TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ......

36
Author: Razorpoint Security Team Version: 1.6 Date of current version: 2006-05/22 Date of original version: 2001-04/10 Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved. TCP/IP Ports List [ WHITE PAPER ]

Transcript of TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ......

Page 1: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

Author:Razorpoint Security TeamVersion:1.6

Date of current version:2006-05/22

Date of original version:2001-04/10

Copyright © 2001-2006 Razorpoint Security Technologies, Inc.All Rights Reserved.

TCP/IP Ports List

[ WHITE PAPER ]

Page 2: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

Table of Contents.

TCP/IP Ports List .......................................................................................................................................... 1

Valid Ports ..................................................................................................................................................... 2

Trojan / Backdoor Ports ................................................................................................................................... 24

May 22, 2006 TCP/IP Ports List [v1.6]

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 3: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

TCP/IP Ports ListTCP/IP (Transmission Control Protocol / Internet Protocol) is the primary packet type on the Internet. It uses an assigned list of ports (numbered services used to accept connections) for valid Internet services. This TCP/IP ports list covers both TCP and UDP (Universal Datagram Packet) port assignments used by authorized services like email (SMTP), news (NNTP), and the World Wide Web (HTTP), in addition to illegitimate hacker/cracker backdoor, or trojan, ports.

Authorized (legitimate) port numbers are divided into three ranges: the Well Known Ports, the Registered Ports, and the Dynamic and/or Private Ports. Well Known Ports are those from 0 through 1023, Registered Ports are those from 1024 through 49151, and the Dynamic and/or Private Ports are those from 49152 through 65535. The Well Known Ports are assigned by the IANA (Internet Assigned Numbers Authority) and on most systems can only be used by system (root level) processes or by programs executed by privileged users. Ports for the TCP are defined in RFC 793, and ports for the UDP are defined in RFC 768. Where ever possible, port assignments are the same for TCP and UDP packet types.

Razorpoint Security Technologies, Inc. continues to update this list on a regular basis and attempts to keep it as one of the most comprehensive TCP/IP ports list available. This list contains TCP/IP ports used by most operating systems and network technologies, including: Sun Solaris, Linux, BSD Unix (MacOS X, OpenBSD, FreeBSD, NetBSD, etc.), Windows, Cisco, Nortel and 3Com.

For more information, please contact Razorpoint Security Technologies, Inc. at (www.razorpointsecurity.com).

May 22, 2006 TCP/IP Ports List [v1.6] Page 1 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 4: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

Valid TCP/IP Ports

Service Name TCP Port UDP Port Description

<reserved> 0 0 Reservedtcpmux 1 1 TCP Port Service Multiplexer (RFC-1078)compressnet 2 2 Management Utilitycompressnet 3 3 Compression Process<unassigned> 4 4 Unassignedrje 5 5 Remote Job Entry<unassigned> 6 6 Unassignedecho 7 7discard 9 9 sink null<unassigned> 10 10 Unassignedsystat 11 11 Active Users<unassigned> 12 12 Unassigneddaytime 13 13 Daytime (RFC 867)<unassigned> 14 14 Unassigned<unassigned> 15 15 Unassigned <formerly netstat><unassigned> 16 16 Unassignedqotd 17 17 Quote of the Daymsp 18 18 Message Send Protocolchargen 19 19 Character GeneratorFTP-data 20 20 File Transfer [Default Data]FTP 21 21 File Transfer [Control]SSH 22 22 Secure Shell (ssh / scp)Telnet 23 23priv-mail 24 24 Any private mail systemSMTP 25 25 Simple Mail Transfer Protocol<unassigned> 26 26 Unassignednsw-fe 27 27 NSW User System FEmsg-icp 29 29 MSG ICPmsg-auth 31 31 MSG Authentication<unassigned> 32 32 Unassigneddsp 33 33 Display Support Protocol<unassigned> 34 34 Unassignedpriv-print 35 35 any private printer servertime 37 37 timserverrap 38 38 Route Access Protocolrlp 39 39 Resource Location Protocol<unassigned> 40 40 Unassignedgraphics 41 41 Graphicsnameserver 42 42 Host Name Servernicname 43 43 Who Ismpm-flags 44 44 MPM FLAGS Protocolmpm 45 45 Msg Processing Module [recv]mpm-snd 46 46 MPM [default send]ni-ftp 47 47 NI FTPauditd 48 48 Digital Audit Daemontacacs 49 49 Login Host Protocol (TACACS)re-mail-ck 50 50 Remote Mail Checking Protocolla-maint 51 51 IMP Logical Address Maintenancexns-time 52 52 XNS Time Protocoldomain 53 53 Domain Name Serverxns-ch 54 54 XNS Clearinghouseisi-gl 55 55 ISI Graphics Languagexns-auth 56 56 XNS AuthenticationMTP 57 57 Any private terminal accessxns-mail 58 58 XNS Mailpriv-file 59 59 any private file service<unassigned> 60 60 Unassignedni-mail 61 61 NI MAILacas 62 62 ACA Services

May 22, 2006 TCP/IP Ports List [v1.6] Page 2 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 5: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

whois 63 63 Whois++ VIA Systems - FTPcovia 64 64 Communications Integrator (CI)tacacs-ds 65 65 TACACS-Database Servicesql*net 66 66 Oracle SQL*NETbootps 67 Bootstrap Protocol Serverbootpc 68 Bootstrap Protocol Clienttftp 69 Trivial File Transfergopher 70 70netrjs-1 71 71 Remote Job Servicenetrjs-2 72 72 Remote Job Servicenetrjs-3 73 73 Remote Job Servicenetrjs-4 74 74 Remote Job Servicepriv-dial 75 75 Any private dial out servicedeos 76 76 Distributed External Object Storepriv-rje 77 77 any private RJE service, netjrsvettcp 78finger 79http 80 World Wide Web HTTPhosts2-ns 81 81 HOSTS2 Name Serverxfer 82 82 XFER Utilitymit-ml-dev 83 83 MIT ML Devicectf 84 84 Common Trace Facilitymit-ml-dev 85 85 MIT ML Devicemfcobol 86 86 Micro Focus Cobolpriv-term-l 87 any private terminal link, ttylinkkerberos-sec 88 88 Kerberos (v5)su-mit-tg 89 89 SU/MIT Telnet Gatewaydnsix 90 90 DNSIX Securit Attribute Token Mapmit-dov 91 91 MIT Dover Spoolernpp 92 Network Printing Protocoldcp 93 Device Control Protocolobjcall 94 Tivoli Object Dispatchersupdup 95 BSD supdupddixie 96 96 DIXIE Protocol Specificationswift-rvf 97 Swift Remote Virtural File Protocollinuxconf 98 linuxconf 98 TAC Newsmetagram 99 Metagram Relayirc 100 Internet Relay Chathostname 101 hostnames NIC Host Name Server Internet Relay Chatiso-tsap 102 tsap ISO-TSAP Class 0gppitnp 103 Genesis Point-to-Point Trans Net, or x400 ISO Emailacr-nema 104 ACR-NEMA Digital Imag. & Comm. 300csnet-ns 105 Mailbox Name Nameserverpop3pw 106 Eudora compatible PW changer 106 3Com TSMuxrtelnet 107 Remote Telnetsnagas 108 SNA Gateway Access Serverpop-2 109 PostOffice V.2pop-3 110 PostOffice V.3 Internet Relay Chat (Fserve)sunrpc 111 portmapper, rpcbind Internet Relay Chat (Fserve)mcidas 112 McIDAS Data Transmission Protocolauth 113 ident, tap, Authentication Service Internet Relay Chat (DCC)irc 113 Internet Relay Chat (Ident)audionews 114 Audio News Multicastsftp 115 Secure File Transfer Protocolansanotify 116 ANSA REX Notifyuucp-path 117 UUCP Path Service

May 22, 2006 TCP/IP Ports List [v1.6] Page 3 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 6: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

sqlserv 118 SQL Servicesnntp 119 Network News Transfer Protocolirc 120 Internet Relay Chat (Send)erpc 121 Encore Expedited Remote Pro.Call Internet Relay Chat (Send)smakynet 122ntp 123 123 Network Time Protocolansatrader 124 ANSA REX Traderansatrader 124 ANSA REX Traderlocus-map 125 Locus PC-Interface Net Map Serlocus-map 125 Locus PC-Interface Net Map Serunitary 126 Unisys Unitary Loginlocus-con 127 Locus PC-Interface Conn Servergss-xlicen 128 GSS X License Verificationpwdgen 129 Password Generator Protocolcisco-fna 130 cisco FNATIVE Internet Relay Chat (Get)cisco-tna 131 cisco TNATIVE Internet Relay Chat (Get)cisco-sys 132 cisco SYSMAINT Internet Relay Chat (Get)statsrv 133 Statistics Serviceingres-net 134 INGRES-NET Serviceloc-srv 135 NCS local location brokerprofile 136 PROFILE Naming Systemnetbios-ns 137 137 NETBIOS Name Servicenetbios-dgm 138 138 NETBIOS Datagram Servicenetbios-ssn 139 139 NETBIOS Session Serviceemfis-data 140 EMFIS Data Serviceemfis-cntl 141 EMFIS Control Servicebl-idm 142 Britton-Lee IDMimap2 143 Inernet Mail Access Protocol v2news 144 NewS window systemuaac 145 UAAC Protocoliso-tp0 146iso-ip 147cronus 148 CRONUS-SUPPORTaed-512 149 AED 512 Emulation Servicesql-net 150hems 151bftp 152 Background File Transfer Programsgmp 153netsc-prod 154netsc-dev 155sqlsrv 156 SQL Serviceknet-cmp 157 KNET/VM Command/Message Protocolpcmail-srv 158 PCMail Servernss-routing 159sgmp-traps 160snmp 161 Simple Network Management Protocolsnmptrap 162 snmp-trapcmip-man 163 CMIP Managersmip-agent 164 CMIP Agentxns-courier 165 Xeroxs-net 166 Sirius Systemsnamp 167namp 167rsvd 168rsvd 168send 169print-srv 170 Network PostScriptmultiplex 171 Network Innovations Multiplexcl-1 172 Network Innovations CL/1xyplex-mux 173mailq 174May 22, 2006 TCP/IP Ports List [v1.6] Page 4 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 7: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

vmnet 175genrad-mux 176xdmcp 177 X Display Manager Control Protocolnextstep 178 NextStep Window Serverbgp 179 Border Gateway Protocolris 180 Intergraphunify 181audit 182 Unisys Audit SITPocbinder 183ocserver 184remote-kis 185kis 186 KIS Protocolaci 187 Application Communication Interfacemumps 188 Plus Fives MUMPSqft 189 Queued File Transportgacp 190 Gateway Access Control Protocolprospero 191 Prospero Directory Serviceosu-nms 192 OSU Network Monitoring Systemsrmp 193 Spider Remote Monitoring Protocolirc 194 Internet Relay Chatdn6-nlm-aud 195 DNSIX Network Level Module Auditdn6-smm-red 196 DNSIX Session Mgt Module Audit Redirdls 197 Directory Location Servicedls-mon 198 Directory Location Service Monitorsmux 199 SNMP Unix Multiplexersrc 200 IBM System Resource Controllerat-rtmp 201 AppleTalk Routing Maintenanceat-nbp 202 AppleTalk Name Bindingat-3 203 AppleTalk Unusedat-echo 204 AppleTalk Echoat-5 205 AppleTalk Unusedat-zis 206 AppleTalk Zone Informationat-7 207 AppleTalk Unusedat-8 208 AppleTalk Unusedtam 209 Trivial Authenticated Mail Protocolz39.50 210 wais, ANSI Z39.50914c-g 211 Texas Instruments 914C/G Terminalanet 212 ATEXSSTRipx 213vmpwscs 214softpc 215 Insignia Solutionsatls 216 Access Technology License Serverdbase 217 dBASE Unixmpp 218 Netix Message Posting Protocoluarps 219 Unisys ARPsimap3 220 Interactive Mail Access Protocol v3fln-spx 221 Berkeley rlogind with SPX authrsh-spx 222 Berkeley rshd with SPX authcdc 223 Certificate Distribution Centermasqdialer 224 224 Masqdialerdirect 242sur-meas 243 Survey Measurementdayna 244link 245dsp3270 246 Display Systems Protocolsubntbcst_tftp 247bhfhs 248rap 256set 257 secure electronic transactionyak-chat 258 yak winsock personal chatfw1-vpn 259 Check Point FireWall-1/VPN-1 Secure Portopenport 260nsiiops 261 iiop name service over tls/sslarcisdms 262

May 22, 2006 TCP/IP Ports List [v1.6] Page 5 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 8: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

hdap 263bgmp 264x-bone-ctl 265 265 X-Bone CTLmom 270 http://www.Microsoft.com/mom/http-mgmt 280 280personal-link 281cableport-ax 282 cable port a/xfxp 286 286 FXP Communicationnovastorbakcup 308 novastor backupentrusttime 309bhmds 310bhmds 310asip-webadmin 311 appleshare ip webadminvslmp 312magenta-logic 313opalis-robot 314dpsi 315decauth 316zannet 317pkix-timestamp 318 318 PKIX Timestamppip 321rtsps 322 322 RTSPSpdap 344 Prospero Data Access Protocolpawserv 345 Perf Analysis Workbenchzserv 346 Zebra serverfatserv 347 Fatmen Servercsi-sgwp 348 Cabletron Management Protocolmftp 349matip-type-a 350 MATIP Type Amatip-type-b 351 MATIP Type B or bhoettydtag-ste-sb 352 DTAG, or bhoedap4ndsauth 353bh611 354datex-asn 355cloanto-net-1 356 Cloanto Net 1bhevent 357shrinkwrap 358tenebris_nts 359 Tenebris Network Trace Servicescoi2odialog 360semantix 361srssend 362 SRS Sendrsvp_tunnel 363aurora-cmgr 364dtk 365 Deception Tool Kit (lame -- see www.all.net)odmr 366mortgageware 367qbikgdp 368rpc2portmap 369codaauth2 370clearcase 371ulistserv 372 Unix Listservlegent-1 373 Legent Corporation (Computer Associates)legent-1 373 Legent Corporation (Computer Associates)legent-2 374 Legent Corporation (Computer Associates)hassle 375nip 376 Amiga Envoy Network Inquiry PrototnETOS 377 NEC CorporationdsETOS 378 NEC Corporationis99c 379 TIA/EIA/IS-99 modem clientis99s 380 TIA/EIA/IS-99 modem serverhp-collector 381 hp performance data collectorhp-managed-node 382 hp performance data managed nodehp-alarm-mgr 383 hp performance data alarm managerarns 384 A Remote Network Server Systemibm-app 385 IBM Application

May 22, 2006 TCP/IP Ports List [v1.6] Page 6 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 9: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

asa 386 ASA Message Router Object Def.aurp 387 Appletalk Update-Based Routing Pro.unidata-ldm 388 Unidata LDM Version 4ldap 389 Lightweight Directory Access Protocoluis 390synotics-relay 391 SynOptics SNMP Relay Portsynotics-broker 392 SynOptics Port Broker Portdis 393 Data Interpretation Systemembl-ndt 394 EMBL Nucleic Data Transfernetcp 395 NETscout Control Protocolnetware-ip 396 Novell Netware over IPmptn 397 Multi Protocol Trans. Net.kryptolan 398iso-tsap-c2 399 ISO-TSAP Class 2work-sol 400 Workstation Solutionsups 401 Uninterruptible Power Supplygenie 402 Genie Protocoldecap 403nced 404ncld 405imsp 406 Interactive Mail Support Protocoltimbuktu 407prm-sm 408 Prospero Resource Manager Sys. Man.prm-nm 409 Prospero Resource Manager Node Man.decladebug 410 DECLadebug Remote Debug Protocolrmt 411 Remote MT Protocolsynoptics-trap 412 Trap Convention Portsmsp 413infoseek 414bnet 415silverplatter 416onmux 417hyper-g 418ariel1 419smpte 420ariel2 421ariel3 422opc-job-start 423 IBM Operations Planning and Control Startopc-job-track 424 IBM Operations Planning and Control Trackicad-el 425smartsdp 426svrloc 427 Server Locationocs_cmu 428ocs_amu 429utmpsd 430utmpcd 431iasd 432nnsp 433 Usenet, Network News Transfermobileip-agent 434mobilip-mn 435dna-cml 436comscm 437dsfgw 438dasp 439sgcp 440decvms-sysmgt 441cvc_hostd 442https 443 secure http (SSL)snpp 444 Simple Network Paging Protocolmicrosoft-ds 445ddm-rdb 446ddm-dfm 447ddm-ssl 448 ddm-byteas-servermap 449 AS Server Mapper

May 22, 2006 TCP/IP Ports List [v1.6] Page 7 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 10: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

tserver 450sfs-smp-net 451 Cray Network Semaphore serversfs-config 452 Cray SFS config servercreativeserver 453contentserver 454creativepartnr 455macon-tcp 456scohelp 457appleqtc 458 apple quick timeampr-rcmd 459skronk 460datasurfsrv 461datasurfsrvsec 462alpes 463kpasswd5 464 Kerberos (v5)smtps 465 smtp protocol over TLS/SSL (was ssmtp)digital-vrc 466mylex-mapd 467photuris 468 Photuris Key Managementrcp 469 Radio Control Protocolscx-proxy 470mondex 471ljk-login 472hybrid-pop 473tn-tl-w1 474tcpnethaspsrv 475tn-tl-fd1 476ss7ns 477spsc 478iafserver 479loadsrv 480iafdbase 480dvs 481ph 481bgs-nsi 482xlog 482ulpnet 483integra-sme 484 Integra Software Management Environmentpowerburst 485 Air Soft Power Burstsstats 486avian 486saft 487 saft Simple Asynchronous File Transfergss-http 488nest-protocol 489micom-pfs 490go-login 491ticf-1 492 Transport Independent Convergence for FNAticf-2 493 Transport Independent Convergence for FNApov-ray 494intecourier 495pim-rp-disc 496Dantz Retrospect 497 MacOS Backup Software Systemsiam 498iso-ill 499 ISO ILL Protocolisakmp 500 ISA/KMP Encryption Key Exchange 500 Baynetworks VPNstmf 501asa-appl-proto 502intrinsa 503citadel 504mailbox-lm 505ohimsrv 506crs 507xvttp 508snare 509May 22, 2006 TCP/IP Ports List [v1.6] Page 8 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 11: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

fcp 510 FirstClass Serverpassgo 511exec 512 BSD rexecdbiff 512 comsatlogin 513 BSD rlogindwho 513 BSD rwhodshell 514 BSD rshdsyslog 514 BSD syslogdprinter 515 spooler (lpr/lpd)videotex 516talk 517 BSD talkdntalk 518 (talkd)utime 519 unixtimeroute 520 router routed (RIP), or extended file name serverripng 521ulp 522ibm-db2 523ncp 524timed 525 timeservertempo 526 newdatestx 527 Stock IXChangecustix 528 Customer IXChangeirc-serv 529courier 530 rpcconference 531 chatnetnews 532 readnewsnetwall 533 for emergency broadcastsmm-admin 534 MegaMedia Adminiiop 535opalis-rdv 536nmsp 537 Networked Media Streaming Protocolgdomap 538apertus-ldp 539 Apertus Technologies Load Determinationuucp 540 uucpduucp-rlogin 541commerce 542klogin 543 Kerberos (v4/v5) AppleShare over IPkshell 544 krcmd Kerberos (v4/v5)ekshell 545 Kerberos encrypted remote shell -kfalldhcpv6-client 546 DHCPv6 Clientdhcpv6-server 547 DHCPv6 Serverafpovertcp 548 AFP (AppleShare) over TCP, also iDiskidfp 549new-rwho 550 new-whocybercash 551deviceshare 552pirp 553rtsp 554 Real Time Streaming Protocoldsf 555remotefs 556 rfs, rfs_server, Brunhoff remote filesystemopenvms-sysipc 557sdnskmp 558teedtap 559rmonitor 560 rmonitordmonitor 561chshell 562 chcmdsnews 563 NNTP over SSL9pfs 564 Plan 9 file servicewhoami 565streettalk 566banyan-rpc 567ms-shuttle 568 Microsoft shuttlems-rome 569 Microsoft romemeter 570 demonMay 22, 2006 TCP/IP Ports List [v1.6] Page 9 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 12: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

umeter 571 udemonsonar 572banyan-vip 573ftp-agent 574 FTP Software Agent Systemvemmi 575ipcd 576vnas 577ipdd 578decbsrv 579sntp-heartbeat 580bdp 581 Bundle Discovery Protocolscc-security 582philips-vc 583 Philips Video-Conferencingkeyserver 584imap4-ssl 585 IMAP4+SSL (use port 993 instead)password-chg 586submission 587cal 588eyelink 589tns-cml 590http-alt 591 FileMaker Pro - HTTP Alternateeudora-set 592 Eudora Settings Serverhttp-rpc-epmap 593 HTTP RPC Ep Maptpip 594cab-protocol 595smsd 596ptcnameservice 597 PTC Name Servicesco-websrvrmg3 598 SCO Web Server Manager 3acp 599 Aeolon Core Protocolipcserver 600 Sun IPC serversyslog-conn 601 601 Reliable Syslog Servicexmlrpc-beep 602 602 XML-RPC over BEEPidxp 603 603 IDXPtunnel 604 604 TUNNELsoap-beep 605 605 SOAP over BEEPurm 606 Cray Unified Resource Managernqs 607sift-uft 608 Sender-Initiated/Unsolicited File Transfernpmp-trap 609npmp-local 610npmp-gui 611sshell 614 614 SSLshellsco-inetmgr 615 615 Internet Configuration Managersco-sysmgr 616 616 SCO System Administration Serversco-dtmgr 617 617 SCO Desktop Administration Servernlservd 617 http://www.arkeia.comcryptoadmin 624 624 Crypto AdminIMAP Admin 626qmqp 628 Qmail Quick Mail Queueingcups 631 Common UNIX Printing Systemginad 634mount 635 NFS Mount Serviceldapssl 636 LDAP over SSLpcnfs 640 PC-NFS DOS Authenticationsanity 643 643 SANityldp 646 646 LDPdhcp-failover 647 647 DHCP Failoverrrp 648 NSI Registry Registrar Protocolbwnfs 650 BW-NFS DOS AuthenticationAppleShare IP Admin 660 AppleShare Web & File Servicespftp 662 662 PFTPpurenoise 663 663 PureNoisedoom 666 Doom(Id Software)vpp 677 677 Virtual Presence ProtocolMacOS Users & Groups 687

May 22, 2006 TCP/IP Ports List [v1.6] Page 10 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 13: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

nmap 689 689 NMAPresvc 691 Microsoft Exchange 2000 Server Routingha-cluster 694 694 ha-clusterBuddyPhone 700 BuddyPhone Communication (No FTP)BuddyPhone 701 BuddyPhone Communication (No FTP)elcsd 704 errlog copy/server daemonentrustmanager 709 EntrustMgr - NorTel DES auth networkcisco-tdp 711 711 Cisco TDPnetviewdm1 729 IBM NetView DM/6000 Server/Clientnetviewdm2 730 IBM NetView DM/6000 sendnetviewdm3 731 IBM NetView DM/6000 receivesometimes-rpc2 737 Rusersd(OpenBSD)netcp 740 NETscout Control Protocolnetgw 741netrcs 742 Network based Rev. Cont. Sys.flexlm 744 Flexible License Managerfujitsu-dev 747 Fujitsu Device Controlris-cm 748 Russell Info Sci Calendar Managerkerberos-adm 749 Kerberos 5 admin/changepwkerberos 750 kdc Kerberos (v4)kerberos_master 751 Kerberos `kadmin (v4)qrh 752rrh 753krb_prop 754 kerberos/v5 server propagationnlogin 758nlogin 758con 759krbupdate 760 kreg Kerberos (v4) registrationkpasswd 761 kpwd Kerberos (v4) “passwd”quotad 762cycleserv 763omserv 764webster 765phonebook 767 phonevid 769cadlock 770rtip 771cycleserv2 772submit 773rpasswd 774acmaint_dbd 774entomb 775acmaint_transd 775wpages 776wpages 776multiling-http 777 777 Multiling HTTPwpgs 780wpgs 780hp-collector 781 hp performance data collectorhp-managed-node 782 hp performance data managed nodehp-alarm-mgr 783 hp performance data alarm managerconcert 786controlit 799mdbs_daemon 800device 801iscsi 860 860 iSCSIsupfilesrv 871 SUP serverrsync 873 Rsync server ( http://rsync.samba.org )accessbuilder 888 Accessbuilder, or Audio CD Databasesamba-swat 901 Samba SWAT tool.Also used by ISS RealSecure.oftep-rpc 950 Often RPC.statd (on Redhat Linux)rndc 953 RNDC is used by BIND 9 (& probably other NS)ftps-data 989 FTP protocol (data) over TLS/SSLftps 990 FTP protocol (control) over TLS/SSLtelnets 992 Telnet protocol over TLS/SSLMay 22, 2006 TCP/IP Ports List [v1.6] Page 11 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 14: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

imaps 993 IMAP4 protocol over TLS/SSLircs 994 IRC protocol over TLS/SSLpop3s 995 POP3 protocol over TLS/SSLxtreelic 996 XTREE License Servervsinet 996maitrd 997busboy 998puparp 998garcon 999applix 999 Applix accadlock 1000silencer 1001 webex 1001 blackice-port-1002 1002ufsd 1008 UFS-aware serversometimes-rpc1 1012 rstatd (OpenBSD)kdm 1024 K Display Manager (KDE version of xdm) Dwyco Video Conferencing (Range: 1024-5000)listen 1025 listener RFS remote_file_sharing network blackjacknterm 1026 remote_login network_terminalwindows-messenger-service 1026 http://www.lurhq.com/popup_spam.htmlicq 1027 ICQicq 1029 ICQicq 1032 ICQiad1 1030 BBN IADiad2 1031 BBN IADiad3 1032 BBN IADnetspy 1033 w2k-printer-port-monitor 1033 fpitp 1045 1045 Fingerprint Image Transfer Protocolwfremotertm 1046 1046 WebFilter Remote Monitorstartron 1057 1057 STARTRONnim 1058nimreg 1059polestar 1060 1060 POLESTARkiosk 1061 1061 KIOSKveracity 1062 1062 Veracitysyscomlan 1065 1065 SYSCOMLANinstl_boots 1067 Installation Bootstrap Proto. Serv.instl_bootc 1068 Installation Bootstrap Proto. Cli.socks 1080 Socks/Wingateansoft-lm-1 1083 Anasoft License Manageransoft-lm-2 1084 Anasoft License Managerxaudio 1103 Xaserver # X Audio Serverxrl 1104 1104 XRLkpop 1109 Pop with Kerberosnfsd-status 1110 NFS Cluster status/Keep-Alive infomsql 1112 mini-sql servermini-sql 1114 1114 Mini SQLsacred 1118 1118 SACREDsupfiledbg 1127 SUP debuggingnfa 1155 Network File Accessnfa 1155 Network File Accessoracle-oms 1159 1159 Oracle OMSphone 1167 conference callingvchat 1168 1168 VChat Conference Servicetripwire 1169 1169 TripWirestreamingaudio 1170 1170 streamingaudioskkserv 1178 SKK (kanji input)mysql-cluster 1186 1186 MySQL Cluster Managerhp-webadmin 1188 1188 HP Web Adminopenvpn 1194 1194 OpenVPNlupa 1212

May 22, 2006 TCP/IP Ports List [v1.6] Page 12 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 15: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

kazaa 1214 1214 KAZAAnerv 1222 SNI R&D networkvpnz 1224 1224 VPNzdns2go 1227 1227 DNS2Goflorence 1228 1228 FLORENCEperiscope 1230 1230 Periscopehotline 1234nessus 1241 nessus client-to-server port remote message servervoodoo 1245 hermes 1248emc-gateway 1273 1273 EMC-Gatewayemperion 1282 1282 Emperionboomerang 1304 1304 Boomerangbmc_patroldb 1313 1313 BMC_PATROLDBalta-ana-lm 1346 Alta Analytics License Managerbbn-mmc 1347 multi media conferencingbbn-mmx 1348 multi media conferencingsbook 1349 Registration Network Protocoleditbench 1350 Registration Network Protocolequationbuilder 1351 Digital Tool Works (MIT)lotusnotes 1352 Lotus Notesrelief 1353 Relief Consultingrelief 1353 Relief Consultingrightbrain 1354 RightBrain Softwarerightbrain 1354 RightBrain Softwareintuitive-edge 1355 Intuitive Edgecuillamartin 1356 CuillaMartin Companypegboard 1357 Electronic PegBoardconnlcli 1358ftsrv 1359mimer 1360linx 1361timeflies 1362ndm-requester 1363 Network DataMover Requesterndm-server 1364 Network DataMover Serveradapt-sna 1365 Network Software Associatesnetware-csp 1366 Novell NetWare Comm Service Platformdcs 1367screencast 1368gv-us 1369 GlobalView to Unix Shellus-gv 1370 Unix Shell to GlobalViewfc-cli 1371 Fujitsu Config Protocolfc-ser 1372 Fujitsu Config Protocolchromagrafx 1373molly 1374 EPI Software Systemsbytex 1375ibm-pps 1376 IBM Person to Person Softwarecichlid 1377 Cichlid License Managerelan 1378 Elan License Managerdbreporter 1379 Integrity Solutionstelesis-licman 1380 Telesis Network License Managerapple-licman 1381 Apple Network License Managergwha 1383 GW Hannaway Network License Manageros-licman 1384 Objective Solutions License Manageratex_elmd 1385 Atex Publishing License Managerchecksum 1386 CheckSum License Managercadsi-lm 1387 Computer Aided Design Software Inc LMobjective-dbc 1388 Objective Solutions DataBase Cacheiclpv-dm 1389 Document Managericlpv-sc 1390 Storage Controllericlpv-sas 1391 Storage Access Servericlpv-pm 1392 Print Managericlpv-nls 1393 Network Log Server

May 22, 2006 TCP/IP Ports List [v1.6] Page 13 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 16: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

iclpv-nlc 1394 Network Log Clienticlpv-wsm 1395 PC Workstation Manager softwaredvl-activemail 1396 DVL Active Mailaudio-activmail 1397 Audio Active Mailvideo-activmail 1398 Video Active Mailcadkey-licman 1399 Cadkey License Managercadkey-tablet 1400 Cadkey Tablet Daemongoldleaf-licman 1401 Goldleaf License Managerprm-sm-np 1402 Prospero Resource Managerprm-nm-np 1403 Prospero Resource Managerigi-lm 1404 Infinite Graphics License Manageribm-res 1405 IBM Remote Execution Starternetlabs-lm 1406 NetLabs License Managerdbsa-lm 1407 DBSA License Managersophia-lm 1408 Sophia License Managerhere-lm 1409 Here License Managerhiq 1410 HiQ License Manageraf 1411 AudioFileinnosys 1412innosys-acl 1413ibm-mqseries 1414 IBM MQSeries 1414 CUSeeMe Vdeo/Audio Serverdbstar 1415novell-lu6.2 1416 Novell LU6.2timbuktu-srv1 1417 Timbuktu Service 1 Porttimbuktu-srv2 1418 Timbuktu Service 2 Porttimbuktu-srv3 1419 Timbuktu Service 3 Porttimbuktu-srv4 1420 Timbuktu Service 4 Portgandalf-lm 1421 Gandalf License Managerautodesk-lm 1422 Autodesk License Manageressbase 1423 Essbase Arbor Softwarehybrid 1424 Hybrid Encryption Protocol 1424 CUSeeMe Vdeo/Audio Serverzion-lm 1425 Zion Software License Managersas-1 1426 Satellite-data Acquisition System 1mloadd 1427 mloadd monitoring toolinformatik-lm 1428 informatik License Managernms 1429 Hypercom NMStpdu 1430 Hypercom TPDUrgtp 1431 Reverse Gossip Transportblueberry-lm 1432 Blueberry Software License Managerms-sql-s 1433 Microsoft-SQL-Serverms-sql-m 1434 Microsoft-SQL-Monitoribm-cics 1435sas-2 1436 Satellite-data Acquisition System 2tabula 1437eicon-server 1438 Eicon Security Agent/Servereicon-x25 1439 Eicon X25/SNA Gatewayeicon-slp 1440 Eicon Service Location Protocolcadis-1 1441 Cadis License Managementcadis-2 1442 Cadis License ManagementWebSTAR/SSL Admin 1443 4D WebStar Web Server Adminmarcam-lm 1444 Marcam License Managementproxima-lm 1445 Proxima License Managerora-lm 1446 Optical Research Associates License Managerapri-lm 1447 Applied Parallel Research LMoc-lm 1448 OpenConnect License Managerpeport 1449dwf 1450 Tandem Distributed Workbench Facilityinfoman 1451 IBM Information Managementgtegsc-lm 1452 GTE Government Systems License Mangenie-lm 1453 Genie License Managerinterhdl_elmd 1454 interHDL License Manageresl-lm 1455 ESL License Manager

May 22, 2006 TCP/IP Ports List [v1.6] Page 14 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 17: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

dca 1456valisys-lm 1457 Valisys License Managernrcabq-lm 1458 Nichols Research Corp.proshare1 1459 Proshare Notebook Applicationproshare2 1460 Proshare Notebook Applicationibm_wrless_lan 1461 IBM Wireless LANworld-lm 1462 World License Managernucleus 1463msl_lmd 1464 MSL License Managerpipes 1465oceansoft-lm 1466 Ocean Software License Managercsdmbase 1467csdm 1468aal-lm 1469 Active Analysis Limited License Manageruaiact 1470 Universal Analyticscsdmbase 1471csdm 1472openmath 1473telefinder 1474taligent-lm 1475 Taligent License Managerclvm-cfg 1476ms-sna-server 1477ms-sna-base 1478dberegister 1479pacerforum 1480airs 1481miteksys-lm 1482 Miteksys License Managerafs 1483 AFS License Managerconfluent 1484 Confluent License Managerlansource 1485nms_topo_serv 1486localinfosrvr 1487docstor 1488dmdocbroker 1489insitu-conf 1490anynetgateway 1491stone-design-1 1492netmap_lm 1493citrix-ica 1494 Citrix MetaFramecvc 1495liberty-lm 1496rfx-lm 1497watcom-sql 1498fhc 1499 Federico Heinz Consultoravlsi-lm 1500 VLSI License Managersas-3 1501 Satellite-data Acquisition System 3shivadiscovery 1502 Shivaimtc-mcs 1503 Databeamevb-elm 1504 EVB Software Engineering License Managerfunkproxy 1505 Funk Software, Inc.utcd 1506 Universal Time daemon (utcd)symplex 1507diagmond 1508robcad-lm 1509 Robcad, Ltd. License Managermvx-lm 1510 Midland Valley Exploration Ltd. License Mgr3l-l1 1511wins 1512 Microsofts Windows Internet Name Servicefujitsu-dtc 1513 Fujitsu Systems Business of America, Incfujitsu-dtcns 1514 Fujitsu Systems Business of America, Incifor-protocol 1515vpad 1516 Virtual Places Audio datavpac 1517 Virtual Places Audio controlvpvd 1518 Virtual Places Video datavpvc 1519 Virtual Places Video control

May 22, 2006 TCP/IP Ports List [v1.6] Page 15 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 18: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

atm-zip-office 1520 atm zip officeoracle-sql 1521 Oracle SQLNet nCube License Managerrna-lm 1522 Ricardo North America License Managercichild-lm 1523ingreslock 1524 ingrespdap 1525 Prosperopdap-np 1526 Prospero Data Access Prot non-privtlisrv 1527 Oraclemciautoreg 1528coauthor 1529 Oraclerap-service 1530rap-listen 1531miroconnect 1532virtual-places 1533 Virtual Places Softwaremicromuse-lm 1534ampr-info 1535ampr-inter 1536sdsc-lm 15373ds-lm 1538intellistor-lm 1539 Intellistor License Managerrds 1540rds2 1541gridgen-elmd 1542simba-cs 1543aspeclmd 1544vistium-share 1545abbaccuray 1546laplink 1547axon-lm 1548 Axon License Managershivasound 1549 Shiva Sound3m-image-lm 1550 Image Storage license manager 3M Companyhecmtl-db 1551pciarray 1552livelan 1555 1555 livelanveritas_pbx 1556 1556 Veritas Private Branch Exchangeweb2host 1559 1559 web2hostets 1569 1569 etsorbixd 1570 1570 orbixdoraclenames 1575 1575 oraclenamessimbaexpress 1583 1583 simbaexpressdialpad 1584 Dialpaddialpad 1585 Dialpadissd 1600citrix-ica 1604 Citrix ICA, MS Terminal Serverskytelnet 1618 1618 skytelnetsoftdataphone 1621 1621 softdataphoneontime 1622 1622 ontimeradius 1645 radius authenticationradacct 1646 radius accountingkermit 1649 1649 kermitnkd 1650shiva_confsrvr 1651xnmp 1652netview-aix-1 1661netview-aix-2 1662netview-aix-3 1663netview-aix-4 1664netview-aix-5 1665netview-aix-6 1666netview-aix-7 1667netview-aix-8 1668netview-aix-9 1669netview-aix-10 1670

May 22, 2006 TCP/IP Ports List [v1.6] Page 16 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 19: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

netview-aix-11 1671netview-aix-12 1672groupwise 1677 1677 groupwiseprolink 1678 1678 prolinkcarboncopy 1680 CarbonCopy Serversnaresecure 1684 1684 SnareSecuregroupwise 1686 1686 http://www.Novell.com/products/groupwise/cuseeme 1720 CUSeeMe Vdeo/Audio Server H.323/Q.931pptp 1723 Point-to-Point Tunnelling Protocolwm-asf 1755 Windows Media (.asf)tftp-multi 1758 TFTP Multicastradius 1812 RADIUS authentication protocol (RFC 2138) 1812 CUSeeMe Vdeo/Audio Serverradacct 1813 RADIUS accounting protocol (RFC 2139) 1813 CUSeeMe Vdeo/Audio Serverpcm 1827 PCM Agent (AutoSecure Policy Compliance Mgr)sugp 1905 1905 Secure UP.Link Gateway Protocollicensedaemon 1986 cisco license managementtr-rsrb-p1 1987 cisco RSRB Priority 1 porttr-rsrb-p2 1988 cisco RSRB Priority 2 porttr-rsrb-p3 1989 cisco RSRB Priority 3 portstun-p1 1990 cisco STUN Priority 1 portstun-p2 1991 cisco STUN Priority 2 portstun-p3 1992 cisco STUN Priority 3 portsnmp-tcp-port 1993 cisco SNMP TCP portstun-port 1994 cisco serial tunnel portperf-port 1995 cisco perf porttr-rsrb-port 1996 cisco Remote SRB portgdp-port 1997 cisco Gateway Discovery Protocolx25-svc-port 1998 cisco X.25 service (XOT)tcp-id-port 1999 cisco identification portcallbook 2000wizard 2001 curryglobe 2002cfingerd 2003 GNU fingermailbox 2004emce 2004 CCWS mm confdeslogin 2005 encrypted symmetric telnet/loginoracle 2005invokator 2006raid-cc 2006 raiddectalk 2007raid-am 2007conf 2008terminaldb 2008news 2009whosockami 2009search 2010 or, nfr411pipe_server 2010raid-cc 2011 raidservserv 2011ttyinfo 2012raid-ac 2012raid-am 2013raid-cd 2013troff 2014raid-sf 2014cypress 2015raid-cs 2015bootserver 2016bootserver 2016cypress-stat 2017bootclient 2017

May 22, 2006 TCP/IP Ports List [v1.6] Page 17 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 20: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

terminaldb 2018rellpack 2018whosockami 2019about 2019xinupageserver 2020servexec 2021xinuexpansion1 2021xinuexpansion2 2022xinuexpansion3 2023xinuexpansion4 2024ellpack 2025xribs 2025scrabble 2026shadowserver 2027submitserver 2028device2 2030blackboard 2032glogger 2033scoremgr 2034imsldoc 2035objectmanager 2038lam 2040interbase 2041isis 2042isis-bcast 2043rimsl 2044cdfunc 2045sdfunc 2046dls 2047dls-monitor 2048nfs 2049 Network File Systemdistrib-net-rsa 2064 distributed.net RSA crypto decipher tooldlsrpn 2065 Data Link Switch Read Port Numberdlswpn 2067 Data Link Switch Write Port Numbergo2call 2090 2090 Go2Callgo2call 2091 Go2Callzephyr-clt 2103 Zephyr serv-hm connectionzephyr-hm 2104 Zephyr hostmanagereklogin 2105 Kerberos (v4) encrypted rloginekshell 2106 Kerberos (v4) encrypted rshellrkinit 2108 Kerberos (v4) remote initializationkx 2111 X over kerberoskip 2112 IP over kerberoskauth 2120 Remote kauthats 2201 Advanced Training System Programivs-video 2232 IVS Video defaultshiva-vpn 2233ivsd 2241 IVS Daemonmysql-im 2273 2273 MySql Instance Managercompaqdiag 2301 Compaq Insight Management Web Agentspehelp 2307netscape-conf 2327 Netscape Conferenceapple-ug 2336 Apple UG Controlms-olap3 2382 2382 Microsoft OLAPms-olap4 2383 2383 Microsoft OLAPfmpro-fdal 2399 2399 Filemaker, Inc. -- Data Access Layercvspserver 2401 CVS network serverg-talk 2421 2421 G-Talkvenus 2430venus-se 2431codasrv 2432codasrv-se 2433rtsserv 2500 Resource Tracking system serverrtsclient 2501 Resource Tracking system clientwlbs 2504May 22, 2006 TCP/IP Ports List [v1.6] Page 18 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 21: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

citrixima 2512 2512 Citrix IMAhp-3000-telnet 2564 HP 3000 NS/VT block mode telnetzebrasrv 2600 zebra servicezebra 2601 zebra vtyripd 2602 RIPd vtyripngd 2603 RIPngd vtyospfd 2604 OSPFd vtybgpd 2605 BGPd vtywebster 2627 Network dictionarysybase 2638 Sybase databasecp-udp-encap 2746 Check Point UDP Encapsulationlisten 2766 System V listener portiss-realsec 2998 ISS RealSecure IDS Remote Console Admin portactive-ppp 3000 Active Worlds Msging Deerfield MDaemon Email Server User-level ppp daemon 3000 Calista IP Phone (Inbound)nessusd 3001 Nessus Security Scanner Daemon Deerfield MDaemon Email Serverdeslogin 3005 Encrypted symmetric telnet/logindeslogind 3006Program Linking 3031 MacOS Apple Events / AgentVUcfs 3049 cryptographic file system (nfs)distrib-net-proxy 3064 proxy port (distributed.net)sj3 3086 SJ3 (kanji input)squid-http 3128squid-ipc 3130vmodem 3141viavideo 3230 3230 Polycom ViaVideo (H.323)viavideo 3231 3231 Polycom ViaVideo (H.323)viavideo 3232 3232 Polycom ViaVideo (H.323)viavideo 3233 3233 Polycom ViaVideo (H.323)viavideo 3234 3234 Polycom ViaVideo (H.323)viavideo 3235 3235 Polycom ViaVideo (H.323)ccmail 3264 cc:Mail/LotusMacOS Net Assistant 3283mysql 3306 mySQLdec-notes 3333 DEC Notesmsrdp 3389 Microsoft Remote Display (Terminal) Protocolbmap 3421 Bull Apprise portmapperbungie-myth 3453 Bungie Myth and Myth II Serverprsvp 3455 RSVP Portvat 3456 VAT default datavat-control 3457 VAT default controltrack 3462 software distributionudt_os 3900 Unidata UDT OSmapper-nodemgr 3984 MAPPER network node managermapper-mapethd 3985 MAPPER TCP/IP servermapper-ws_ethd 3986 MAPPER workstation servernetcheque 4008 NetCheque accountinglockd 4045 NFS lock daemon/manageraol-aim-2 4099 AOL Instant Messanger (Outbound)nuts_dem 4132 NUTS Daemonnuts_bootp 4133 NUTS Bootp Serverwincim 4144 Windows Compuserve ProtocolEIMS Admin 4199rwhois 4321 Remote Who Ismsql 4333 mini-sql serverunicall 4343krb524 4444 Kerberos v5 -> v4 ticket translatorsae-urn 4500fax 4557 FlexFax FAX transmission servicehylafax 4559 HylaFAX client-server protocolrfa 4672 Remote file access server

May 22, 2006 TCP/IP Ports List [v1.6] Page 19 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 22: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

commplex-main 5000 Yahoo Messenger Chat Free Internet Chess Servercommplex-link 5001 Yahoo Messenger Chatrfe 5002 Radio Free EthernetFileMaker Pro 5003 5003 FileMaker Pro over IPtelelpathstart 5010telelpathattack 5011mmcc 5050 multimedia conference control toolrmonitor_secure 5145 RMonitor Secureaol-aim-1 5190 AOL Instant Messanger (Inbound) Calista IP Phone (Outbound)aol-1 5191 AmericaOnline1aol-2 5192 AmericaOnline2aol-3 5193 AmericaOnline3sgi-dgl 5232 SGI Distributed Graphicspadl2sim 5236hacl-hb 5300 HA cluster heartbeathacl-gs 5301 HA cluster general serviceshacl-cfg 5302 HA cluster configurationhacl-probe 5303 HA cluster probinghacl-local 5304hacl-test 5305cfengine 5308pcduo-old 5400 RemCon PC-Duo - old portpcduo 5405 RemCon PC-Duo - new portpostgres 5432 postgres database serverhotline 5499 Hotline Serversecurid 5500 SecurID VNC Server Hotline Serverhotline 5501 Hotline Serverhotline 5502 Hotline Serverhotline 5503 Hotline Serversecureidprop 5510 SecurID ACE/Server servicessdlog 5520 SecurID ACE/Server servicessdserv 5530 SecurID ACE/Server servicessdxauthd 5540 SecurID ACE/Server servicessdadmind 5550 SecurID ACE/Server servicesrplay 5555pcAnywhereData 5631pcAnywhereStat 5632active-worlds 5670 Active Worlds Messaging & Conferencingcanna 5680 Canna (Japanese Input)proshareaudio 5713 proshare conf audioprosharevideo 5714 proshare conf videoprosharedata 5715 proshare conf dataprosharerequest 5716 proshare conf requestprosharenotify 5717 proshare conf notifyvnc 5800 Virtual Network Computervnc 5801 Virtual Network Computervnc 5900 Virtual Network Computervnc-1 5901 Virtual Network Computer Display :1vnc-2 5902 Virtual Network Computer Display :2ncd-pref-tcp 5977 NCD preferences tcp portncd-diag-tcp 5978 NCD diagnostic tcp portncd-conf-tcp 5979 NCD configuration tcp portncd-pref 5997 NCD preferences telnet portncd-diag 5998 NCD diagnostic telnet portncd-conf 5999 NCD configuration telnet portX11 6000 X Window serverX11:1 6001 X Window serverX11:2 6002 X Window server

May 22, 2006 TCP/IP Ports List [v1.6] Page 20 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 23: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

X11:3 6003 X Window serverX11:4 6004 X Window serverX11:5 6005 X Window serverX11:6 6006 X Window serverX11:7 6007 X Window serverX11:8 6008 X Window serverX11:9 6009 X Window serverarcserve 6050 ARCserve agentisdninfo 6105 isdninfoisdninfo 6106 i4lmondsoftcm 6110 HP SoftBench CMspc 6111 HP SoftBench Sub-Process Controldtspc 6112 CDE subprocess controlmeta-corp 6141 Meta Corporation License Manageraspentec-lm 6142 Aspen Technology License Managerwatershed-lm 6143 Watershed License Managerstatsci1-lm 6144 StatSci License Manager - 1statsci2-lm 6145 StatSci License Manager - 2lonewolf-lm 6146 Lone Wolf Systems License Managermontage-lm 6147 Montage License Managerricardo-lm 6148 Ricardo North America License Managergnutella 6346 6346 GNUtella Peer-to-Peer File Sharing Systemnetop-rc 6502 NetOp Remote Control (by Danware Data A/S)xdsxdm 6558irc-serv 6666 internet relay chat serverirc 6667 Internet Relay Chatirc 6668 Internet Relay Chatnapster 6699 Napster Music Sharing Systemacmsoda 6969napster 6699 Napster file (MP3) sharing softwarequicktime 6970 6970 QuickTime Server (UDP Range: 6970-7000) RealMedia Server (UDP Range: 6970-7170)dwyco-video 6700 Dwyco Video Conferencingdwyco-video 6701 Dwyco Video Conferencingdwyco-video 6702 Dwyco Video Conferencingnet2phone 6801 Net2Phonenet2phone 6802 Net2Phonenet2phone 6803 Net2Phonedwyco-video 6880 Dwyco Video Conferencingafs3-fileserver 7000 afs file server Internet Relay Chat ActiveWorlds (Range: 7000-7100)afs3-callback 7001 callbacks to cache managersafs3-prserver 7002 users & groups databaseafs3-vlserver 7003 volume location databaseafs3-kaserver 7004 AFS/Kerberos authentication serviceafs3-volser 7005 volume managment serverafs3-errors 7006 error interpretation serviceafs3-bos 7007 basic overseer processafs3-update 7008 server-to-server updaterafs3-rmtsys 7009 remote cache manager serviceups-onlinet 7010 onlinet uninterruptable power suppliesrealmedia 7070 RealMedia (Audio/Video)font-service 7100 X Font Servicedialpad 7175 Dialpadfodms 7200 FODMS FLIPdlip 7201icb 7326 Internet Citizens Bandqaz 7597 Quaz trojan wormCUSeeMe 7640 CUSeeMe Video/Audio ServerCUSeeMe 7642 CUSeeMe Video/Audio ServerCUSeeMe-1 7648 7648 CUSeeMe Video/Audio ServerCUSeeMe-2 7649 CUSeeMe Video/Audio ServerCUSeeMe-3 7650 CUSeeMe Video/Audio ServerCUSeeMe-4 7651 CUSeeMe Video/Audio ServerMay 22, 2006 TCP/IP Ports List [v1.6] Page 21 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 24: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

active-worlds-2 7777 Active Worlds Messaging & Conferencingshoutcast 8000 Shoucast Streaming MP3 Servershoutcast 8001 Shoucast Streaming MP3 Servershoutcast 8002 Shoucast Streaming MP3 Servershoutcast 8003 Shoucast Streaming MP3 Servershoutcast 8004 Shoucast Streaming MP3 Servershoutcast 8005 Shoucast Streaming MP3 Serverjserv 8007 Apache JServ moduleajp13 8009http-proxy 8080 Common HTTP proxy/second web server portblackice-icecap 8081 ICECap user consoleblackice-alerts 8082 BlackIce Alerts sent to this portcp-cluster 8116 8116 Check Point Clusteringdialpad 8680 Dialpad (Range: 8680-8686)sun-answerbook 8888 Sun Answerbook HTTP serverseosload 8892 Computer Associates eTrust ACXzeus-admin 9090 Zeus Admin Serverjetdirect 9100 HP JetDirectman 9535sd 9876 Session Directorivisit 9943 Ivisitissa 9991 ISS System Scanner Agentissc 9992 ISS System Scanner Consolepalace-chat 9997 Palace Chat Serverpalace-chat 9998 Palace Chat Serverstel 10005 Secure telnetamanda 10080 Amanda Backup Utilamandaidx 10082 Amanda indexingamidxtape 10083 Amanda tape indexingpksd 11371 PGP Public Key Serverdwyco-video 12000 Dwyco Video Conference (Range: 12000-16090)delta3pc2phone 12053 Delta Three PC to Phonedelta3pc2phone 12080 Delta Three PC to Phonedelta3pc2phone 12083 Delta Three PC to Phonedelta3pc2phone 12120 Delta Three PC to Phonedelta3pc2phone 12122 Delta Three PC to Phoneisode-dua 17007biimenu 18000 Beckman Instruments, Inc.liquid-au 18888 LiquidAudiobtx 20005 xcept4 (German Telekoms CEPT videotext service)wnn6 22273 Wnn6 (Japanese input)wnn6_Cn 22289 Wnn6 (Chinese input)wnn6_Kr 22305 Wnn6 (Korean input)wnn6_Tw 22321 Wnn6 (Taiwanse input)hpnpd 22370 Hewlett-Packard Network Printer daemonhpnpd 22370 Hewlett-Packard Network Printer daemoninternetphone 22555 Internet Phonedelta3pc2phone 24150 Delta Three PC to Phone (Range: 24150 - 24179)wnn6_DS 26208 Wnn6 (Dserver)halflife 27015 Half Life Game ServerQuake3Server 27660 Quake 3 Arena Server (for first player)Quake2Server 27910 Quake 2 ServerQuake3Server 27960 Quake 3 Arena Serverheretic2 28910 Heretic II Game ServerSolaris RPC port 32770 Solaris RPC portSolaris RPC port 32771 Solaris RPC port (rusersd)Solaris RPC port 32772 Solaris RPC port (status)Solaris RPC port 32773 Solaris RPC port (rquotad)Solaris RPC port 32774 Solaris RPC port (rusersd)Solaris RPC port 32775 Solaris RPC port (status)Solaris RPC port 32776 Solaris RPC port (sprayd)Solaris RPC port 32777 Solaris RPC port (walld)Solaris RPC port 32778 Solaris RPC port (rstatd)Solaris RPC port 32779 Solaris RPC port

May 22, 2006 TCP/IP Ports List [v1.6] Page 22 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 25: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

May 22, 2006 TCP/IP Ports List [v1.6] Page 23 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Solaris RPC port 32780 Solaris RPC portSolaris RPC port 32786 Solaris RPC port (mountd)Solaris RPC port 32787 Solaris RPC port dmispd (DMI Service Provider)timestep 38036sygatefw 39213 SyGate Firewall Mgmt port v3.0 build 521 and <novell 40193reachout 43188coldfusion-auth 44442 ColdFusion Advanced Security/Siteminder Authcoldfusion-auth 44443 ColdFusion Advanced Security/Siteminder Authciscopop 45000 Cisco PostOffice Protocol for NetRanger (IDS)dbbrowse 47557 Databeam Corporationdialpad 51200 Dialpaddialpad 51201 Dialpaddialpad 51210 Dialpadivisit 56768 Ivisitcuseeme 56800 CUSeeMepcAnywhere 65301 pcAnywhere

###

Page 26: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

Trojan / Backdoor Ports

The following ports should be considered as hostile ports as they are mostly used for trojans or backdoor programs. Hackers/crackers that break into systems often start processes running on one of the following ports and then use them to either regain entry or launch attacks against other sites.

Service Name TCP Port UDP Port Description

0 Click attack (ICMP) 1 Sockets des Troie 2 Death 8 Ping Attack (ICMP) 9 Chargen 19 Chargen 20 Senna Spy FTP server 21 Back Construction Blade Runner Cattivik FTP Server CC Invader Dark FTP Dolly Trojan Fore Invisible FTP Juggernaut 42 Larva MotIv FTP Net Administrator Ramen Senna Spy FTP server The Flu Traitor 21 WebEx WinCrash 22 Shaft 23 Fire HacKer Tiny Telnet Server - TTS Truva Atl 25 Ajan Antigen Barok Email Password Sender (EPS) & EPS II Gip Gris Happy99 Hpteam mail Hybris I love you Kuang2 Magic Horse MBT (Mail Bombing Trojan) Moscow Email trojan Naebi NewApt worm ProMail trojan Shtirlitz Stealth Tapiras Terminator WinSpy

30 Agent 40421 31 Agent 31 Hackers Paradise Masters Paradise

May 22, 2006 TCP/IP Ports List [v1.6] Page 24 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 27: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

41 Deep Throat Foreplay 48 DRAT 50 DRAT 58 DMSetup 59 DMSetup 79 CDK Firehotcker 80 711 trojan (Seven Eleven) AckCmd Back End Back Orifice 2000 Plug-Ins Cafeini CGI Backdoor Executor God Message God Message Creator Hooker IISworm MTX NCX Reverse WWW Tunnel Backdoor RingZero Seeker WAN Remote Web Server CT WebDownloader 81 RemoConChubo 90 Hidden Port 2.0 99 Hidden Port NCX 110 ProMail trojan 113 Invisible Identd Deamon Kazimas 119 Happy99 121 Attack Bot God Message JammerKillah 123 Net Controller 129 Password Generator Protocol 133 Farnaz 137 Netbios name (DoS attacks) Chode 137 Netbios name (DoS attacks) Msinit 138 Chode 139 Netbios session (DoS attacks) Chode God Message worm Msinit Netlog Network Qaz 139 Netbios session (DoS attacks) 142 NetTaxi 146 146 Infector 1.3 170 A-trojan 334 Backage 411 Backage 420 Breach Incognito 421 TCP Wrappers trojan 455 Fatal Connections 456 Hackers Paradise

May 22, 2006 TCP/IP Ports List [v1.6] Page 25 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 28: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

513 Grlogin 514 RPC Backdoor 531 Net666 Rasmin 555 711 trojan (Seven Eleven) Ini-Killer Net Administrator Phase Zero Stealth Spy 605 Secret Service 666 Attack FTP Back Construction BLA trojan Cain & Abel NokNok Satans Back Door - SBD ServU Shadow Phyre th3r1pp3rz (Therippers) 667 SniperNet 669 DP trojan 692 GayOL 777 AIM Spy Application Undetected 808 WinHole 911 Dark Shadow 999 Deep Throat Foreplay WinSatan 1000 Der SpSher / Der Spaeher Direct Connection 1001 Der SpSher / Der Spaeher Le Guardien Silencer WebEx 1010 Doly Trojan 1011 Doly Trojan 1012 Doly Trojan 1015 Doly Trojan 1016 Doly Trojan 1020 Vampire 1024 Jade Latinus NetSpy 1025 Remote Storm 1025 Mavericks Matrix 1.2 - 2.0 Remote Storm 1033 NetSpy 1035 Multidropper 1042 BLA trojan 1045 Rasmin 1049 /sbin/initd 1050 MiniCommand 1053 The Thief 1054 AckCmd 1080 WinHole 1081 WinHole 1082 WinHole 1083 WinHole 1090 Xtreme 1095 Remote Administration Tool - RAT 1097 Remote Administration Tool - RAT 1098 Remote Administration Tool - RAT

May 22, 2006 TCP/IP Ports List [v1.6] Page 26 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 29: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

1099 Blood Fest Evolution Remote Administration Tool - RAT 1150 Orion 1151 Orion 1170 Psyber Stream Server - PSS Streaming Audio Server Voice 1200 NoBackO 1201 NoBackO 1207 SoftWAR 1208 Infector 1212 Kaos 1234 SubSeven Java client Ultors Trojan 1243 BackDoor-G SubSeven Apocalypse Tiles Sub Seven 1245 VooDoo Doll 1255 Scarab 1256 Project nEXT 1269 Mavericks Matrix 1272 The Matrix 1313 NETrojan 1338 Millenium Worm 1349 BackOrifice DLL Comm 1394 GoFriller Backdoor G-1 1441 Remote Storm 1492 FTP99CMP 1524 Trinoo 1568 Remote Hack 1600 Direct Connection Shivka-Burka 1703 Exploiter 1777 Scarab 1807 SpySender 1966 Fake FTP 1967 WM FTP Server 1969 OpC BO 1981 Bowl Shockrave 1999 Back Door SubSeven TransScout 2000 Der SpSher / Der Spaeher Insane Network Last 2000 Remote Explorer 2000 Senna Spy Trojan Generator 2001 Der SpSher / Der Spaeher Trojan Cow 2002 TransScout 2003 TransScout 2004 TransScout 2005 TransScout 2023 Ripper Pro 2080 WinHole 2115 Bugs 2130 Mini Backlash 2140 The Invasor 2140 Deep Throat Foreplay

May 22, 2006 TCP/IP Ports List [v1.6] Page 27 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 30: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

2155 Illusion Mailer 2255 Nirvana 2283 HLV Rat5 2300 Xplorer 2311 Studio 54 2330 Contact 2331 Contact 2332 Contact 2333 Contact 2334 Contact 2335 Contact 2336 Contact 2337 Contact 2338 Contact 2339 Contact Voice Spy 2339 Voice Spy 2345 Doly Trojan 2565 Striker trojan 2583 WinCrash 2600 Digital RootBeer 2716 The Prayer 1.2 -1.3 2721 Phase Zero 2773 SubSeven SubSeven 2.1 Gold 2774 SubSeven SubSeven 2.1 Gold 2801 Phineas Phucker 2989 Remote Administration Tool - RAT 3000 Remote Shut 3024 WinCrash 3028 Ring Zero 3031 Microspy 3128 Reverse WWW Tunnel Backdoor RingZero 3129 Masters Paradise 3150 The Invasor 3150 Deep Throat Foreplay Mini Backlash 3456 Terror trojan 3459 Eclipse 2000 Sanctuary 3700 Portal of Doom 3777 PsychWard 3791 Total Solar Eclypse 3801 Total Solar Eclypse 4000 SkyDance 4092 WinCrash 4100 Watchguard Firebox Admin DoS 4242 Virtual Hacking Machine - VHM 4321 BoBo 4444 Prosiak Swift Remote 4567 File Nail 4590 ICQ Trojan 4950 ICQ Trogen (Lm) 5000 Back Door Setup Blazer5 Bubbel ICKiller Ra1d Sockets des Troie 5001 Back Door Setup

May 22, 2006 TCP/IP Ports List [v1.6] Page 28 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 31: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

Sockets des Troie 5002 cd00r Shaft 5010 Solo 5011 One of the Last Trojans - OOTLT modified 5025 WM Remote KeyLogger 5031 Net Metropolitan 1.0 5032 Net Metropolitan 1.04 5321 Firehotcker 5333 Backage NetDemon 5343 wCrat - WC Remote Administration Tool 5400 Back Construction Blade Runner 5401 Back Construction Blade Runner 5402 Back Construction Blade Runner 5512 Illusion Mailer Xtcp 5521 Illusion Mailer 5534 The Flu 5550 Xtcp 5555 ServeMe 5556 BO Facil 5557 BO Facil 5569 Robo-Hack 5637 PC Crasher 5638 PC Crasher 5742 WinCrash 5760 Portmap Remote Root Linux Exploit 5880 Y3K RAT 5882 5882 Y3K RAT 5888 5888 Y3K RAT 5889 Y3K RAT 6000 The Thing 1.6 6006 Bad Blood 6272 Secret Service 6400 The Thing 6661 TEMan, Weia-Meia 6666 Dark Connection Inside NetBus worm 6667 Sub-7 Trojan (new icq notification) Subseven 2.1.4 DefCon 8 SubSeven Dark FTP ScheduleAgent Trinity WinSatan 6669 Host Control Vampyre 6670 BackWeb Server Deep Throat Foreplay WinNuke eXtreame 6671 Deep Throat 6711 BackDoor-G SubSeven VP Killer 6712 Funny trojan SubSeven 6713 SubSeven 6723 Mstream attack-handler

May 22, 2006 TCP/IP Ports List [v1.6] Page 29 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 32: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

6771 Deep Throat Foreplay 6776 2000 Cracks BackDoor-G SubSeven VP Killer 6838 Mstream Agent-handler 6883 Delta Source DarkStar 6912 Sh*t Heap (not 69123) 6939 Indoctrination 6969 GateCrasher IRC 3 Net Controller Priority 6970 GateCrasher 7000 Exploit Translation Server Kazimas Remote Grab SubSeven SubSeven 2.1 Gold 7001 Freak88 Freak2k 7028 7028 Unknown Trojan 7215 SubSeven SubSeven 2.1 Gold 7300 NetMonitor 7301 NetMonitor 7306 NetMonitor 7307 NetMonitor 7308 NetMonitor 7424 7424 Host Control 7597 QaZ (Remote Access Trojan) 7626 Glacier 7777 God Message Tini 7789 Back Door Setup ICKiller 7891 The ReVeNgEr 7983 MStream handler-agent 8080 Brown Orifice RemoConChubo Reverse WWW Tunnel Backdoor RingZero 8787 Back Orifice 2000 8879 8879 Back Orifice 2000 8988 BacHack 8989 Rcon Recon Xcon 9000 Netministrator 9325 MStream Agent-handler 9400 InCommand 9872 Portal of Doom 9873 Portal of Doom 9874 Portal of Doom 9875 Portal of Doom 9876 Cyber Attacker Rux 9878 TransScout 9989 ini-Killer 9999 The Prayer 1.2 -1.3 10000 OpwinTRojan 10005 OpwinTRojan 10067 Portal of Doom

May 22, 2006 TCP/IP Ports List [v1.6] Page 30 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 33: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

10085 Syphillis 10086 Syphillis 10100 Control Total, Gift trojan 10101 BrainSpy, Silencer 10167 Portal of Doom 10498 Mstream handler-agent 10520 Acid Shivers 10528 Host Control 10607 Coma 10666 Ambush 11000 Senna Spy Trojan Generator 11050 Host Control 11051 Host Control 11223 Progenic trojan Secret Agent 12076 Gjamer 12223 Hack 99 KeyLogger 12345 Ashley cron / crontab Fat Bitch trojan, GabanBus icmp_client.c icmp_pipe.c Mypic NetBus NetBus Toy NetBus worm Pie Bill Gates Ultors Trojan Whack Job X-bill 12346 Fat Bitch trojan GabanBus NetBus X-bill 12349 BioNet 12361 Whack-a-mole 12362 Whack-a-mole 12363 Whack-a-mole 12623 DUN Control 12456 NetBus 12624 ButtMan 12631 Whack Job 12701 Eclypse 2000 12754 Mstream attack-handler 13000 Senna Spy Trojan Generator 13010 Hacker Brasil - HBR 13013 PsychWard 13014 PsychWard 13223 Hack 99 KeyLogger 13473 Chupacabra 13700 Kuang2 the Virus 14500 PC Invader 14501 PC Invader 14502 PC Invader 14503 PC Invader 15000 NetDemon 15092 Host Control 15104 Mstream attack-handler 15382 SubZero 15858 CDK 16484 Mosucker 16660 Stacheldraht 16772 ICQ Revenge

May 22, 2006 TCP/IP Ports List [v1.6] Page 31 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 34: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

16959 SubSeven Subseven 2.1.4 DefCon 8 16969 Priority 17166 Mosaic 17300 Kuang2 the virus 17449 Kid Terror 17499 CrazzyNet 17500 CrazzyNet 17569 Infector 17593 Audiodoor 17777 Nephron 18753 18753 Shafthandler to Agent 19864 ICQ Revenge 20000 Millenium 20001 Millenium Millenium (Lm) 20002 AcidkoR 20005 Mosucker 20023 VP Killer 20034 NetBus 2.0 Pro NetBus 2.0 Pro Hidden NetRex Whack Job 20203 Chupacabra Logged! 20331 BLA trojan 20432 Shaft Client to handlers 20433 Shaft Agent to handlers 21544 GirlFriend Kid Terror 21554 Exploiter Kid Terror Schwindler Winsp00fer 22222 Donald Dick Prosiak Ruler RUX The TIc.K 23005 NetTrash 23006 NetTrash 23023 Logged 23032 Amanda 23432 Asylum 23456 Evil FTP Ugly FTP Whack Job 23476 23476 Donald Dick 23477 Donald Dick 23777 InetSpy 24000 Infector 25685 Moonpie 25686 Moonpie 25982 Moonpie 26274 Delta Source 26681 Voice Spy 26274 Delta Source 27374 Bad Blood Ramen Seeker SubSeven SubSeven 2.1 Gold Subseven 2.1.4 DefCon 8 SubSeven Muie Ttfloader 27444 27444 Trin00/TFN2K

May 22, 2006 TCP/IP Ports List [v1.6] Page 32 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 35: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

27573 SubSeven 2.1 27665 Trin00 DoS Attack 28678 Exploiter 29104 NetTrojan 29369 ovasOn 29891 The Unexplained 30000 Infector 30001 ErrOr32 30003 Lamers Death 30029 AOL Trojan 30100 NetSphere 30101 NetSphere 30102 NetSphere 30103 30103 NetSphere 30133 NetSphere Final 30303 Sockets des Troie 30464 IceCast remote overflow 30947 Intruse 30999 Kuang2 31335 31335 Trin00 DoS Attack 31336 BO-Whack Butt Funneleleet 31337 Back Fire Back Orifice 1.20 patches Back Orifice (Lm) Back Orifice russian Baron Night, Beeone BO client BO Facil BO spy BO2 cron / crontab Freak88 Freak2k icmp_pipe.c Sockdmini 31337 Back Orifice Deep BO 31338 Back Orifice Butt Funnel NetSpy (DK) 31338 Deep BO 31339 NetSpy (DK) 31666 BO-Whack 31785 HackaTack 31787 HackaTack 31788 HackaTack 31789 HackaTack 31790 HackaTack 31791 HackaTack 31792 HackaTack 32001 Donald Dick 32100 Peanut Brittle Project nEXT 32418 Acid Battery 33270 Trinity Trojan 33333 Blakharaz Prosiak 33390 Unknown trojan 33577 Son of PsychWard 33777 Son of PsychWard 33911 Spirit 2000 Spirit 2001 34324 Big Gluck

May 22, 2006 TCP/IP Ports List [v1.6] Page 33 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.

Page 36: TCP/IP Ports List - Razorpoint Security Technologies · TCP/IP Ports List TCP/IP (Transmission ... hostname 101 hostnames NIC Host Name Server ... smip-agent 164 CMIP Agent xns-courier

TN 34444 Donald Dick 34555 Trinoo (Windows only) 35555 Trinoo (Windows only) 37237 Mantis 37651 Yet Another Trojan - YAT 40412 The Spy 40421 Agent 40421 Masters Paradise 40422 Masters Paradise 40423 Masters Paradise 40425 Masters Paradise 40426 Masters Paradise 41337 Storm 41666 Remote Boot Tool (RBT) 43210 Masters Paradise 44444 Prosiak 44575 Exploiter 47252 Delta Source 47262 Delta Source 49301 OnLine KeyLogger 50130 Enterprise 50505 Sockets de Troie 2.0 50766 Fore Schwindler 51966 Cafeini 52317 Acid Battery 2000 53001 Remote Windows Shutdown (RWS) 54283 SubSeven SubSeven 2.1 Gold 54320 Back Orifice 200 (Default Port) 54321 Back Orifice 200 (Default Port) School Bus 55165 File Manager trojan WM Trojan Generator 55166 WM Trojan Generator 57341 NetRaider Trojan 58339 Butt Funnel 60000 Deep Throat Foreplay Sockets des Troie 60001 Trinity 60068 Xzip 6000068 60411 Connection 61348 Bunker-Hill Trojan 61466 TeleCommando 61603 Bunker-Hill Trojan 63485 Bunker-Hill Trojan 64101 Taskman 65000 Devil Sockets des Troie Stacheldraht 65390 Eclypse 65421 Jade 65432 65432 The Traitor (= th3tr41t0r) 65534 /sbin/initd 65535 RC1 trojan

###

May 22, 2006 TCP/IP Ports List [v1.6] Page 34 of 34

31 east 32nd street, sixth floor | new york city, new york 10016-5509 usa | tel: 212.744.6900 | fax: 212.744.6344 | www.razorpointsecurity.com | [email protected] Copyright © 2001-2006 Razorpoint Security Technologies, Inc. All Rights Reserved.