Three ranges, and what the split is for
The port field is 16 bits, so the numbers run from 0 to 65535, and they are divided into three bands. 0 to 1023 are the well-known ports, assigned by IANA, and on unix-like systems a process traditionally needs elevated privilege to bind one — which is why web servers historically started as root and dropped privileges, and why containers and modern init systems have several mechanisms for handing over a low port without that. 1024 to 49151 are registered: IANA records them on request, but nothing enforces the assignment and plenty of the entries describe software that no longer exists. 49152 upwards is the dynamic range, never assigned to anything, and that is where the client end of an outbound connection lands — a fresh number for each connection, released when it closes.
This is why a connection has four numbers, not one. A request to a web server is a tuple: your address and some high port you did not choose, to their address and 443. The port you dial is the server side. The port your machine used is an implementation detail that exists for the length of the connection.
Implicit TLS and STARTTLS, which is most of the confusion
Several protocols exist in two forms, and each form got its own number. Implicit TLS means the connection is encrypted from the first byte: 993 for mail access, 995 for mail retrieval, 465 for mail submission, 636 for directory access. STARTTLS means the connection opens in plaintext and is upgraded by a command: 143, 110, 587 and 389 respectively. Both end up encrypted when everything works. The difference is that a STARTTLS connection has a window before the upgrade, and a client that does not require the upgrade can be talked out of it.
The pair people get wrong most often is 465 and 587 for sending mail. Both are for a client submitting a message to its own provider, both are widely supported, and configuring one when the server expects the other produces a timeout or a handshake failure rather than a helpful error. Port 25 is a third thing entirely: server-to-server transfer, and not what a client application should be using to send.
Numbers that come in pairs
| Pair | What each one is |
|---|---|
| 67 and 68 | DHCP server and client. One exchange, two numbers, both required |
| 546 and 547 | The DHCPv6 equivalents. Not 67 and 68 |
| 161 and 162 | Management polling in, notifications out — opposite directions |
| 500 and 4500 | Key exchange, and the same traffic once NAT is in the path |
| 20 and 21 | File transfer data and control, on separate connections |
| 139 and 445 | File sharing with, and without, the legacy NetBIOS layer |
Open one of a pair and the protocol half works, in a way that is often intermittent — a device that gets an address but never renews it, a manager that polls successfully but never receives an alert. When a protocol is behaving strangely rather than failing, checking whether both halves of its pair are handled is a cheap early step.
The convention is not enforced
Nothing in TCP or UDP ties a number to a protocol. A registered number is documentation. Anything can listen on any port, a great deal of software is deliberately moved off its default, and a number of protocols end up tunnelled over 443 because that is what tends to get through. It follows that reading a port number tells you what is conventional, not what is true on a particular machine. Answering what is actually listening requires access to that machine and the authority to ask it — this page has neither and does not pretend to.
What a port number does not tell you
A port being reachable is not a defect and a port being closed is not a protection. Whether a listening service is appropriate depends on what it is, who can reach it, how it authenticates, and what it is for — none of which is visible in a number. This page is a naming reference: it converts between a number and the protocol conventionally associated with it, offline, from a fixed table, and it makes no assessment of any configuration. It performs no scan, opens no connection and reaches nothing. For the protocol layer above, the HTTP status code reference and the header explainer cover what travels once a connection exists, and the wireless guide covers the link underneath it.
Questions people ask
What is the difference between port 465 and port 587?
Both carry mail submitted by a client to its own provider. On 465 the connection is encrypted from the first byte — implicit TLS. On 587 the connection opens in plaintext and is upgraded by a STARTTLS command. Providers support one, the other, or both, and there is no way to tell from the number alone which yours wants. Port 25 is neither of these: it is server-to-server transfer, and many networks do not carry client traffic to it at all.
Why does my outbound connection use a port in the 50000s?
Because that is the dynamic range, and the operating system picks a number from it for the client end of every outbound connection. The number is arbitrary, unique for the duration of the connection, and released afterwards. It is what lets one machine hold many simultaneous connections to the same server on the same port — the four-part combination of both addresses and both ports is what distinguishes them.
Is a port number the same on TCP and UDP?
The registry usually assigns both to the same service, but they are separate spaces and a machine can have entirely different things listening on the two. DNS genuinely uses both on 53: queries over UDP, and TCP for responses too large for one datagram and for zone transfers. Blocking the TCP half of 53 on the assumption that DNS is a UDP protocol is a long-standing source of failures that appear only for large answers.
Can I run a service on a port that belongs to something else?
Yes. Nothing enforces the assignment — it is a convention so that clients know where to look by default. Moving a service to a non-standard number means every client has to be told the new one, and it does not make the service any more or less exposed to whoever can reach it. It is a configuration choice, and it is worth documenting somewhere other than in the memory of whoever made it.
Does this tool check whether a port is open?
No, and it deliberately cannot. Everything here reads from a fixed table inside the page; no connection is opened, nothing is probed, and no traffic leaves the browser. It answers what a number is conventionally for, not what any machine is doing. Finding out what is listening on a host means asking that host, from a position of authority over it, with a tool built for the job.