23477 Donald Dick
23777 InetSpy
24000 Infector
25685 Moonpie
25686 Moonpie
25982 Moonpie
26274 Delta Source
26681 Voice Spy
26274 Delta Source
27374 Bad Blood
Ramen
Seeker
SubSeven
SubSeven 2.1 Gold
Subseven 2.1.4 DefCon 8
SubSeven Muie Ttfloader
27444 27444 Trin00/TFN2K
May 22, 2006 TCP/IP Ports List [v1.6] Page 32 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

35. 27573 SubSeven 2.1
27665 Trin00 DoS Attack
28678 Exploiter
29104 NetTrojan
29369 ovasOn
29891 The Unexplained
30000 Infector
30001 ErrOr32
30003 Lamers Death
30029 AOL Trojan
30100 NetSphere
30101 NetSphere
30102 NetSphere
30103 30103 NetSphere
30133 NetSphere Final
30303 Sockets des Troie
30464 IceCast remote overflow
30947 Intruse
30999 Kuang2
31335 31335 Trin00 DoS Attack
31336 BO-Whack
Butt Funnel
eleet 31337 Back Fire
Back Orifice 1.20 patches
Back Orifice (Lm)
Back Orifice russian
Baron Night, Beeone
BO client
BO Facil
BO spy
BO2
cron / crontab
Freak88
Freak2k
icmp_pipe.c
Sockdmini
31337 Back Orifice
Deep BO
31338 Back Orifice
Butt Funnel
NetSpy (DK)
31338 Deep BO
31339 NetSpy (DK)
31666 BO-Whack
31785 HackaTack
31787 HackaTack
31788 HackaTack
31789 HackaTack
31790 HackaTack
31791 HackaTack
31792 HackaTack
32001 Donald Dick
32100 Peanut Brittle
Project nEXT
32418 Acid Battery
33270 Trinity Trojan
33333 Blakharaz
Prosiak
33390 Unknown trojan
33577 Son of PsychWard
33777 Son of PsychWard
33911 Spirit 2000
Spirit 2001
34324 Big Gluck
May 22, 2006 TCP/IP Ports List [v1.6] Page 33 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

36. TN
34444 Donald Dick
34555 Trinoo (Windows only)
35555 Trinoo (Windows only)
37237 Mantis
37651 Yet Another Trojan - YAT
40412 The Spy
40421 Agent 40421
Masters Paradise
40422 Masters Paradise
40423 Masters Paradise
40425 Masters Paradise
40426 Masters Paradise
41337 Storm
41666 Remote Boot Tool (RBT)
43210 Masters Paradise
44444 Prosiak
44575 Exploiter
47252 Delta Source
47262 Delta Source
49301 OnLine KeyLogger
50130 Enterprise
50505 Sockets de Troie 2.0
50766 Fore
Schwindler
51966 Cafeini
52317 Acid Battery 2000
53001 Remote Windows Shutdown (RWS)
54283 SubSeven
SubSeven 2.1 Gold
54320 Back Orifice 200 (Default Port)
54321 Back Orifice 200 (Default Port)
School Bus
55165 File Manager trojan
WM Trojan Generator
55166 WM Trojan Generator
57341 NetRaider Trojan
58339 Butt Funnel
60000 Deep Throat
Foreplay
Sockets des Troie
60001 Trinity
60068 Xzip 6000068
60411 Connection
61348 Bunker-Hill Trojan
61466 TeleCommando
61603 Bunker-Hill Trojan
63485 Bunker-Hill Trojan
64101 Taskman
65000 Devil
Sockets des Troie
Stacheldraht
65390 Eclypse
65421 Jade
65432 65432 The Traitor (= th3tr41t0r)
65534 /sbin/initd
65535 RC1 trojan
###
May 22, 2006 TCP/IP Ports List [v1.6] Page 34 of 34
31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com
Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.