• Share
  • Email
  • Embed
  • Like
  • Save
  • Private Content

Loading…

Flash Player 9 (or above) is needed to view presentations.
We have detected that you do not have it on your computer. To install it, go here.

Like this document? Why not share!

RAZORPOINT TCP/UDP PORTS LIST

on

  • 2,115 views

A comprehensive list of TCP/IP ports (TCP and UDP), including both legitimate and illegitimate (hacker/cracker) ports.

A comprehensive list of TCP/IP ports (TCP and UDP), including both legitimate and illegitimate (hacker/cracker) ports.

Statistics

Views

Total Views
2,115
Views on SlideShare
2,111
Embed Views
4

Actions

Likes
0
Downloads
10
Comments
0

1 Embed 4

http://www.techgig.com 4

Accessibility

Categories

Upload Details

Uploaded via as Adobe PDF

Usage Rights

© All Rights Reserved

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Processing…
Post Comment
Edit your comment

    RAZORPOINT TCP/UDP PORTS LIST RAZORPOINT TCP/UDP PORTS LIST Document Transcript

    • [ WHITE PAPER ] ™ TCP/IP Ports List Author: Razorpoint Security Team Version: 1.6 Date of current version: 2006-05/22 Date of original version: 2001-04/10 Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • ™ Table of Contents. TCP/IP Ports List .......................................................................................................................................... 1 Valid Ports ..................................................................................................................................................... 2 Trojan / Backdoor Ports ................................................................................................................................... 24 May 22, 2006 TCP/IP Ports List [v1.6] 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • ™ TCP/IP Ports List TCP/IP (Transmission Control Protocol / Internet Protocol) is the primary packet type on the Internet. It uses an assigned list of ports (numbered services used to accept connections) for valid Internet services. This TCP/IP ports list covers both TCP and UDP (Universal Datagram Packet) port assignments used by authorized services like email (SMTP), news (NNTP), and the World Wide Web (HTTP), in addition to illegitimate hacker/cracker backdoor, or trojan, ports. Authorized (legitimate) port numbers are divided into three ranges: the Well Known Ports, the Registered Ports, and the Dynamic and/or Private Ports. Well Known Ports are those from 0 through 1023, Registered Ports are those from 1024 through 49151, and the Dynamic and/or Private Ports are those from 49152 through 65535. The Well Known Ports are assigned by the IANA (Internet Assigned Numbers Authority) and on most systems can only be used by system (root level) processes or by programs executed by privileged users. Ports for the TCP are defined in RFC 793, and ports for the UDP are defined in RFC 768. Where ever possible, port assignments are the same for TCP and UDP packet types. Razorpoint Security Technologies, Inc. continues to update this list on a regular basis and attempts to keep it as one of the most comprehensive TCP/IP ports list available. This list contains TCP/IP ports used by most operating systems and network technologies, including: Sun Solaris, Linux, BSD Unix (MacOS X, OpenBSD, FreeBSD, NetBSD, etc.), Windows, Cisco, Nortel and 3Com. For more information, please contact Razorpoint Security Technologies, Inc. at (www.razorpointsecurity.com). May 22, 2006 TCP/IP Ports List [v1.6] Page 1 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • Valid TCP/IP Ports Service Name TCP Port UDP Port Description <reserved> 0 0 Reserved tcpmux 1 1 TCP Port Service Multiplexer (RFC-1078) compressnet 2 2 Management Utility compressnet 3 3 Compression Process <unassigned> 4 4 Unassigned rje 5 5 Remote Job Entry <unassigned> 6 6 Unassigned echo 7 7 discard 9 9 sink null <unassigned> 10 10 Unassigned systat 11 11 Active Users <unassigned> 12 12 Unassigned daytime 13 13 Daytime (RFC 867) <unassigned> 14 14 Unassigned <unassigned> 15 15 Unassigned <formerly netstat> <unassigned> 16 16 Unassigned qotd 17 17 Quote of the Day msp 18 18 Message Send Protocol chargen 19 19 Character Generator FTP-data 20 20 File Transfer [Default Data] FTP 21 21 File Transfer [Control] SSH 22 22 Secure Shell (ssh / scp) Telnet 23 23 priv-mail 24 24 Any private mail system SMTP 25 25 Simple Mail Transfer Protocol <unassigned> 26 26 Unassigned nsw-fe 27 27 NSW User System FE msg-icp 29 29 MSG ICP msg-auth 31 31 MSG Authentication <unassigned> 32 32 Unassigned dsp 33 33 Display Support Protocol <unassigned> 34 34 Unassigned priv-print 35 35 any private printer server time 37 37 timserver rap 38 38 Route Access Protocol rlp 39 39 Resource Location Protocol <unassigned> 40 40 Unassigned graphics 41 41 Graphics nameserver 42 42 Host Name Server nicname 43 43 Who Is mpm-flags 44 44 MPM FLAGS Protocol mpm 45 45 Msg Processing Module [recv] mpm-snd 46 46 MPM [default send] ni-ftp 47 47 NI FTP auditd 48 48 Digital Audit Daemon tacacs 49 49 Login Host Protocol (TACACS) re-mail-ck 50 50 Remote Mail Checking Protocol la-maint 51 51 IMP Logical Address Maintenance xns-time 52 52 XNS Time Protocol domain 53 53 Domain Name Server xns-ch 54 54 XNS Clearinghouse isi-gl 55 55 ISI Graphics Language xns-auth 56 56 XNS Authentication MTP 57 57 Any private terminal access xns-mail 58 58 XNS Mail priv-file 59 59 any private file service <unassigned> 60 60 Unassigned ni-mail 61 61 NI MAIL acas 62 62 ACA Services May 22, 2006 TCP/IP Ports List [v1.6] Page 2 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • whois 63 63 Whois++ VIA Systems - FTP covia 64 64 Communications Integrator (CI) tacacs-ds 65 65 TACACS-Database Service sql*net 66 66 Oracle SQL*NET bootps 67 Bootstrap Protocol Server bootpc 68 Bootstrap Protocol Client tftp 69 Trivial File Transfer gopher 70 70 netrjs-1 71 71 Remote Job Service netrjs-2 72 72 Remote Job Service netrjs-3 73 73 Remote Job Service netrjs-4 74 74 Remote Job Service priv-dial 75 75 Any private dial out service deos 76 76 Distributed External Object Store priv-rje 77 77 any private RJE service, netjrs vettcp 78 finger 79 http 80 World Wide Web HTTP hosts2-ns 81 81 HOSTS2 Name Server xfer 82 82 XFER Utility mit-ml-dev 83 83 MIT ML Device ctf 84 84 Common Trace Facility mit-ml-dev 85 85 MIT ML Device mfcobol 86 86 Micro Focus Cobol priv-term-l 87 any private terminal link, ttylink kerberos-sec 88 88 Kerberos (v5) su-mit-tg 89 89 SU/MIT Telnet Gateway dnsix 90 90 DNSIX Securit Attribute Token Map mit-dov 91 91 MIT Dover Spooler npp 92 Network Printing Protocol dcp 93 Device Control Protocol objcall 94 Tivoli Object Dispatcher supdup 95 BSD supdupd dixie 96 96 DIXIE Protocol Specification swift-rvf 97 Swift Remote Virtural File Protocol linuxconf 98 linuxconf 98 TAC News metagram 99 Metagram Relay irc 100 Internet Relay Chat hostname 101 hostnames NIC Host Name Server Internet Relay Chat iso-tsap 102 tsap ISO-TSAP Class 0 gppitnp 103 Genesis Point-to-Point Trans Net, or x400 ISO Email acr-nema 104 ACR-NEMA Digital Imag. & Comm. 300 csnet-ns 105 Mailbox Name Nameserver pop3pw 106 Eudora compatible PW changer 106 3Com TSMux rtelnet 107 Remote Telnet snagas 108 SNA Gateway Access Server pop-2 109 PostOffice V.2 pop-3 110 PostOffice V.3 Internet Relay Chat (Fserve) sunrpc 111 portmapper, rpcbind Internet Relay Chat (Fserve) mcidas 112 McIDAS Data Transmission Protocol auth 113 ident, tap, Authentication Service Internet Relay Chat (DCC) irc 113 Internet Relay Chat (Ident) audionews 114 Audio News Multicast sftp 115 Secure File Transfer Protocol ansanotify 116 ANSA REX Notify uucp-path 117 UUCP Path Service May 22, 2006 TCP/IP Ports List [v1.6] Page 3 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • sqlserv 118 SQL Services nntp 119 Network News Transfer Protocol irc 120 Internet Relay Chat (Send) erpc 121 Encore Expedited Remote Pro.Call Internet Relay Chat (Send) smakynet 122 ntp 123 123 Network Time Protocol ansatrader 124 ANSA REX Trader ansatrader 124 ANSA REX Trader locus-map 125 Locus PC-Interface Net Map Ser locus-map 125 Locus PC-Interface Net Map Ser unitary 126 Unisys Unitary Login locus-con 127 Locus PC-Interface Conn Server gss-xlicen 128 GSS X License Verification pwdgen 129 Password Generator Protocol cisco-fna 130 cisco FNATIVE Internet Relay Chat (Get) cisco-tna 131 cisco TNATIVE Internet Relay Chat (Get) cisco-sys 132 cisco SYSMAINT Internet Relay Chat (Get) statsrv 133 Statistics Service ingres-net 134 INGRES-NET Service loc-srv 135 NCS local location broker profile 136 PROFILE Naming System netbios-ns 137 137 NETBIOS Name Service netbios-dgm 138 138 NETBIOS Datagram Service netbios-ssn 139 139 NETBIOS Session Service emfis-data 140 EMFIS Data Service emfis-cntl 141 EMFIS Control Service bl-idm 142 Britton-Lee IDM imap2 143 Inernet Mail Access Protocol v2 news 144 NewS window system uaac 145 UAAC Protocol iso-tp0 146 iso-ip 147 cronus 148 CRONUS-SUPPORT aed-512 149 AED 512 Emulation Service sql-net 150 hems 151 bftp 152 Background File Transfer Program sgmp 153 netsc-prod 154 netsc-dev 155 sqlsrv 156 SQL Service knet-cmp 157 KNET/VM Command/Message Protocol pcmail-srv 158 PCMail Server nss-routing 159 sgmp-traps 160 snmp 161 Simple Network Management Protocol snmptrap 162 snmp-trap cmip-man 163 CMIP Manager smip-agent 164 CMIP Agent xns-courier 165 Xerox s-net 166 Sirius Systems namp 167 namp 167 rsvd 168 rsvd 168 send 169 print-srv 170 Network PostScript multiplex 171 Network Innovations Multiplex cl-1 172 Network Innovations CL/1 xyplex-mux 173 mailq 174 May 22, 2006 TCP/IP Ports List [v1.6] Page 4 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • vmnet 175 genrad-mux 176 xdmcp 177 X Display Manager Control Protocol nextstep 178 NextStep Window Server bgp 179 Border Gateway Protocol ris 180 Intergraph unify 181 audit 182 Unisys Audit SITP ocbinder 183 ocserver 184 remote-kis 185 kis 186 KIS Protocol aci 187 Application Communication Interface mumps 188 Plus Fives MUMPS qft 189 Queued File Transport gacp 190 Gateway Access Control Protocol prospero 191 Prospero Directory Service osu-nms 192 OSU Network Monitoring System srmp 193 Spider Remote Monitoring Protocol irc 194 Internet Relay Chat dn6-nlm-aud 195 DNSIX Network Level Module Audit dn6-smm-red 196 DNSIX Session Mgt Module Audit Redir dls 197 Directory Location Service dls-mon 198 Directory Location Service Monitor smux 199 SNMP Unix Multiplexer src 200 IBM System Resource Controller at-rtmp 201 AppleTalk Routing Maintenance at-nbp 202 AppleTalk Name Binding at-3 203 AppleTalk Unused at-echo 204 AppleTalk Echo at-5 205 AppleTalk Unused at-zis 206 AppleTalk Zone Information at-7 207 AppleTalk Unused at-8 208 AppleTalk Unused tam 209 Trivial Authenticated Mail Protocol z39.50 210 wais, ANSI Z39.50 914c-g 211 Texas Instruments 914C/G Terminal anet 212 ATEXSSTR ipx 213 vmpwscs 214 softpc 215 Insignia Solutions atls 216 Access Technology License Server dbase 217 dBASE Unix mpp 218 Netix Message Posting Protocol uarps 219 Unisys ARPs imap3 220 Interactive Mail Access Protocol v3 fln-spx 221 Berkeley rlogind with SPX auth rsh-spx 222 Berkeley rshd with SPX auth cdc 223 Certificate Distribution Center masqdialer 224 224 Masqdialer direct 242 sur-meas 243 Survey Measurement dayna 244 link 245 dsp3270 246 Display Systems Protocol subntbcst_tftp 247 bhfhs 248 rap 256 set 257 secure electronic transaction yak-chat 258 yak winsock personal chat fw1-vpn 259 Check Point FireWall-1/VPN-1 Secure Port openport 260 nsiiops 261 iiop name service over tls/ssl arcisdms 262 May 22, 2006 TCP/IP Ports List [v1.6] Page 5 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • hdap 263 bgmp 264 x-bone-ctl 265 265 X-Bone CTL mom 270 http://www.Microsoft.com/mom/ http-mgmt 280 280 personal-link 281 cableport-ax 282 cable port a/x fxp 286 286 FXP Communication novastorbakcup 308 novastor backup entrusttime 309 bhmds 310 bhmds 310 asip-webadmin 311 appleshare ip webadmin vslmp 312 magenta-logic 313 opalis-robot 314 dpsi 315 decauth 316 zannet 317 pkix-timestamp 318 318 PKIX Timestamp pip 321 rtsps 322 322 RTSPS pdap 344 Prospero Data Access Protocol pawserv 345 Perf Analysis Workbench zserv 346 Zebra server fatserv 347 Fatmen Server csi-sgwp 348 Cabletron Management Protocol mftp 349 matip-type-a 350 MATIP Type A matip-type-b 351 MATIP Type B or bhoetty dtag-ste-sb 352 DTAG, or bhoedap4 ndsauth 353 bh611 354 datex-asn 355 cloanto-net-1 356 Cloanto Net 1 bhevent 357 shrinkwrap 358 tenebris_nts 359 Tenebris Network Trace Service scoi2odialog 360 semantix 361 srssend 362 SRS Send rsvp_tunnel 363 aurora-cmgr 364 dtk 365 Deception Tool Kit (lame -- see www.all.net) odmr 366 mortgageware 367 qbikgdp 368 rpc2portmap 369 codaauth2 370 clearcase 371 ulistserv 372 Unix Listserv legent-1 373 Legent Corporation (Computer Associates) legent-1 373 Legent Corporation (Computer Associates) legent-2 374 Legent Corporation (Computer Associates) hassle 375 nip 376 Amiga Envoy Network Inquiry Proto tnETOS 377 NEC Corporation dsETOS 378 NEC Corporation is99c 379 TIA/EIA/IS-99 modem client is99s 380 TIA/EIA/IS-99 modem server hp-collector 381 hp performance data collector hp-managed-node 382 hp performance data managed node hp-alarm-mgr 383 hp performance data alarm manager arns 384 A Remote Network Server System ibm-app 385 IBM Application May 22, 2006 TCP/IP Ports List [v1.6] Page 6 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • asa 386 ASA Message Router Object Def. aurp 387 Appletalk Update-Based Routing Pro. unidata-ldm 388 Unidata LDM Version 4 ldap 389 Lightweight Directory Access Protocol uis 390 synotics-relay 391 SynOptics SNMP Relay Port synotics-broker 392 SynOptics Port Broker Port dis 393 Data Interpretation System embl-ndt 394 EMBL Nucleic Data Transfer netcp 395 NETscout Control Protocol netware-ip 396 Novell Netware over IP mptn 397 Multi Protocol Trans. Net. kryptolan 398 iso-tsap-c2 399 ISO-TSAP Class 2 work-sol 400 Workstation Solutions ups 401 Uninterruptible Power Supply genie 402 Genie Protocol decap 403 nced 404 ncld 405 imsp 406 Interactive Mail Support Protocol timbuktu 407 prm-sm 408 Prospero Resource Manager Sys. Man. prm-nm 409 Prospero Resource Manager Node Man. decladebug 410 DECLadebug Remote Debug Protocol rmt 411 Remote MT Protocol synoptics-trap 412 Trap Convention Port smsp 413 infoseek 414 bnet 415 silverplatter 416 onmux 417 hyper-g 418 ariel1 419 smpte 420 ariel2 421 ariel3 422 opc-job-start 423 IBM Operations Planning and Control Start opc-job-track 424 IBM Operations Planning and Control Track icad-el 425 smartsdp 426 svrloc 427 Server Location ocs_cmu 428 ocs_amu 429 utmpsd 430 utmpcd 431 iasd 432 nnsp 433 Usenet, Network News Transfer mobileip-agent 434 mobilip-mn 435 dna-cml 436 comscm 437 dsfgw 438 dasp 439 sgcp 440 decvms-sysmgt 441 cvc_hostd 442 https 443 secure http (SSL) snpp 444 Simple Network Paging Protocol microsoft-ds 445 ddm-rdb 446 ddm-dfm 447 ddm-ssl 448 ddm-byte as-servermap 449 AS Server Mapper May 22, 2006 TCP/IP Ports List [v1.6] Page 7 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • tserver 450 sfs-smp-net 451 Cray Network Semaphore server sfs-config 452 Cray SFS config server creativeserver 453 contentserver 454 creativepartnr 455 macon-tcp 456 scohelp 457 appleqtc 458 apple quick time ampr-rcmd 459 skronk 460 datasurfsrv 461 datasurfsrvsec 462 alpes 463 kpasswd5 464 Kerberos (v5) smtps 465 smtp protocol over TLS/SSL (was ssmtp) digital-vrc 466 mylex-mapd 467 photuris 468 Photuris Key Management rcp 469 Radio Control Protocol scx-proxy 470 mondex 471 ljk-login 472 hybrid-pop 473 tn-tl-w1 474 tcpnethaspsrv 475 tn-tl-fd1 476 ss7ns 477 spsc 478 iafserver 479 loadsrv 480 iafdbase 480 dvs 481 ph 481 bgs-nsi 482 xlog 482 ulpnet 483 integra-sme 484 Integra Software Management Environment powerburst 485 Air Soft Power Burst sstats 486 avian 486 saft 487 saft Simple Asynchronous File Transfer gss-http 488 nest-protocol 489 micom-pfs 490 go-login 491 ticf-1 492 Transport Independent Convergence for FNA ticf-2 493 Transport Independent Convergence for FNA pov-ray 494 intecourier 495 pim-rp-disc 496 Dantz Retrospect 497 MacOS Backup Software System siam 498 iso-ill 499 ISO ILL Protocol isakmp 500 ISA/KMP Encryption Key Exchange 500 Baynetworks VPN stmf 501 asa-appl-proto 502 intrinsa 503 citadel 504 mailbox-lm 505 ohimsrv 506 crs 507 xvttp 508 snare 509 May 22, 2006 TCP/IP Ports List [v1.6] Page 8 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • fcp 510 FirstClass Server passgo 511 exec 512 BSD rexecd biff 512 comsat login 513 BSD rlogind who 513 BSD rwhod shell 514 BSD rshd syslog 514 BSD syslogd printer 515 spooler (lpr/lpd) videotex 516 talk 517 BSD talkd ntalk 518 (talkd) utime 519 unixtime route 520 router routed (RIP), or extended file name server ripng 521 ulp 522 ibm-db2 523 ncp 524 timed 525 timeserver tempo 526 newdate stx 527 Stock IXChange custix 528 Customer IXChange irc-serv 529 courier 530 rpc conference 531 chat netnews 532 readnews netwall 533 for emergency broadcasts mm-admin 534 MegaMedia Admin iiop 535 opalis-rdv 536 nmsp 537 Networked Media Streaming Protocol gdomap 538 apertus-ldp 539 Apertus Technologies Load Determination uucp 540 uucpd uucp-rlogin 541 commerce 542 klogin 543 Kerberos (v4/v5) AppleShare over IP kshell 544 krcmd Kerberos (v4/v5) ekshell 545 Kerberos encrypted remote shell -kfall dhcpv6-client 546 DHCPv6 Client dhcpv6-server 547 DHCPv6 Server afpovertcp 548 AFP (AppleShare) over TCP, also iDisk idfp 549 new-rwho 550 new-who cybercash 551 deviceshare 552 pirp 553 rtsp 554 Real Time Streaming Protocol dsf 555 remotefs 556 rfs, rfs_server, Brunhoff remote filesystem openvms-sysipc 557 sdnskmp 558 teedtap 559 rmonitor 560 rmonitord monitor 561 chshell 562 chcmd snews 563 NNTP over SSL 9pfs 564 Plan 9 file service whoami 565 streettalk 566 banyan-rpc 567 ms-shuttle 568 Microsoft shuttle ms-rome 569 Microsoft rome meter 570 demon May 22, 2006 TCP/IP Ports List [v1.6] Page 9 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • umeter 571 udemon sonar 572 banyan-vip 573 ftp-agent 574 FTP Software Agent System vemmi 575 ipcd 576 vnas 577 ipdd 578 decbsrv 579 sntp-heartbeat 580 bdp 581 Bundle Discovery Protocol scc-security 582 philips-vc 583 Philips Video-Conferencing keyserver 584 imap4-ssl 585 IMAP4+SSL (use port 993 instead) password-chg 586 submission 587 cal 588 eyelink 589 tns-cml 590 http-alt 591 FileMaker Pro - HTTP Alternate eudora-set 592 Eudora Settings Server http-rpc-epmap 593 HTTP RPC Ep Map tpip 594 cab-protocol 595 smsd 596 ptcnameservice 597 PTC Name Service sco-websrvrmg3 598 SCO Web Server Manager 3 acp 599 Aeolon Core Protocol ipcserver 600 Sun IPC server syslog-conn 601 601 Reliable Syslog Service xmlrpc-beep 602 602 XML-RPC over BEEP idxp 603 603 IDXP tunnel 604 604 TUNNEL soap-beep 605 605 SOAP over BEEP urm 606 Cray Unified Resource Manager nqs 607 sift-uft 608 Sender-Initiated/Unsolicited File Transfer npmp-trap 609 npmp-local 610 npmp-gui 611 sshell 614 614 SSLshell sco-inetmgr 615 615 Internet Configuration Manager sco-sysmgr 616 616 SCO System Administration Server sco-dtmgr 617 617 SCO Desktop Administration Server nlservd 617 http://www.arkeia.com cryptoadmin 624 624 Crypto Admin IMAP Admin 626 qmqp 628 Qmail Quick Mail Queueing cups 631 Common UNIX Printing System ginad 634 mount 635 NFS Mount Service ldapssl 636 LDAP over SSL pcnfs 640 PC-NFS DOS Authentication sanity 643 643 SANity ldp 646 646 LDP dhcp-failover 647 647 DHCP Failover rrp 648 NSI Registry Registrar Protocol bwnfs 650 BW-NFS DOS Authentication AppleShare IP Admin 660 AppleShare Web & File Services pftp 662 662 PFTP purenoise 663 663 PureNoise doom 666 Doom(Id Software) vpp 677 677 Virtual Presence Protocol MacOS Users & Groups 687 May 22, 2006 TCP/IP Ports List [v1.6] Page 10 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • nmap 689 689 NMAP resvc 691 Microsoft Exchange 2000 Server Routing ha-cluster 694 694 ha-cluster BuddyPhone 700 BuddyPhone Communication (No FTP) BuddyPhone 701 BuddyPhone Communication (No FTP) elcsd 704 errlog copy/server daemon entrustmanager 709 EntrustMgr - NorTel DES auth network cisco-tdp 711 711 Cisco TDP netviewdm1 729 IBM NetView DM/6000 Server/Client netviewdm2 730 IBM NetView DM/6000 send netviewdm3 731 IBM NetView DM/6000 receive sometimes-rpc2 737 Rusersd(OpenBSD) netcp 740 NETscout Control Protocol netgw 741 netrcs 742 Network based Rev. Cont. Sys. flexlm 744 Flexible License Manager fujitsu-dev 747 Fujitsu Device Control ris-cm 748 Russell Info Sci Calendar Manager kerberos-adm 749 Kerberos 5 admin/changepw kerberos 750 kdc Kerberos (v4) kerberos_master 751 Kerberos `kadmin (v4) qrh 752 rrh 753 krb_prop 754 kerberos/v5 server propagation nlogin 758 nlogin 758 con 759 krbupdate 760 kreg Kerberos (v4) registration kpasswd 761 kpwd Kerberos (v4) “passwd” quotad 762 cycleserv 763 omserv 764 webster 765 phonebook 767 phone vid 769 cadlock 770 rtip 771 cycleserv2 772 submit 773 rpasswd 774 acmaint_dbd 774 entomb 775 acmaint_transd 775 wpages 776 wpages 776 multiling-http 777 777 Multiling HTTP wpgs 780 wpgs 780 hp-collector 781 hp performance data collector hp-managed-node 782 hp performance data managed node hp-alarm-mgr 783 hp performance data alarm manager concert 786 controlit 799 mdbs_daemon 800 device 801 iscsi 860 860 iSCSI supfilesrv 871 SUP server rsync 873 Rsync server ( http://rsync.samba.org ) accessbuilder 888 Accessbuilder, or Audio CD Database samba-swat 901 Samba SWAT tool.Also used by ISS RealSecure. oftep-rpc 950 Often RPC.statd (on Redhat Linux) rndc 953 RNDC is used by BIND 9 (& probably other NS) ftps-data 989 FTP protocol (data) over TLS/SSL ftps 990 FTP protocol (control) over TLS/SSL telnets 992 Telnet protocol over TLS/SSL May 22, 2006 TCP/IP Ports List [v1.6] Page 11 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • imaps 993 IMAP4 protocol over TLS/SSL ircs 994 IRC protocol over TLS/SSL pop3s 995 POP3 protocol over TLS/SSL xtreelic 996 XTREE License Server vsinet 996 maitrd 997 busboy 998 puparp 998 garcon 999 applix 999 Applix ac cadlock 1000 silencer 1001 webex 1001 blackice-port-1002 1002 ufsd 1008 UFS-aware server sometimes-rpc1 1012 rstatd (OpenBSD) kdm 1024 K Display Manager (KDE version of xdm) Dwyco Video Conferencing (Range: 1024-5000) listen 1025 listener RFS remote_file_sharing network blackjack nterm 1026 remote_login network_terminal windows-messenger-service 1026 http://www.lurhq.com/popup_spam.html icq 1027 ICQ icq 1029 ICQ icq 1032 ICQ iad1 1030 BBN IAD iad2 1031 BBN IAD iad3 1032 BBN IAD netspy 1033 w2k-printer-port-monitor 1033 fpitp 1045 1045 Fingerprint Image Transfer Protocol wfremotertm 1046 1046 WebFilter Remote Monitor startron 1057 1057 STARTRON nim 1058 nimreg 1059 polestar 1060 1060 POLESTAR kiosk 1061 1061 KIOSK veracity 1062 1062 Veracity syscomlan 1065 1065 SYSCOMLAN instl_boots 1067 Installation Bootstrap Proto. Serv. instl_bootc 1068 Installation Bootstrap Proto. Cli. socks 1080 Socks/Wingate ansoft-lm-1 1083 Anasoft License Manager ansoft-lm-2 1084 Anasoft License Manager xaudio 1103 Xaserver # X Audio Server xrl 1104 1104 XRL kpop 1109 Pop with Kerberos nfsd-status 1110 NFS Cluster status/Keep-Alive info msql 1112 mini-sql server mini-sql 1114 1114 Mini SQL sacred 1118 1118 SACRED supfiledbg 1127 SUP debugging nfa 1155 Network File Access nfa 1155 Network File Access oracle-oms 1159 1159 Oracle OMS phone 1167 conference calling vchat 1168 1168 VChat Conference Service tripwire 1169 1169 TripWire streamingaudio 1170 1170 streamingaudio skkserv 1178 SKK (kanji input) mysql-cluster 1186 1186 MySQL Cluster Manager hp-webadmin 1188 1188 HP Web Admin openvpn 1194 1194 OpenVPN lupa 1212 May 22, 2006 TCP/IP Ports List [v1.6] Page 12 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • kazaa 1214 1214 KAZAA nerv 1222 SNI R&D network vpnz 1224 1224 VPNz dns2go 1227 1227 DNS2Go florence 1228 1228 FLORENCE periscope 1230 1230 Periscope hotline 1234 nessus 1241 nessus client-to-server port remote message server voodoo 1245 hermes 1248 emc-gateway 1273 1273 EMC-Gateway emperion 1282 1282 Emperion boomerang 1304 1304 Boomerang bmc_patroldb 1313 1313 BMC_PATROLDB alta-ana-lm 1346 Alta Analytics License Manager bbn-mmc 1347 multi media conferencing bbn-mmx 1348 multi media conferencing sbook 1349 Registration Network Protocol editbench 1350 Registration Network Protocol equationbuilder 1351 Digital Tool Works (MIT) lotusnotes 1352 Lotus Notes relief 1353 Relief Consulting relief 1353 Relief Consulting rightbrain 1354 RightBrain Software rightbrain 1354 RightBrain Software intuitive-edge 1355 Intuitive Edge cuillamartin 1356 CuillaMartin Company pegboard 1357 Electronic PegBoard connlcli 1358 ftsrv 1359 mimer 1360 linx 1361 timeflies 1362 ndm-requester 1363 Network DataMover Requester ndm-server 1364 Network DataMover Server adapt-sna 1365 Network Software Associates netware-csp 1366 Novell NetWare Comm Service Platform dcs 1367 screencast 1368 gv-us 1369 GlobalView to Unix Shell us-gv 1370 Unix Shell to GlobalView fc-cli 1371 Fujitsu Config Protocol fc-ser 1372 Fujitsu Config Protocol chromagrafx 1373 molly 1374 EPI Software Systems bytex 1375 ibm-pps 1376 IBM Person to Person Software cichlid 1377 Cichlid License Manager elan 1378 Elan License Manager dbreporter 1379 Integrity Solutions telesis-licman 1380 Telesis Network License Manager apple-licman 1381 Apple Network License Manager gwha 1383 GW Hannaway Network License Manager os-licman 1384 Objective Solutions License Manager atex_elmd 1385 Atex Publishing License Manager checksum 1386 CheckSum License Manager cadsi-lm 1387 Computer Aided Design Software Inc LM objective-dbc 1388 Objective Solutions DataBase Cache iclpv-dm 1389 Document Manager iclpv-sc 1390 Storage Controller iclpv-sas 1391 Storage Access Server iclpv-pm 1392 Print Manager iclpv-nls 1393 Network Log Server May 22, 2006 TCP/IP Ports List [v1.6] Page 13 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • iclpv-nlc 1394 Network Log Client iclpv-wsm 1395 PC Workstation Manager software dvl-activemail 1396 DVL Active Mail audio-activmail 1397 Audio Active Mail video-activmail 1398 Video Active Mail cadkey-licman 1399 Cadkey License Manager cadkey-tablet 1400 Cadkey Tablet Daemon goldleaf-licman 1401 Goldleaf License Manager prm-sm-np 1402 Prospero Resource Manager prm-nm-np 1403 Prospero Resource Manager igi-lm 1404 Infinite Graphics License Manager ibm-res 1405 IBM Remote Execution Starter netlabs-lm 1406 NetLabs License Manager dbsa-lm 1407 DBSA License Manager sophia-lm 1408 Sophia License Manager here-lm 1409 Here License Manager hiq 1410 HiQ License Manager af 1411 AudioFile innosys 1412 innosys-acl 1413 ibm-mqseries 1414 IBM MQSeries 1414 CUSeeMe Vdeo/Audio Server dbstar 1415 novell-lu6.2 1416 Novell LU6.2 timbuktu-srv1 1417 Timbuktu Service 1 Port timbuktu-srv2 1418 Timbuktu Service 2 Port timbuktu-srv3 1419 Timbuktu Service 3 Port timbuktu-srv4 1420 Timbuktu Service 4 Port gandalf-lm 1421 Gandalf License Manager autodesk-lm 1422 Autodesk License Manager essbase 1423 Essbase Arbor Software hybrid 1424 Hybrid Encryption Protocol 1424 CUSeeMe Vdeo/Audio Server zion-lm 1425 Zion Software License Manager sas-1 1426 Satellite-data Acquisition System 1 mloadd 1427 mloadd monitoring tool informatik-lm 1428 informatik License Manager nms 1429 Hypercom NMS tpdu 1430 Hypercom TPDU rgtp 1431 Reverse Gossip Transport blueberry-lm 1432 Blueberry Software License Manager ms-sql-s 1433 Microsoft-SQL-Server ms-sql-m 1434 Microsoft-SQL-Monitor ibm-cics 1435 sas-2 1436 Satellite-data Acquisition System 2 tabula 1437 eicon-server 1438 Eicon Security Agent/Server eicon-x25 1439 Eicon X25/SNA Gateway eicon-slp 1440 Eicon Service Location Protocol cadis-1 1441 Cadis License Management cadis-2 1442 Cadis License Management WebSTAR/SSL Admin 1443 4D WebStar Web Server Admin marcam-lm 1444 Marcam License Management proxima-lm 1445 Proxima License Manager ora-lm 1446 Optical Research Associates License Manager apri-lm 1447 Applied Parallel Research LM oc-lm 1448 OpenConnect License Manager peport 1449 dwf 1450 Tandem Distributed Workbench Facility infoman 1451 IBM Information Management gtegsc-lm 1452 GTE Government Systems License Man genie-lm 1453 Genie License Manager interhdl_elmd 1454 interHDL License Manager esl-lm 1455 ESL License Manager May 22, 2006 TCP/IP Ports List [v1.6] Page 14 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • dca 1456 valisys-lm 1457 Valisys License Manager nrcabq-lm 1458 Nichols Research Corp. proshare1 1459 Proshare Notebook Application proshare2 1460 Proshare Notebook Application ibm_wrless_lan 1461 IBM Wireless LAN world-lm 1462 World License Manager nucleus 1463 msl_lmd 1464 MSL License Manager pipes 1465 oceansoft-lm 1466 Ocean Software License Manager csdmbase 1467 csdm 1468 aal-lm 1469 Active Analysis Limited License Manager uaiact 1470 Universal Analytics csdmbase 1471 csdm 1472 openmath 1473 telefinder 1474 taligent-lm 1475 Taligent License Manager clvm-cfg 1476 ms-sna-server 1477 ms-sna-base 1478 dberegister 1479 pacerforum 1480 airs 1481 miteksys-lm 1482 Miteksys License Manager afs 1483 AFS License Manager confluent 1484 Confluent License Manager lansource 1485 nms_topo_serv 1486 localinfosrvr 1487 docstor 1488 dmdocbroker 1489 insitu-conf 1490 anynetgateway 1491 stone-design-1 1492 netmap_lm 1493 citrix-ica 1494 Citrix MetaFrame cvc 1495 liberty-lm 1496 rfx-lm 1497 watcom-sql 1498 fhc 1499 Federico Heinz Consultora vlsi-lm 1500 VLSI License Manager sas-3 1501 Satellite-data Acquisition System 3 shivadiscovery 1502 Shiva imtc-mcs 1503 Databeam evb-elm 1504 EVB Software Engineering License Manager funkproxy 1505 Funk Software, Inc. utcd 1506 Universal Time daemon (utcd) symplex 1507 diagmond 1508 robcad-lm 1509 Robcad, Ltd. License Manager mvx-lm 1510 Midland Valley Exploration Ltd. License Mgr 3l-l1 1511 wins 1512 Microsofts Windows Internet Name Service fujitsu-dtc 1513 Fujitsu Systems Business of America, Inc fujitsu-dtcns 1514 Fujitsu Systems Business of America, Inc ifor-protocol 1515 vpad 1516 Virtual Places Audio data vpac 1517 Virtual Places Audio control vpvd 1518 Virtual Places Video data vpvc 1519 Virtual Places Video control May 22, 2006 TCP/IP Ports List [v1.6] Page 15 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • atm-zip-office 1520 atm zip office oracle-sql 1521 Oracle SQLNet nCube License Manager rna-lm 1522 Ricardo North America License Manager cichild-lm 1523 ingreslock 1524 ingres pdap 1525 Prospero pdap-np 1526 Prospero Data Access Prot non-priv tlisrv 1527 Oracle mciautoreg 1528 coauthor 1529 Oracle rap-service 1530 rap-listen 1531 miroconnect 1532 virtual-places 1533 Virtual Places Software micromuse-lm 1534 ampr-info 1535 ampr-inter 1536 sdsc-lm 1537 3ds-lm 1538 intellistor-lm 1539 Intellistor License Manager rds 1540 rds2 1541 gridgen-elmd 1542 simba-cs 1543 aspeclmd 1544 vistium-share 1545 abbaccuray 1546 laplink 1547 axon-lm 1548 Axon License Manager shivasound 1549 Shiva Sound 3m-image-lm 1550 Image Storage license manager 3M Company hecmtl-db 1551 pciarray 1552 livelan 1555 1555 livelan veritas_pbx 1556 1556 Veritas Private Branch Exchange web2host 1559 1559 web2host ets 1569 1569 ets orbixd 1570 1570 orbixd oraclenames 1575 1575 oraclenames simbaexpress 1583 1583 simbaexpress dialpad 1584 Dialpad dialpad 1585 Dialpad issd 1600 citrix-ica 1604 Citrix ICA, MS Terminal Server skytelnet 1618 1618 skytelnet softdataphone 1621 1621 softdataphone ontime 1622 1622 ontime radius 1645 radius authentication radacct 1646 radius accounting kermit 1649 1649 kermit nkd 1650 shiva_confsrvr 1651 xnmp 1652 netview-aix-1 1661 netview-aix-2 1662 netview-aix-3 1663 netview-aix-4 1664 netview-aix-5 1665 netview-aix-6 1666 netview-aix-7 1667 netview-aix-8 1668 netview-aix-9 1669 netview-aix-10 1670 May 22, 2006 TCP/IP Ports List [v1.6] Page 16 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • netview-aix-11 1671 netview-aix-12 1672 groupwise 1677 1677 groupwise prolink 1678 1678 prolink carboncopy 1680 CarbonCopy Server snaresecure 1684 1684 SnareSecure groupwise 1686 1686 http://www.Novell.com/products/groupwise/ cuseeme 1720 CUSeeMe Vdeo/Audio Server H.323/Q.931 pptp 1723 Point-to-Point Tunnelling Protocol wm-asf 1755 Windows Media (.asf) tftp-multi 1758 TFTP Multicast radius 1812 RADIUS authentication protocol (RFC 2138) 1812 CUSeeMe Vdeo/Audio Server radacct 1813 RADIUS accounting protocol (RFC 2139) 1813 CUSeeMe Vdeo/Audio Server pcm 1827 PCM Agent (AutoSecure Policy Compliance Mgr) sugp 1905 1905 Secure UP.Link Gateway Protocol licensedaemon 1986 cisco license management tr-rsrb-p1 1987 cisco RSRB Priority 1 port tr-rsrb-p2 1988 cisco RSRB Priority 2 port tr-rsrb-p3 1989 cisco RSRB Priority 3 port stun-p1 1990 cisco STUN Priority 1 port stun-p2 1991 cisco STUN Priority 2 port stun-p3 1992 cisco STUN Priority 3 port snmp-tcp-port 1993 cisco SNMP TCP port stun-port 1994 cisco serial tunnel port perf-port 1995 cisco perf port tr-rsrb-port 1996 cisco Remote SRB port gdp-port 1997 cisco Gateway Discovery Protocol x25-svc-port 1998 cisco X.25 service (XOT) tcp-id-port 1999 cisco identification port callbook 2000 wizard 2001 curry globe 2002 cfingerd 2003 GNU finger mailbox 2004 emce 2004 CCWS mm conf deslogin 2005 encrypted symmetric telnet/login oracle 2005 invokator 2006 raid-cc 2006 raid dectalk 2007 raid-am 2007 conf 2008 terminaldb 2008 news 2009 whosockami 2009 search 2010 or, nfr411 pipe_server 2010 raid-cc 2011 raid servserv 2011 ttyinfo 2012 raid-ac 2012 raid-am 2013 raid-cd 2013 troff 2014 raid-sf 2014 cypress 2015 raid-cs 2015 bootserver 2016 bootserver 2016 cypress-stat 2017 bootclient 2017 May 22, 2006 TCP/IP Ports List [v1.6] Page 17 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • terminaldb 2018 rellpack 2018 whosockami 2019 about 2019 xinupageserver 2020 servexec 2021 xinuexpansion1 2021 xinuexpansion2 2022 xinuexpansion3 2023 xinuexpansion4 2024 ellpack 2025 xribs 2025 scrabble 2026 shadowserver 2027 submitserver 2028 device2 2030 blackboard 2032 glogger 2033 scoremgr 2034 imsldoc 2035 objectmanager 2038 lam 2040 interbase 2041 isis 2042 isis-bcast 2043 rimsl 2044 cdfunc 2045 sdfunc 2046 dls 2047 dls-monitor 2048 nfs 2049 Network File System distrib-net-rsa 2064 distributed.net RSA crypto decipher tool dlsrpn 2065 Data Link Switch Read Port Number dlswpn 2067 Data Link Switch Write Port Number go2call 2090 2090 Go2Call go2call 2091 Go2Call zephyr-clt 2103 Zephyr serv-hm connection zephyr-hm 2104 Zephyr hostmanager eklogin 2105 Kerberos (v4) encrypted rlogin ekshell 2106 Kerberos (v4) encrypted rshell rkinit 2108 Kerberos (v4) remote initialization kx 2111 X over kerberos kip 2112 IP over kerberos kauth 2120 Remote kauth ats 2201 Advanced Training System Program ivs-video 2232 IVS Video default shiva-vpn 2233 ivsd 2241 IVS Daemon mysql-im 2273 2273 MySql Instance Manager compaqdiag 2301 Compaq Insight Management Web Agents pehelp 2307 netscape-conf 2327 Netscape Conference apple-ug 2336 Apple UG Control ms-olap3 2382 2382 Microsoft OLAP ms-olap4 2383 2383 Microsoft OLAP fmpro-fdal 2399 2399 Filemaker, Inc. -- Data Access Layer cvspserver 2401 CVS network server g-talk 2421 2421 G-Talk venus 2430 venus-se 2431 codasrv 2432 codasrv-se 2433 rtsserv 2500 Resource Tracking system server rtsclient 2501 Resource Tracking system client wlbs 2504 May 22, 2006 TCP/IP Ports List [v1.6] Page 18 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • citrixima 2512 2512 Citrix IMA hp-3000-telnet 2564 HP 3000 NS/VT block mode telnet zebrasrv 2600 zebra service zebra 2601 zebra vty ripd 2602 RIPd vty ripngd 2603 RIPngd vty ospfd 2604 OSPFd vty bgpd 2605 BGPd vty webster 2627 Network dictionary sybase 2638 Sybase database cp-udp-encap 2746 Check Point UDP Encapsulation listen 2766 System V listener port iss-realsec 2998 ISS RealSecure IDS Remote Console Admin port active-ppp 3000 Active Worlds Msging Deerfield MDaemon Email Server User-level ppp daemon 3000 Calista IP Phone (Inbound) nessusd 3001 Nessus Security Scanner Daemon Deerfield MDaemon Email Server deslogin 3005 Encrypted symmetric telnet/login deslogind 3006 Program Linking 3031 MacOS Apple Events / AgentVU cfs 3049 cryptographic file system (nfs) distrib-net-proxy 3064 proxy port (distributed.net) sj3 3086 SJ3 (kanji input) squid-http 3128 squid-ipc 3130 vmodem 3141 viavideo 3230 3230 Polycom ViaVideo (H.323) viavideo 3231 3231 Polycom ViaVideo (H.323) viavideo 3232 3232 Polycom ViaVideo (H.323) viavideo 3233 3233 Polycom ViaVideo (H.323) viavideo 3234 3234 Polycom ViaVideo (H.323) viavideo 3235 3235 Polycom ViaVideo (H.323) ccmail 3264 cc:Mail/Lotus MacOS Net Assistant 3283 mysql 3306 mySQL dec-notes 3333 DEC Notes msrdp 3389 Microsoft Remote Display (Terminal) Protocol bmap 3421 Bull Apprise portmapper bungie-myth 3453 Bungie Myth and Myth II Server prsvp 3455 RSVP Port vat 3456 VAT default data vat-control 3457 VAT default control track 3462 software distribution udt_os 3900 Unidata UDT OS mapper-nodemgr 3984 MAPPER network node manager mapper-mapethd 3985 MAPPER TCP/IP server mapper-ws_ethd 3986 MAPPER workstation server netcheque 4008 NetCheque accounting lockd 4045 NFS lock daemon/manager aol-aim-2 4099 AOL Instant Messanger (Outbound) nuts_dem 4132 NUTS Daemon nuts_bootp 4133 NUTS Bootp Server wincim 4144 Windows Compuserve Protocol EIMS Admin 4199 rwhois 4321 Remote Who Is msql 4333 mini-sql server unicall 4343 krb524 4444 Kerberos v5 -> v4 ticket translator sae-urn 4500 fax 4557 FlexFax FAX transmission service hylafax 4559 HylaFAX client-server protocol rfa 4672 Remote file access server May 22, 2006 TCP/IP Ports List [v1.6] Page 19 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • commplex-main 5000 Yahoo Messenger Chat Free Internet Chess Server commplex-link 5001 Yahoo Messenger Chat rfe 5002 Radio Free Ethernet FileMaker Pro 5003 5003 FileMaker Pro over IP telelpathstart 5010 telelpathattack 5011 mmcc 5050 multimedia conference control tool rmonitor_secure 5145 RMonitor Secure aol-aim-1 5190 AOL Instant Messanger (Inbound) Calista IP Phone (Outbound) aol-1 5191 AmericaOnline1 aol-2 5192 AmericaOnline2 aol-3 5193 AmericaOnline3 sgi-dgl 5232 SGI Distributed Graphics padl2sim 5236 hacl-hb 5300 HA cluster heartbeat hacl-gs 5301 HA cluster general services hacl-cfg 5302 HA cluster configuration hacl-probe 5303 HA cluster probing hacl-local 5304 hacl-test 5305 cfengine 5308 pcduo-old 5400 RemCon PC-Duo - old port pcduo 5405 RemCon PC-Duo - new port postgres 5432 postgres database server hotline 5499 Hotline Server securid 5500 SecurID VNC Server Hotline Server hotline 5501 Hotline Server hotline 5502 Hotline Server hotline 5503 Hotline Server secureidprop 5510 SecurID ACE/Server services sdlog 5520 SecurID ACE/Server services sdserv 5530 SecurID ACE/Server services sdxauthd 5540 SecurID ACE/Server services sdadmind 5550 SecurID ACE/Server services rplay 5555 pcAnywhereData 5631 pcAnywhereStat 5632 active-worlds 5670 Active Worlds Messaging & Conferencing canna 5680 Canna (Japanese Input) proshareaudio 5713 proshare conf audio prosharevideo 5714 proshare conf video prosharedata 5715 proshare conf data prosharerequest 5716 proshare conf request prosharenotify 5717 proshare conf notify vnc 5800 Virtual Network Computer vnc 5801 Virtual Network Computer vnc 5900 Virtual Network Computer vnc-1 5901 Virtual Network Computer Display :1 vnc-2 5902 Virtual Network Computer Display :2 ncd-pref-tcp 5977 NCD preferences tcp port ncd-diag-tcp 5978 NCD diagnostic tcp port ncd-conf-tcp 5979 NCD configuration tcp port ncd-pref 5997 NCD preferences telnet port ncd-diag 5998 NCD diagnostic telnet port ncd-conf 5999 NCD configuration telnet port X11 6000 X Window server X11:1 6001 X Window server X11:2 6002 X Window server May 22, 2006 TCP/IP Ports List [v1.6] Page 20 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • X11:3 6003 X Window server X11:4 6004 X Window server X11:5 6005 X Window server X11:6 6006 X Window server X11:7 6007 X Window server X11:8 6008 X Window server X11:9 6009 X Window server arcserve 6050 ARCserve agent isdninfo 6105 isdninfo isdninfo 6106 i4lmond softcm 6110 HP SoftBench CM spc 6111 HP SoftBench Sub-Process Control dtspc 6112 CDE subprocess control meta-corp 6141 Meta Corporation License Manager aspentec-lm 6142 Aspen Technology License Manager watershed-lm 6143 Watershed License Manager statsci1-lm 6144 StatSci License Manager - 1 statsci2-lm 6145 StatSci License Manager - 2 lonewolf-lm 6146 Lone Wolf Systems License Manager montage-lm 6147 Montage License Manager ricardo-lm 6148 Ricardo North America License Manager gnutella 6346 6346 GNUtella Peer-to-Peer File Sharing System netop-rc 6502 NetOp Remote Control (by Danware Data A/S) xdsxdm 6558 irc-serv 6666 internet relay chat server irc 6667 Internet Relay Chat irc 6668 Internet Relay Chat napster 6699 Napster Music Sharing System acmsoda 6969 napster 6699 Napster file (MP3) sharing software quicktime 6970 6970 QuickTime Server (UDP Range: 6970-7000) RealMedia Server (UDP Range: 6970-7170) dwyco-video 6700 Dwyco Video Conferencing dwyco-video 6701 Dwyco Video Conferencing dwyco-video 6702 Dwyco Video Conferencing net2phone 6801 Net2Phone net2phone 6802 Net2Phone net2phone 6803 Net2Phone dwyco-video 6880 Dwyco Video Conferencing afs3-fileserver 7000 afs file server Internet Relay Chat ActiveWorlds (Range: 7000-7100) afs3-callback 7001 callbacks to cache managers afs3-prserver 7002 users & groups database afs3-vlserver 7003 volume location database afs3-kaserver 7004 AFS/Kerberos authentication service afs3-volser 7005 volume managment server afs3-errors 7006 error interpretation service afs3-bos 7007 basic overseer process afs3-update 7008 server-to-server updater afs3-rmtsys 7009 remote cache manager service ups-onlinet 7010 onlinet uninterruptable power supplies realmedia 7070 RealMedia (Audio/Video) font-service 7100 X Font Service dialpad 7175 Dialpad fodms 7200 FODMS FLIP dlip 7201 icb 7326 Internet Citizens Band qaz 7597 Quaz trojan worm CUSeeMe 7640 CUSeeMe Video/Audio Server CUSeeMe 7642 CUSeeMe Video/Audio Server CUSeeMe-1 7648 7648 CUSeeMe Video/Audio Server CUSeeMe-2 7649 CUSeeMe Video/Audio Server CUSeeMe-3 7650 CUSeeMe Video/Audio Server CUSeeMe-4 7651 CUSeeMe Video/Audio Server May 22, 2006 TCP/IP Ports List [v1.6] Page 21 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • active-worlds-2 7777 Active Worlds Messaging & Conferencing shoutcast 8000 Shoucast Streaming MP3 Server shoutcast 8001 Shoucast Streaming MP3 Server shoutcast 8002 Shoucast Streaming MP3 Server shoutcast 8003 Shoucast Streaming MP3 Server shoutcast 8004 Shoucast Streaming MP3 Server shoutcast 8005 Shoucast Streaming MP3 Server jserv 8007 Apache JServ module ajp13 8009 http-proxy 8080 Common HTTP proxy/second web server port blackice-icecap 8081 ICECap user console blackice-alerts 8082 BlackIce Alerts sent to this port cp-cluster 8116 8116 Check Point Clustering dialpad 8680 Dialpad (Range: 8680-8686) sun-answerbook 8888 Sun Answerbook HTTP server seosload 8892 Computer Associates eTrust ACX zeus-admin 9090 Zeus Admin Server jetdirect 9100 HP JetDirect man 9535 sd 9876 Session Director ivisit 9943 Ivisit issa 9991 ISS System Scanner Agent issc 9992 ISS System Scanner Console palace-chat 9997 Palace Chat Server palace-chat 9998 Palace Chat Server stel 10005 Secure telnet amanda 10080 Amanda Backup Util amandaidx 10082 Amanda indexing amidxtape 10083 Amanda tape indexing pksd 11371 PGP Public Key Server dwyco-video 12000 Dwyco Video Conference (Range: 12000-16090) delta3pc2phone 12053 Delta Three PC to Phone delta3pc2phone 12080 Delta Three PC to Phone delta3pc2phone 12083 Delta Three PC to Phone delta3pc2phone 12120 Delta Three PC to Phone delta3pc2phone 12122 Delta Three PC to Phone isode-dua 17007 biimenu 18000 Beckman Instruments, Inc. liquid-au 18888 LiquidAudio btx 20005 xcept4 (German Telekoms CEPT videotext service) wnn6 22273 Wnn6 (Japanese input) wnn6_Cn 22289 Wnn6 (Chinese input) wnn6_Kr 22305 Wnn6 (Korean input) wnn6_Tw 22321 Wnn6 (Taiwanse input) hpnpd 22370 Hewlett-Packard Network Printer daemon hpnpd 22370 Hewlett-Packard Network Printer daemon internetphone 22555 Internet Phone delta3pc2phone 24150 Delta Three PC to Phone (Range: 24150 - 24179) wnn6_DS 26208 Wnn6 (Dserver) halflife 27015 Half Life Game Server Quake3Server 27660 Quake 3 Arena Server (for first player) Quake2Server 27910 Quake 2 Server Quake3Server 27960 Quake 3 Arena Server heretic2 28910 Heretic II Game Server Solaris RPC port 32770 Solaris RPC port Solaris RPC port 32771 Solaris RPC port (rusersd) Solaris RPC port 32772 Solaris RPC port (status) Solaris RPC port 32773 Solaris RPC port (rquotad) Solaris RPC port 32774 Solaris RPC port (rusersd) Solaris RPC port 32775 Solaris RPC port (status) Solaris RPC port 32776 Solaris RPC port (sprayd) Solaris RPC port 32777 Solaris RPC port (walld) Solaris RPC port 32778 Solaris RPC port (rstatd) Solaris RPC port 32779 Solaris RPC port May 22, 2006 TCP/IP Ports List [v1.6] Page 22 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • Solaris RPC port 32780 Solaris RPC port Solaris RPC port 32786 Solaris RPC port (mountd) Solaris RPC port 32787 Solaris RPC port dmispd (DMI Service Provider) timestep 38036 sygatefw 39213 SyGate Firewall Mgmt port v3.0 build 521 and < novell 40193 reachout 43188 coldfusion-auth 44442 ColdFusion Advanced Security/Siteminder Auth coldfusion-auth 44443 ColdFusion Advanced Security/Siteminder Auth ciscopop 45000 Cisco PostOffice Protocol for NetRanger (IDS) dbbrowse 47557 Databeam Corporation dialpad 51200 Dialpad dialpad 51201 Dialpad dialpad 51210 Dialpad ivisit 56768 Ivisit cuseeme 56800 CUSeeMe pcAnywhere 65301 pcAnywhere ### May 22, 2006 TCP/IP Ports List [v1.6] Page 23 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • Trojan / Backdoor Ports The following ports should be considered as hostile ports as they are mostly used for trojans or backdoor programs. Hackers/crackers that break into systems often start processes running on one of the following ports and then use them to either regain entry or launch attacks against other sites. Service Name TCP Port UDP Port Description 0 Click attack (ICMP) 1 Sockets des Troie 2 Death 8 Ping Attack (ICMP) 9 Chargen 19 Chargen 20 Senna Spy FTP server 21 Back Construction Blade Runner Cattivik FTP Server CC Invader Dark FTP Dolly Trojan Fore Invisible FTP Juggernaut 42 Larva MotIv FTP Net Administrator Ramen Senna Spy FTP server The Flu Traitor 21 WebEx WinCrash 22 Shaft 23 Fire HacKer Tiny Telnet Server - TTS Truva Atl 25 Ajan Antigen Barok Email Password Sender (EPS) & EPS II Gip Gris Happy99 Hpteam mail Hybris I love you Kuang2 Magic Horse MBT (Mail Bombing Trojan) Moscow Email trojan Naebi NewApt worm ProMail trojan Shtirlitz Stealth Tapiras Terminator WinSpy 30 Agent 40421 31 Agent 31 Hackers Paradise Masters Paradise May 22, 2006 TCP/IP Ports List [v1.6] Page 24 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • 41 Deep Throat Foreplay 48 DRAT 50 DRAT 58 DMSetup 59 DMSetup 79 CDK Firehotcker 80 711 trojan (Seven Eleven) AckCmd Back End Back Orifice 2000 Plug-Ins Cafeini CGI Backdoor Executor God Message God Message Creator Hooker IISworm MTX NCX Reverse WWW Tunnel Backdoor RingZero Seeker WAN Remote Web Server CT WebDownloader 81 RemoConChubo 90 Hidden Port 2.0 99 Hidden Port NCX 110 ProMail trojan 113 Invisible Identd Deamon Kazimas 119 Happy99 121 Attack Bot God Message JammerKillah 123 Net Controller 129 Password Generator Protocol 133 Farnaz 137 Netbios name (DoS attacks) Chode 137 Netbios name (DoS attacks) Msinit 138 Chode 139 Netbios session (DoS attacks) Chode God Message worm Msinit Netlog Network Qaz 139 Netbios session (DoS attacks) 142 NetTaxi 146 146 Infector 1.3 170 A-trojan 334 Backage 411 Backage 420 Breach Incognito 421 TCP Wrappers trojan 455 Fatal Connections 456 Hackers Paradise May 22, 2006 TCP/IP Ports List [v1.6] Page 25 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • 513 Grlogin 514 RPC Backdoor 531 Net666 Rasmin 555 711 trojan (Seven Eleven) Ini-Killer Net Administrator Phase Zero Stealth Spy 605 Secret Service 666 Attack FTP Back Construction BLA trojan Cain & Abel NokNok Satans Back Door - SBD ServU Shadow Phyre th3r1pp3rz (Therippers) 667 SniperNet 669 DP trojan 692 GayOL 777 AIM Spy Application Undetected 808 WinHole 911 Dark Shadow 999 Deep Throat Foreplay WinSatan 1000 Der SpSher / Der Spaeher Direct Connection 1001 Der SpSher / Der Spaeher Le Guardien Silencer WebEx 1010 Doly Trojan 1011 Doly Trojan 1012 Doly Trojan 1015 Doly Trojan 1016 Doly Trojan 1020 Vampire 1024 Jade Latinus NetSpy 1025 Remote Storm 1025 Mavericks Matrix 1.2 - 2.0 Remote Storm 1033 NetSpy 1035 Multidropper 1042 BLA trojan 1045 Rasmin 1049 /sbin/initd 1050 MiniCommand 1053 The Thief 1054 AckCmd 1080 WinHole 1081 WinHole 1082 WinHole 1083 WinHole 1090 Xtreme 1095 Remote Administration Tool - RAT 1097 Remote Administration Tool - RAT 1098 Remote Administration Tool - RAT May 22, 2006 TCP/IP Ports List [v1.6] Page 26 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • 1099 Blood Fest Evolution Remote Administration Tool - RAT 1150 Orion 1151 Orion 1170 Psyber Stream Server - PSS Streaming Audio Server Voice 1200 NoBackO 1201 NoBackO 1207 SoftWAR 1208 Infector 1212 Kaos 1234 SubSeven Java client Ultors Trojan 1243 BackDoor-G SubSeven Apocalypse Tiles Sub Seven 1245 VooDoo Doll 1255 Scarab 1256 Project nEXT 1269 Mavericks Matrix 1272 The Matrix 1313 NETrojan 1338 Millenium Worm 1349 BackOrifice DLL Comm 1394 GoFriller Backdoor G-1 1441 Remote Storm 1492 FTP99CMP 1524 Trinoo 1568 Remote Hack 1600 Direct Connection Shivka-Burka 1703 Exploiter 1777 Scarab 1807 SpySender 1966 Fake FTP 1967 WM FTP Server 1969 OpC BO 1981 Bowl Shockrave 1999 Back Door SubSeven TransScout 2000 Der SpSher / Der Spaeher Insane Network Last 2000 Remote Explorer 2000 Senna Spy Trojan Generator 2001 Der SpSher / Der Spaeher Trojan Cow 2002 TransScout 2003 TransScout 2004 TransScout 2005 TransScout 2023 Ripper Pro 2080 WinHole 2115 Bugs 2130 Mini Backlash 2140 The Invasor 2140 Deep Throat Foreplay May 22, 2006 TCP/IP Ports List [v1.6] Page 27 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • 2155 Illusion Mailer 2255 Nirvana 2283 HLV Rat5 2300 Xplorer 2311 Studio 54 2330 Contact 2331 Contact 2332 Contact 2333 Contact 2334 Contact 2335 Contact 2336 Contact 2337 Contact 2338 Contact 2339 Contact Voice Spy 2339 Voice Spy 2345 Doly Trojan 2565 Striker trojan 2583 WinCrash 2600 Digital RootBeer 2716 The Prayer 1.2 -1.3 2721 Phase Zero 2773 SubSeven SubSeven 2.1 Gold 2774 SubSeven SubSeven 2.1 Gold 2801 Phineas Phucker 2989 Remote Administration Tool - RAT 3000 Remote Shut 3024 WinCrash 3028 Ring Zero 3031 Microspy 3128 Reverse WWW Tunnel Backdoor RingZero 3129 Masters Paradise 3150 The Invasor 3150 Deep Throat Foreplay Mini Backlash 3456 Terror trojan 3459 Eclipse 2000 Sanctuary 3700 Portal of Doom 3777 PsychWard 3791 Total Solar Eclypse 3801 Total Solar Eclypse 4000 SkyDance 4092 WinCrash 4100 Watchguard Firebox Admin DoS 4242 Virtual Hacking Machine - VHM 4321 BoBo 4444 Prosiak Swift Remote 4567 File Nail 4590 ICQ Trojan 4950 ICQ Trogen (Lm) 5000 Back Door Setup Blazer5 Bubbel ICKiller Ra1d Sockets des Troie 5001 Back Door Setup May 22, 2006 TCP/IP Ports List [v1.6] Page 28 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • Sockets des Troie 5002 cd00r Shaft 5010 Solo 5011 One of the Last Trojans - OOTLT modified 5025 WM Remote KeyLogger 5031 Net Metropolitan 1.0 5032 Net Metropolitan 1.04 5321 Firehotcker 5333 Backage NetDemon 5343 wCrat - WC Remote Administration Tool 5400 Back Construction Blade Runner 5401 Back Construction Blade Runner 5402 Back Construction Blade Runner 5512 Illusion Mailer Xtcp 5521 Illusion Mailer 5534 The Flu 5550 Xtcp 5555 ServeMe 5556 BO Facil 5557 BO Facil 5569 Robo-Hack 5637 PC Crasher 5638 PC Crasher 5742 WinCrash 5760 Portmap Remote Root Linux Exploit 5880 Y3K RAT 5882 5882 Y3K RAT 5888 5888 Y3K RAT 5889 Y3K RAT 6000 The Thing 1.6 6006 Bad Blood 6272 Secret Service 6400 The Thing 6661 TEMan, Weia-Meia 6666 Dark Connection Inside NetBus worm 6667 Sub-7 Trojan (new icq notification) Subseven 2.1.4 DefCon 8 SubSeven Dark FTP ScheduleAgent Trinity WinSatan 6669 Host Control Vampyre 6670 BackWeb Server Deep Throat Foreplay WinNuke eXtreame 6671 Deep Throat 6711 BackDoor-G SubSeven VP Killer 6712 Funny trojan SubSeven 6713 SubSeven 6723 Mstream attack-handler May 22, 2006 TCP/IP Ports List [v1.6] Page 29 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • 6771 Deep Throat Foreplay 6776 2000 Cracks BackDoor-G SubSeven VP Killer 6838 Mstream Agent-handler 6883 Delta Source DarkStar 6912 Sh*t Heap (not 69123) 6939 Indoctrination 6969 GateCrasher IRC 3 Net Controller Priority 6970 GateCrasher 7000 Exploit Translation Server Kazimas Remote Grab SubSeven SubSeven 2.1 Gold 7001 Freak88 Freak2k 7028 7028 Unknown Trojan 7215 SubSeven SubSeven 2.1 Gold 7300 NetMonitor 7301 NetMonitor 7306 NetMonitor 7307 NetMonitor 7308 NetMonitor 7424 7424 Host Control 7597 QaZ (Remote Access Trojan) 7626 Glacier 7777 God Message Tini 7789 Back Door Setup ICKiller 7891 The ReVeNgEr 7983 MStream handler-agent 8080 Brown Orifice RemoConChubo Reverse WWW Tunnel Backdoor RingZero 8787 Back Orifice 2000 8879 8879 Back Orifice 2000 8988 BacHack 8989 Rcon Recon Xcon 9000 Netministrator 9325 MStream Agent-handler 9400 InCommand 9872 Portal of Doom 9873 Portal of Doom 9874 Portal of Doom 9875 Portal of Doom 9876 Cyber Attacker Rux 9878 TransScout 9989 ini-Killer 9999 The Prayer 1.2 -1.3 10000 OpwinTRojan 10005 OpwinTRojan 10067 Portal of Doom May 22, 2006 TCP/IP Ports List [v1.6] Page 30 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • 10085 Syphillis 10086 Syphillis 10100 Control Total, Gift trojan 10101 BrainSpy, Silencer 10167 Portal of Doom 10498 Mstream handler-agent 10520 Acid Shivers 10528 Host Control 10607 Coma 10666 Ambush 11000 Senna Spy Trojan Generator 11050 Host Control 11051 Host Control 11223 Progenic trojan Secret Agent 12076 Gjamer 12223 Hack 99 KeyLogger 12345 Ashley cron / crontab Fat Bitch trojan, GabanBus icmp_client.c icmp_pipe.c Mypic NetBus NetBus Toy NetBus worm Pie Bill Gates Ultors Trojan Whack Job X-bill 12346 Fat Bitch trojan GabanBus NetBus X-bill 12349 BioNet 12361 Whack-a-mole 12362 Whack-a-mole 12363 Whack-a-mole 12623 DUN Control 12456 NetBus 12624 ButtMan 12631 Whack Job 12701 Eclypse 2000 12754 Mstream attack-handler 13000 Senna Spy Trojan Generator 13010 Hacker Brasil - HBR 13013 PsychWard 13014 PsychWard 13223 Hack 99 KeyLogger 13473 Chupacabra 13700 Kuang2 the Virus 14500 PC Invader 14501 PC Invader 14502 PC Invader 14503 PC Invader 15000 NetDemon 15092 Host Control 15104 Mstream attack-handler 15382 SubZero 15858 CDK 16484 Mosucker 16660 Stacheldraht 16772 ICQ Revenge May 22, 2006 TCP/IP Ports List [v1.6] Page 31 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • 16959 SubSeven Subseven 2.1.4 DefCon 8 16969 Priority 17166 Mosaic 17300 Kuang2 the virus 17449 Kid Terror 17499 CrazzyNet 17500 CrazzyNet 17569 Infector 17593 Audiodoor 17777 Nephron 18753 18753 Shafthandler to Agent 19864 ICQ Revenge 20000 Millenium 20001 Millenium Millenium (Lm) 20002 AcidkoR 20005 Mosucker 20023 VP Killer 20034 NetBus 2.0 Pro NetBus 2.0 Pro Hidden NetRex Whack Job 20203 Chupacabra Logged! 20331 BLA trojan 20432 Shaft Client to handlers 20433 Shaft Agent to handlers 21544 GirlFriend Kid Terror 21554 Exploiter Kid Terror Schwindler Winsp00fer 22222 Donald Dick Prosiak Ruler RUX The TIc.K 23005 NetTrash 23006 NetTrash 23023 Logged 23032 Amanda 23432 Asylum 23456 Evil FTP Ugly FTP Whack Job 23476 23476 Donald Dick 23477 Donald Dick 23777 InetSpy 24000 Infector 25685 Moonpie 25686 Moonpie 25982 Moonpie 26274 Delta Source 26681 Voice Spy 26274 Delta Source 27374 Bad Blood Ramen Seeker SubSeven SubSeven 2.1 Gold Subseven 2.1.4 DefCon 8 SubSeven Muie Ttfloader 27444 27444 Trin00/TFN2K May 22, 2006 TCP/IP Ports List [v1.6] Page 32 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • 27573 SubSeven 2.1 27665 Trin00 DoS Attack 28678 Exploiter 29104 NetTrojan 29369 ovasOn 29891 The Unexplained 30000 Infector 30001 ErrOr32 30003 Lamers Death 30029 AOL Trojan 30100 NetSphere 30101 NetSphere 30102 NetSphere 30103 30103 NetSphere 30133 NetSphere Final 30303 Sockets des Troie 30464 IceCast remote overflow 30947 Intruse 30999 Kuang2 31335 31335 Trin00 DoS Attack 31336 BO-Whack Butt Funnel eleet 31337 Back Fire Back Orifice 1.20 patches Back Orifice (Lm) Back Orifice russian Baron Night, Beeone BO client BO Facil BO spy BO2 cron / crontab Freak88 Freak2k icmp_pipe.c Sockdmini 31337 Back Orifice Deep BO 31338 Back Orifice Butt Funnel NetSpy (DK) 31338 Deep BO 31339 NetSpy (DK) 31666 BO-Whack 31785 HackaTack 31787 HackaTack 31788 HackaTack 31789 HackaTack 31790 HackaTack 31791 HackaTack 31792 HackaTack 32001 Donald Dick 32100 Peanut Brittle Project nEXT 32418 Acid Battery 33270 Trinity Trojan 33333 Blakharaz Prosiak 33390 Unknown trojan 33577 Son of PsychWard 33777 Son of PsychWard 33911 Spirit 2000 Spirit 2001 34324 Big Gluck May 22, 2006 TCP/IP Ports List [v1.6] Page 33 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.
    • TN 34444 Donald Dick 34555 Trinoo (Windows only) 35555 Trinoo (Windows only) 37237 Mantis 37651 Yet Another Trojan - YAT 40412 The Spy 40421 Agent 40421 Masters Paradise 40422 Masters Paradise 40423 Masters Paradise 40425 Masters Paradise 40426 Masters Paradise 41337 Storm 41666 Remote Boot Tool (RBT) 43210 Masters Paradise 44444 Prosiak 44575 Exploiter 47252 Delta Source 47262 Delta Source 49301 OnLine KeyLogger 50130 Enterprise 50505 Sockets de Troie 2.0 50766 Fore Schwindler 51966 Cafeini 52317 Acid Battery 2000 53001 Remote Windows Shutdown (RWS) 54283 SubSeven SubSeven 2.1 Gold 54320 Back Orifice 200 (Default Port) 54321 Back Orifice 200 (Default Port) School Bus 55165 File Manager trojan WM Trojan Generator 55166 WM Trojan Generator 57341 NetRaider Trojan 58339 Butt Funnel 60000 Deep Throat Foreplay Sockets des Troie 60001 Trinity 60068 Xzip 6000068 60411 Connection 61348 Bunker-Hill Trojan 61466 TeleCommando 61603 Bunker-Hill Trojan 63485 Bunker-Hill Trojan 64101 Taskman 65000 Devil Sockets des Troie Stacheldraht 65390 Eclypse 65421 Jade 65432 65432 The Traitor (= th3tr41t0r) 65534 /sbin/initd 65535 RC1 trojan ### May 22, 2006 TCP/IP Ports List [v1.6] Page 34 of 34 31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | security@razorpointsecurity.com Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.