Ping IpAddress with Port number?

If your looking for a port scanner, use somthing like...

Code Snippet

Public Sub PortScan()
        Console.Clear()
        Console.WriteLine("Please Enter IP address: ")
        Dim IP As String = Console.ReadLine()
        Console.WriteLine("Please Enter Starting Port: ")
        Dim StartPort As Integer = Console.ReadLine()
        Console.WriteLine("Please Enter End Port: ")
        Dim EndPort As Integer = Console.ReadLine()
        Dim ListOfPorts As New List(Of Integer)
        Try
            For Port As Integer = StartPort To EndPort
                Console.SetCursorPosition(0, 7)
                Console.Write("Current Port: " & Port)
                If ScanPort(System.Net.IPAddress.Parse(IP), Port) = True Then
                    ListOfPorts.Add(Port)
                End If
            Next
       
            Console.WriteLine(vbCrLf & "List of Open Ports on: " & IP & " (" & System.Net.Dns.GetHostEntry(System.Net.IPAddress.Parse(IP)).HostName & ")")
            For Each Port As Integer In ListOfPorts
                Console.Write(Port & ", ")
            Next
        Catch
            Console.WriteLine(vbCrLf & "Invalid IP specified, Please try again...")
        End Try
    End Sub

    ReadOnly Property ScanPort(ByVal IP As System.Net.IPAddress, ByVal Port As Integer) As Boolean
        Get
            Dim TCP As New System.Net.Sockets.TcpClient
            Try
                TCP.Connect(IP, Port)
            Catch
            End Try
            If TCP.Connected = True Then
                ScanPort = True
                TCP.Close()
            Else
                ScanPort = False
                TCP.Close()
            End If
        End Get
    End Property

It's a bit slow, but if you run the 'ScanPort' property on several threads then you can speed the process up considerably.

It seems like every day there is a new Internet service that uses some new set of poorly-documented, unregistered ports. I created this page to gather together all the information I could find about the ports used by these new services, for use by firewall administrators and other network monitors.

• "dyn" in the ports field denotes dynamically allocated port(s), usually in the range >=1024 <=65535
• A name in the ports field (e.g. LDAP) indicates that service is also required
• A plus sign + in the ports field indicates the service may use a series of ports starting at the specified one
• An asterisk * in the Notes field indicates that the ports are IANA registered

When a specific port is registered it is usually assigned for both TCP and UDP even though only one or the other may be required. Where possible I have only shown the required ones.
This is not intended to list old, well-documented services such as telnet, FTP etc. You can find these in the IANA list.
You may contact me by email with any suggestions or corrections, or post a message to the TCP/IP Ports discussion.

Ports for Internet Services

Service	TCP	UDP	Notes
SSH	22		Secure Shell *
HTTP	80		HyperText Transfer Protocol * (e.g. for web browsing). Currently (2003-07-05) HTTP/1.1 is officially described in RFC 2616.
HOSTS2 Name Server	81	81	* An interesting story. The name attached to this port in the IANA list, Earl Killian, says he shouldn't be. He says "I don't know what 81 is, or whether it is still in use." Since Mr. Killian doesn't know what HOSTS2 is/was, and with Postel gone, I wonder if there's anyone left in the world who knows what 81 was/is for and who actually requested it.
XFER Utility	82	82	* Another interesting story. The name attached to this port in the IANA list, Thomas M. Smith of Lockheed Martin, says Sorry... there is no publicly available information regarding the details of the XFER Utility and its use of tcp and udp port # 82. XFER employs a proprietary protocol which has not been disclosed.
RPC Endpoint Mapper	135	135	* registered as "epmap - DCE endpoint resolution". Used by Microsoft for RPC locator service. See additional information.
LDAP	389	389	Lightweight Directory Access Protocol *
MS NetMeeting	LDAP or ULP, dyn >=1024, 1503, H.323 HostCall, MS ICCP	dyn >=1024	videoconferencing
Timbuktu	407, 1417-1420	407	remote control *
SLP	427	427	Service Location Protocol * Used by MacOS and NetWare.
HTTPs	443		secure HTTP (SSL) *
LPD / printer	515	515	printing * LPD stands for Line Printer Daemon. Also see printing section.
ULP	522	522	User Location Protocol (Microsoft) *
AppleTalk Filing Protocol (AFP)	548	548	*
QuickTime 4	RTSP	RTP-QT4	streaming audio, video *
RTSP	554		Real Time Streaming Protocol *. Currently (2003-07-05) described in RFC 2326.
NNTPs	563		secure NNTP news (SSL) *
Internet Printing Protocol (IPP)	631	631	print remotely to any IPP enabled printer through the Internet * The Common Unix Printing System (CUPS) is based on IPP. Also see printing section.
LDAPs	636	636	secure LDAP * (LDAP protocol over TLS/SSL)
Doom	666	666	network game *
Remotely Possible (ControlIT)	799		remote control. CA ControlIT support.
VMware Virtual Machine Console	902		remote control and viewing of virtual machines. vmware-authd.
SOCKS	1080		internet proxy *. Also used by Trojans.
OpenVPN	1194	1194	*
Kazaa	1214	1214	peer-to-peer file sharing *
WASTE	1337	1337	peer-to-peer. Also see InfoAnarchy WASTE FAQ. This port is officially registered for Men and Mice DNS (QuickDNS Remote).
Lotus Notes Domino	1352		*
VocalTec Internet Phone	1490, 6670, 25793	22555	videoconferencing *
Citrix ICA	1494, dyn >=1023	1604, dyn >=1023	remote application access *
Virtual Places	1533		conferencing *, also see VP voice
Xing StreamWorks		1558	streaming video *
Novell GroupWise (Remote Client)	1677	1677	group collaboration * NOTE: Other features of GroupWise use many other ports.
H.323 Host Call	1720	1720	H.323 host call *
PPTP	1723		virtual private network (VPN) * Note PPTP also uses the GRE protocol. However Microsoft says in Understanding PPTP: "PPTP can be used with most firewalls and routers by enabling traffic destined for port 1723 to be routed through the firewall or router."
MS ICCP	1731	1731	audio call control (Microsoft) *
MS NetShow	1755	1755, dyn >=1024 <=5000	streaming video *
MSN Messenger	1863		instant messenging *. NOTE: For detailed info on ports for file transfers, voice and video, see the Windows and MSN Messenger section below.
Netopia netOctopus	1917, 1921	1917	network management *
Big Brother	1984	1984	network monitoring *
ICU II	2000-2003		videoconferencing. NOTE: security risk on TCP port 50000
iSpQ	2000-2003		videoconferencing. Note: support docs are inconsistent on what ports are required
glimpseserver	2001		search engine
Distributed.Net RC5/DES	2064		distributed computation
SoulSeek	2234, 5534	2234, 5534	file sharing
Microsoft DirectX gaming (DirectPlay) 7	2300-2400, 47624	2300-2400	networked multiplayer games, * only 47624 is registered as "Direct Play Server", if needed also see MSN Gaming Zone
Microsoft DirectX gaming (DirectPlay) 8		2302-2400, 6073	networked multiplayer games, * only 6073 is registered as DirectPlay8, if needed also see MSN Gaming Zone
MADCAP - Multicast Address Dynamic Client Allocation Protocol	2535	2535	* defined in RFC 2730 - Multicast Address Dynamic Client Allocation Protocol (MADCAP). Also used by Trojans.
Netrek	2592		network game *
ShareDirect	2705	2705	peer-to-peer (P2P) filesharing. Officially registered for Sun SDS Admin.
URBISNET	2745	2745	* Alex Tronin reports was used for Urbis geolocation service... now not operational, but may be revived. Also used by Trojans.
Borland Interbase database	3050	3050	* gds_db. See CERT Advisory CA-2001-01 for potential security risk.
squid	3128	3130	web proxy cache. Also used by Trojans.
iSNS	3205	3205	* Internet Storage Name Service, see iSCSI section
iSCSI default port	3260	3260	* SCSI over IP, see iSCSI section
Windows Remote Desktop Protocol (RDP)	3389		* registered as ms-wbt-server. RDP 5.1 is the current version. See below for more information. Remote Desktop Web Connection also uses HTTP.
NetworkLens SSL Event	3410	3410	* Also used by Trojans.
Virtual Places Voice Chat	3450, 8000-9000		voice chat, also see Virtual Places
Apple iTunes music sharing (DAAP)	3689	3689	Digital Audio Access Protocol *
World of Warcraft	3724		online game *
Mirabilis ICQ	dyn >=1024	4000	locator, chat (note: see newer AOL ICQ)
Blizzard / Battle.net	4000, 6112-6119	4000, 6112-6119	network gaming - support (captured 2001-11-11), proxy and firewall info
Abacast	4000-4100, 4500, 9000-9100		peer-to-peer audio and video streaming. NOTE: This software will create OUTGOING streams to other users if it can.
GlobalChat client, server	4020	4020	chat rooms, used to be called ichat
PGPfone		4747	secure phone
PlayLink	4747, 4748, 10090	6144	online games
radmin	4899	4899	remote control *
Yahoo Messenger - Voice Chat	5000-5001	5000-5010	voice chat
GnomeMeeting	H.323 HostCall, 30000-30010	5000-5003, 5010-5013	audio and videoconference. 5000-5003 is RTP and RTCP range for this app.
Yahoo Messenger - messages	5050		messaging. NOTE: It will try ports 5050, 80, any port.
SIP	5060	5060	Session Initiation Protocol *. For audio and video. Currently (2003-07-05) see RFCs 3261, 3262, 3263, 3264, 3265
Apple iChat AV		SIP, RTP-iChatAV	audio and video conferencing. May also need iChat local port.
Yahoo Messenger - Webcams	5100		video
AOL Instant Messenger (AIM)	5190	5190	America OnLine * Also used by Apple iChat (in AIM compatibility mode).
AIM Video IM	1024-5000 ?	1024-5000 ?	video chat. It is unclear from their FAQ whether you need to open both TCP and UDP ports.
AOL ICQ	5190, dyn >=1024		messaging
AOL	5190-5193	5190-5193	America OnLine *
XMPP / Jabber	5222, 5269	5222, 5269	* Extensible Messaging and Presence Protocol. Also see Using Jabber behind firewalls. Defined by XMPP specs (RFCs now issued), specs created by IETF group.
Qnext	5235-5237	5235-5237	audio / video conference, fileshare, everything. Port 5236 is officially assigned to "padl2sim".
iChat local traffic	5298	5298	Some Rendezvous thing.
Multicast DNS	5353	5353	* Mac OS X 10.2: About Multicast DNS. Related to Zeroconf which Apple has implemented as Rendezvous. (Note: the regular Domain Name Service port is 53.)
Dialpad.com	5354, 7175, 8680-8890, 9000, 9450-9460	dyn >=1024	telephony
HotLine	5500-5503		peer-to-peer filesharing.
SGI ESP HTTP	5554	5554	* SGI Embedded Support Partner (ESP) web server. Also used by Trojans, see SGI Security Advisory 20040501-01-I.
InfoSeek Personal Agent	5555	5555	* I don't know if InfoSeek Personal Agent exists anymore. This port is commonly used by HP OpenView Storage Data Protector (formerly HP OmniBack).
pcAnywhere	5631	5632	remote control *
eShare Chat Server	5760
eShare Web Tour	5761
eShare Admin Server	5764
VNC	5800+, 5900+		remote control
Blizzard Battle.net	6112	6112	online gaming
GNUtella	6346, 6347	6346, 6347	peer-to-peer file sharing *
Netscape Conference	H.323 HostCall, 6498, 6502	2327	audioconferencing
Danware NetOp Remote Control	6502	6502	remote control
common IRC	6665-6669		Internet Relay Chat *
Net2Phone CommCenter	selected	6801, selected	telephony, admin should select one TCP and UDP port in the range 1-3000. Same ports are used by Yahoo Messenger - PC-to-Phone.
BitTorrent	6881-6889, 6969		distributed data download, newer versions TCP 6881-6999. Alternate FAQ link.
Blizzard Downloader	World of Warcraft, Battle.net and BitTorrent		downloads patches for World of Warcraft
RTP-QT4		6970-6999	Realtime Transport Protocol. (These ports are specifically for the Apple QT4 version.)
VDOLive	7000	user-specified	streaming video
Real Audio & Video	RTSP, 7070	6970-7170	streaming audio and video
CU-SeeMe, Enhanced CUSM	7648, 7649, LDAP	7648-7652, 24032	videoconferencing
common HTTP	8000, 8001, 8080
Apache JServ Protocol v12 (ajp12)	8007	8007	(default port) See Workers HowTo for config info.
Apache JServ Protocol v13 (ajp13)	8009	8009	(default port) e.g. Apache mod_jk Tomcat connector using ajp13. See Workers HowTo for config info.
Grouper	8038	8038	peer-to-peer (P2P) filesharing
PDL datastream	9100	9100	printing * PDL is Page Description Language. Used commonly by HP printers and by Apple. Also see printing section.
MonkeyCom	9898	9898	* video-chat, also used by Trojans
iVisit		9943, 9945, 56768	videoconferencing
The Palace	9992-9997	9992-9997	chat environment *
common Palace	9998		chat environment
NDMP	10000	10000	Network Data Management Protocol *. Used for storage backup. Also used by Trojans.
Amanda	10080	10080	backup software *. Also used by Trojans.
Yahoo Games	11999		network games
Italk	12345	12345	network chat supporting multiple access methods * Appears mostly used in Japan. There are many other applications calling themselves "italk". TrendMicro OfficeScan antivirus also uses this port. Commonly used by Trojans.
RTP-iChatAV		16384-16403	Used by Apple iChat AV.
RTP		16384-32767	Realtime Transport Protocol. RTP in general is described in RFC 3550. This range is not registered (it never could be, being so broad) but it seems to be somewhat common. See Are there specific ports assigned to RTP?
Palm Computing Network Hotsync	14237	14238	data synchronization
Liquid Audio	18888		streaming audio
FreeTel		21300-21303	audioconferencing
VocalTec Internet Conference	22555	22555	audio & document conferencing *
Quake	26000	26000	network game *
MSN Gaming Zone	28800-29100	28800-29100	network gaming (zone.com, zone.msn.com), also see DirectPlay 7 and DirectPlay 8
Sygate Manager		39213

iSCSI

iSCSI is specified in RFC 3720 - Internet Small Computer Systems Interface.

The well-known user TCP port number for iSCSI connections assigned by IANA is 3260 and this is the default iSCSI port. Implementations needing a system TCP port number may use port 860, the port assigned by IANA as the iSCSI system port; however in order to use port 860, it MUST be explicitly specified - implementations MUST NOT default to use of port 860, as 3260 is the only allowed default.

Also associated with iSCSI is iSNS, Internet Storage Name Service, on port 3205.
These services essentially open up your storage to the Internet in ways even more deep than CIFS, NFS and other file-level sharing services. Therefore you should be very careful about security and may want to block these ports completely, or tightly limit access to them.

Printing

There are several port numbers that may be involved with printing.
Print Server Port Numbers is a useful guide.
The three main ones are LPD ("printer") on port 515, IPP on 631, and PDL-datastream on 9100.
Apple MacOS X Rendezvous Printing (PDF) will discover printers that are advertising their services. They give the example

For example, the Apple LaserWriter 8500 would register the following services,
assuming the default domain is "local."

Apple LaserWriter 8500._printer._tcp.local.        Port 515
Apple LaserWriter 8500._ipp._tcp.local.            Port 631
Apple LaserWriter 8500._pdl-datastream._tcp.local. Port 9100

Napster

After examining Napster, I decided it was such a complex protocol that it deserved its own section. The first thing to be aware of is that there are two versions of Napster. The "original" flavor is what most people will be interested in. This is the full music file-sharing service. This original service provided by Napster.com has now been shut down. Napster.com will be providing a new service with much more controlled music sharing. However, the original protocol lives on, and the protocol has been analyzed so that people could write compatible applications for many different operating systems.
There is information on the protocol (and how to get it through your firewall) from:

• Microsoft Support Q275236
• opennap.sourceforge.net
• david.weekly.org

Here is a summary of the TCP ports it uses. I have put the notation (primary) after the main port, if more than one port is listed.

• metaserver / redirector: 8875
• directory servers: 4444, 5555, 6666, 7777, 8888 (primary)
• client: 6600 to 6699 (primary)

PalTalk

PalTalk is another messy service that uses many ports, more than I want to summarize here. Visit their support page: PalTalk Networking Support.

Ultima Online

Information from What are the port numbers I need to play UO behind a firewall or proxy server?

Service	Ports	Notes
Game	5001-5010
Login	7775-7777
Patch	8888	overlaps with common HTTP port
UO Messenger	8800-8900	includes port 8866 which is also used by Trojan
Patch	9999

Windows and MSN Messenger Application

A related note: the Messenger Service that runs at the Windows SERVICE level is different from the Windows Messenger or MSN Messenger application. For information about the Messenger APPLICATION see

• For file transfer or voice chat ports and NAT information for MSN Messenger 3 see MS Support article Q278887.
• Microsoft Knowledge Base Article Q324214 - You cannot make phone calls or start voice or video conversations with Windows Messenger
• Windows Messenger 5.0 in Windows XP: Working With Firewalls and Network Address Translation Devices
• Microsoft Support WebCast - Microsoft Windows Messenger for Windows XP: New Features, Common Issues, and Troubleshooting July 17, 2002

Service	TCP	UDP	Notes
Windows Messenger - voice (computer to phone)		2001-2120, 6801, 6901	from Q324214. NOTE: 6801 is Net2Phone.
MSN Messenger - file transfers	6891-6900		from Q278887. Allows up to 10 simultaneous transfers.
MSN Messenger - voice communications (computer to computer)	6901	6901	from Q278887

For Windows Messenger in a non-UPnP environment, unfortunately Microsoft requires dynamic UDP ports across a very wide range. This is a tremendous security risk. Try to establish a UPnP environment if possible. Nevertheless, here is what they say To support [audio and video] in both directions through the firewall, all UDP ports between 5004 and 65535 must be opened to allow signaling (SIP) and media streams (RTP) to traverse the firewall.
Also note: I don't know how much information for WINDOWS Messenger applies to MSN Messenger and vice versa. I also don't know how much information for MSN Messenger Windows version applies to MSN Messenger Mac version. And last but not least, there are multiple different versions of Messenger, which may differ in various ways.

Email Ports

Email is sent around the Internet mainly from server to server using SMTP. Once delivered, clients may access it in a variety of ways, including POP3 and IMAP. This section DOES NOT cover Microsoft Exchange or other proprietary mail protocols.
The major upcoming change to email is the use of TCP port 587 "submission" for email, as defined in section 3.1 of RFC 2476 - Message Submission. This is planned to replace the traditional use of TCP port 25, SMTP.

3.1. Submission Identification

Port 587 is reserved for email message submission as specified in this document. Messages received on this port are defined to be submissions. The protocol used is ESMTP [SMTP-MTA, ESMTP], with additional restrictions as specified here.

While most email clients and servers can be configured to use port 587 instead of 25, there are cases where this is not possible or convenient. A site MAY choose to use port 25 for message submission, by designating some hosts to be MSAs and others to be MTAs.

This initiative is being promoted by, amongst others, the Anti-Spam Technical Alliance. See Anti-Spam Technical Alliance Technology and Policy Proposal, Version 1.0, 22 June 2004 (PDF)

We further recommend that SMTP authentication be implemented on the standard Mail Submission Port, port 587, and that ISPs encourage their customers to switch their mail client software (for example, MS Outlook, Eudora, and so on) to this port. Using this port will provide seamless connectivity that does not depend on if a network allows port 25 traffic.

In addition to SMTP, the other main email protocols are POP3 and IMAP, these are protocols for email clients to access their mailboxes. There are many other topics that are outside the scope of this page. For example, email addresses are described in RFC 2822 (obsoletes RFC 822), and SMTP authentication is covered in RFC 2554 - SMTP Service Extension for Authentication. Transport Layer Security (TLS) is covered in RFC 2246 - The TLS Protocol Version 1.0. SMTP over TLS is covered in RFC 3207 - SMTP Service Extension for Secure SMTP over Transport Layer Security.
The Network Sorcery RFC Sourcebook entry for SMTP also links to many relevant RFCs that cover the details of the protocol itself.

Service	TCP Port	Notes
SMTP - Simple Mail Transfer Protocol	25	* As part of the anti-spam best practices, you should block this outgoing for any machine that doesn't need to send email directly.
SMTPs - secure SMTP	465	Port 465 shows up Appendix A of the 1996 non-standard standard The SSL Protocol Version 3.0 as "Simple Mail Transfer Protocol with SSL". Unfortunately, it's not registered for SMTPs, it's registered for URD - "URL Rendesvous Directory for SSM" by Cisco. The recommended approach, at least for authentication, is to use START TLS encryption on submission port 587.
(SMTP email) submission	587	* See RFC 2476 - Message Submission.
POP2 - Post Office Protocol 2	109	* obsolete
POP3 - Post Office Protocol 3	110	*
POP3s - secure POP3	995	* Full description is "pop3 protocol over TLS/SSL (was spop3)".
IMAP3 - Interactive Mail Access Protocol v3	220	* obsolete
IMAP4 - Internet Message Access Protocol 4	143	* Also referred to by version as IMAP4.
IMAPs - secure IMAP	993	* Full description is "imap4 protocol over TLS/SSL". Use 993 instead of TCP port 585 "imap4-ssl", which is deprecated.

Oracle Database TCP/IP Ports

I have a separate page for Oracle ports.

Obsolete Services

Apple released QuickTime 4 some time ago. I am unsure of the status of their older QuickTime Conferencing (MovieTalk) protocol. All of the applications that supported it (Connectix VideoPhone, Apple VideoPhone, Netscape CoolTalk, QuickTime TV) are no longer supported and the QuickTime Conferencing website is gone.

Service	TCP	UDP	Notes
QuickTime Conferencing (MovieTalk)	458	458, dyn >= 7000	videoconferencing *
Apple VideoPhone	MovieTalk	MovieTalk	videoconferencing *
Connectix VideoPhone	MovieTalk	MovieTalk, dyn >=1024, 4242	videoconferencing
Netscape CoolTalk	6499, 6500	13000	videoconferencing

Official TCP/IP Port Assignments

• IANA - TCP/IP Port Assignments (585K)

Also note, although you will sometimes see mention of RFC 1700 "Assigned Numbers" (dated October 1994) it was long ago obsoleted by the official IANA list. Do not use RFC 1700 as a reference. This fact is now officially documented by RFC 3232 "Assigned Numbers: RFC 1700 is Replaced by an On-line Database".
Network Sorcery lists the IANA TCP/UDP Ports with links to pages describing some protocols in detail, as part of its incredibly useful RFC Sourcebook.

Searchable Port Lists

These cover registered, unregistered, and trojan ports - note that many ports have legitimate, required uses, even though people have also used them as trojan ports.

• Andrew Daviel's Network Service Query is a very nice port metasearch engine
• Tantalo.net Ports database
• Neohapsis Ports List
• PC Flank Ports Database
• portsdb.org Ports Database
• Snort Ports Database
• SecurityStats.Com TCP/UDP Port Search
• Dave's Port Lookup lists registered services along with known trojans
• WeetHet in English or in Dutch lists both registered and trojan ports
• UpOneLevel Network Port listing
• Techeez Port Search

Understanding TCP/IP

The IBM RedBooks are an amazing resource for many technical topics. They have a TCP/IP Tutorial and Technical Overview available as HTML or 7.7 MB PDF.
Cisco also provides excellent information online. Internet Protocols is just one section of their Internetworking Technology Handbook.
There is information on IP (the protocol on which TCP and UDP are built) in Internet Core Protocols: The Definitive Guide Sample Chapter 2: The Internet Protocol [IP].

Articles and Related Resources

Windows

This section discusses specific port information related to Microsoft or provided by them. If you are looking for information about Windows firewalls, including XP Service Pack 2, see the Windows Security Software and Built-in Windows Firewalls sections of my Trojan TCP/IP Ports page.
Microsoft has announced a new Windows Firewall in Windows XP Service Pack 2, it replaces the Internet Connection Firewall (ICF) in previous versions of Windows.

• MS KB 842242 - Some programs seem to stop working after you install Windows XP Service Pack 2 has a section "Identifying and opening ports" and also a fairly extensive list of ports in "Programs that may require you to open ports manually", although for all of the games it says "see the documentation" in the Ports column which is not exactly helpful information.
• How to Open Ports in the Windows XP Internet Connection Firewall has a list of ports followed by instructions
• Port Requirements for the Microsoft Windows Server System (KB 832017)
• TCP and UDP Port Assignments (Windows 2000 Server - Resource Kits - TCP/IP Core Networking Guide - Appendix C)
• NetBIOS Over TCP/IP [original page removed; using archive.org version]
• Firewall Information - Windows Media Technologies
• Microsoft has provided a good list of Windows NT, Terminal Server, and Microsoft Exchange Services Use TCP/IP Ports
• TCP/UDP Ports Used By Exchange 2000 Server
• Active Directory Replication over Firewalls
• TCP, UDP, and RPC Ports Used by MSMQ (Microsoft Message Queue Server)
• A List of the Windows 2000 Domain Controller Default Ports

More information about Windows Remote Desktop Protocol (RDP)

As indicated in the RDP section above, this protocol uses a registered TCP port. It is used for XP Pro Remote Desktop and XP Remote Assistance (read Administering Remote Assistance for a very good overview of firewall, NAT and blocking issues). Also used for WinNT4 Terminal Server, Win2000 Terminal Services, and Win .NET Server 2003 Terminal Server.

Windows Remote Procedure Call (RPC) and Distributed COM (DCOM)

In some cases, Microsoft uses port 135 as an RPC Endpoint Mapper. Runs as RPCSS on (some versions of?) Windows. This is a sort of "RPC directory" service which can be used to lookup what ports other services are running on. For some additional information, see Windows 2000 Network Architecture: Remote Procedure Call and NT Gatekeeper: RPC and Firewall Configuration.
MS-RPC on port 135 is required for some Exchange Server and Active Directory communications. See e.g. TCP Ports and Microsoft Exchange: In-depth Discussion and Restricting Active Directory Replication Traffic to a Specific Port.
However this port also poses a security risk, as indicated in the NET SEND section of my broadband security page.
UPDATE 2003-08-13: Also see the Blaster Worm section for information about this additional security risk.
Additional information:

• Using Distributed COM with Firewalls
• RPC and Firewall Configuration
  Sidebar: RPC Dynamic Port Allocation

Mac

OpenDoor (makers of DoorStop) have a nice list of MacOS-related ports, with hyperlinks to relevant information.
Apple support has provided a list of "Well Known" TCP and UDP Ports Used By Apple Software Products.
Although it doesn't give any port numbers, you may find Rendezvous service types being used by Mac OS X useful.

Novell (NetWare)

• Novell Documentation: NetWare 6 - Port Number Assignments
• Matrix of Ports used in NetWare 6 - TID 10065719
• TCP/IP Port Numbers used by Novell Products - TID 10014320 (NetWare 5.0 and earlier)

IBM (WebSphere)

• Firewall Port Assignments in WebSphere Application Server V5

IP Telephony / Voice over IP (VoIP) / H.323 / SIP / RTP

Some applications that use H.323 include: ohphone, ohphoneX, ...
Getting H.323 audio/video conferencing through firewalls is particularly problematic. I have used Google cache to rescue an Intel document The Problems and Pitfalls of Getting H.323 Safely Through Firewalls. Note in particular that RTCP (Real Time Control Protocol) has no fixed port, an RTCP session is paired with an RTP session, if you have an RTP stream on even numbered UDP port x, RTCP is on x + 1.

• IP Ports and Protocols used by H.323 Devices
• Cisco: IP Telephony / VoIP Traversal of NAT and Firewall

General

The white paper Cisco PIX Firewall and Stateful Firewall Security contains some useful information about the ports and connection protocols for VDOnet, CU-SeeMe, and RealAudio.
Ed Bott's article Block those ports! contains some useful information, and also a kind review of this web page.
You can check out Internet Firewalls: Frequently Asked Questions. As of this writing it was last updated 2000/12/01 but it still has lots of good information.
NetGear's Applications Port List lists a lot of games.
Tim Williams' list of Ports Used by Computer Games has lots of good info.
By popular request: a page on Blocking Chat Programs.
More and more good resources are becoming available, particularly for people with home networks. If you haven't found what you were looking for here, you can try:

• PracticallyNetworked:
  • Handling Special Applications
  • Special Applications - Opening Ports
  • Special Applications - Port List
• HomeNetHelp:
  • Explaining DMZs and Port Forwarding
  • Port list for running a server through a router
  • Port list for running a game server through a router or firewall

Network Protocols

Note that certain services such as IPSec and Microsoft's PPTP use non-TCP/UDP protocols so they may be more complicated to use. In particular, PPTP uses GRE (protocol 47) and IPSec uses ESP (protocol 50) and AH (protocol 51). Protocol numbers are not the same as port numbers. IANA maintains the Assigned Internet Protocol Numbers.

MORE ABOUT HACKING TOOLS - NOW A DAYS

CUDA-Multiforcer – GPU Powered High Performance Multihash Brute Forcer

The Cryptohaze Multiforcer is a high performance multihash brute forcer with support for per-position character sets, and very good performance scaling when dealing with large hash lists. As an example, on a list of 10 hashes, the Cryptohaze Multiforcer achieves 390M steps per second on a GTX260/216SP@1.24ghz card. On a list of 1.4 million hashes with the same card, performance drops to 380M steps per second. This is the password stepping rate – not the search rate. The search rate is 380M * 1.4M passwords per second!
Platforms
The Cryptohaze Multiforcer supports Windows, Linux, and Mac OS X. An nVidia GPU with CUDA support (8000 series, 9000 series, GTX200 series, GTX400 series) is required for this to function. Additionally, a reasonably modern driver with CUDA support will be required. However, to see good rates, a fairly powerful GPU is required. GTX200 series cards are the lowest recommended cards.
Usage

The Multiforcer takes two files as inputs: the hash file, and the character set file. The hash file is very simple: One hash per line as follows:
Hash input file

C55DC1C662628C7B3B85635A4E96262A
5F4DCC3B5AA765D61D8327DEB882CF99
0040F2ABC2CFF0C8F59883B99AE9FAB6
D41D8CD98F00B204E9800998ECF8427E

The character set file is slightly more complex. For a single character set (the same character set applied to all positions), the character set file is very simple: Just the character set in a file, followed by a newline:
Single charset file (-c parameter)

abcdefghijklmnopqrstuvwzyx0123456789

You can download CUDA-Multiforcer here:

MacOS (Intel Only) – CUDA-Multiforcer-Mac-0.72.tar.bz2
Windows (64-Bit Only) – CUDA-Multiforcer-Windows-0.72.zip
Linux – (32 & 64-Bit) – CUDA-Multiforcer-Linux-0.72.tar.bz2

Crunch – Password Cracking Wordlist Generator

Crunch is a wordlist generator where you can specify a standard character set or a character set you specify. crunch can generate all possible combinations and permutations.
Some other options are:

• The Associative Word List Generator (AWLG) – Wordlists for Password Cracking
• CeWL – Custom Word List Generator Tool for Password Cracking
• RSMangler – Keyword Based Wordlist Generator For Bruteforcing
• CUPP – Common User Passwords Profiler – Automated Password Profiling Tool

Of course John the Ripper (JTR) has some built in options for creating permutations from Wordlists.

Features

• Crunch generates wordlists in both combination and permutation ways
• It can breakup output by number of lines or file size
• Now has resume support
• Pattern now supports number and symbols
• Pattern now supports upper and lower case characters separately
• Adds a status report when generating multiple files

You can download Crunch here:
crunch2.6.tgz

Armitage – Cyber Attack Management & GUI For Metasploit

Armitage is a graphical cyber attack management tool for Metasploit that visualizes your targets, recommends exploits, and exposes the advanced capabilities of the framework. Armitage aims to make Metasploit usable for security practitioners who understand hacking but don’t use Metasploit every day. If you want to learn Metasploit and grow into the advanced features, Armitage can help you.
Armitage organizes Metasploit’s capabilities around the hacking process. There are features for discovery, access, post-exploitation, and maneuver.
For discovery, Armitage exposes several of Metasploit’s host management features. You can import hosts and launch scans to populate a database of targets. Armitage also visualizes the database of targets–you’ll always know which hosts you’re working with and where you have sessions.
Armitage assists with remote exploitation–providing features to automatically recommend exploits and even run active checks so you know which exploits will work. If these options fail, you can use the Hail Mary approach and unleash db_autopwn against your target database.
For those of you who are hacking post-2003, Armitage exposes the client-side features of Metasploit. You can launch browser exploits, generate malicious files, and create Meterpreter executables.
Once you’re in, Armitage provides several post-exploitation tools built on the capabilities of the Meterpreter agent. With the click of a menu you will escalate your privileges, dump password hashes to a local credentials database, browse the file system like your local, and launch command shells.
Finally, Armitage aids the process of setting up pivots, a capability that lets you use compromised hosts as a platform for attacking other hosts and further investigating the target network. Armitage also exposes Metasploit’s SOCKS proxy module which allows external tools to take advantage of these pivots. With these tools, you can further explore and maneuver through the network.
If you want to learn more about Metasploit there are also some great resources here:
Learn to use Metasploit – Tutorials, Docs & Videos
Requirements
To use Armitage, you need the following:

• Linux or Windows
• Java 1.6+
• Metasploit Framework 3.5+
• A configured database. Make sure you know the username, password, and host.

Armitage Changelog
You can download Armitage here:
Windows – armitage112510.zip
Linux – armitage112510.tgz

Top 10 Linux Hacking Tools

1. nmap – Nmap (“Network Mapper”) is a free open source utility for network exploration or security auditing. It was designed to rapidly scan large networks, although it works fine against single hosts. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. Nmap runs on most types of computers and both console and graphical versions are available.

2. Nikto – Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 3200 potentially dangerous files/CGIs, versions on over 625 servers, and version specific problems on over 230 servers. Scan items and plugins are frequently updated and can be automatically updated (if desired).

3. THC-Amap – Amap is a next-generation tool for assistingnetwork penetration testing. It performs fast and reliable application protocol detection, independant on the TCP/UDP port they are being bound to.

4. Ethereal – Ethereal is used by network professionals around the world for troubleshooting, analysis, software and protocol development, and education. It has all of the standard features you would expect in a protocol analyzer, and several features not seen in any other product.

5. THC-Hydra – Number one of the biggest security holes are passwords, as every password security study shows. Hydra is a parallized login cracker which supports numerous protocols to attack. New modules are easy to add, beside that, it is flexible and very fast.

6. Metasploit Framework – The Metasploit Framework is an advanced open-source platform for developing, testing, and using exploit code. This project initially started off as a portable network game and has evolved into a powerful tool for penetration testing, exploit development, and vulnerability research.

7. John the Ripper – John the Ripper is a fast password cracker, currently available for many flavors of Unix (11 are officially supported, not counting different architectures), DOS, Win32, BeOS, and OpenVMS. Its primary purpose is to detect weak Unix passwords. Besides several crypt(3) password hash types most commonly found on various Unix flavors, supported out of the box are Kerberos AFS and Windows NT/2000/XP/2003 LM hashes, plus several more with contributed patches.

8. Nessus – Nessus is the world’s most popular vulnerability scanner used in over 75,000 organisations world-wide. Many of the world’s largest organisations are realising significant cost savings by using Nessus to audit business-critical enterprise devices and applications.

9. IRPAS – Internetwork Routing Protocol Attack Suite – Routing protocols are by definition protocols, which are used by routers to communicate with each other about ways to deliver routed protocols, such as IP. While many improvements have been done to the host security since the early days of the Internet, the core of this network still uses unauthenticated services for critical communication.

10. Rainbowcrack – RainbowCrack is a general propose implementation of Philippe Oechslin’s faster time-memory trade-off technique. In short, the RainbowCrack tool is a hash cracker. A traditional brute force cracker try all possible plaintexts one by one in cracking time. It is time consuming to break complex password in this way. The idea of time-memory trade-off is to do all cracking time computation in advance and store the result in files so called “rainbow table”.

Top free troubleshooting tools for Windows
These seven handy tools help you diagnose and cure a wide range of Windows ills, and they're all free for the downloading

No computer runs perfectly forever. Somewhere along the line, something will go wrong. While each successive version of Windows has been that much more reliable and self-healing, that's never been an argument to forgo a good collection of software tools.

Over the years I've accumulated a slew of third-party troubleshooting apps that have proven their value again and again, so much so that they're among the very first programs installed in any system I use. If something goes wrong -- a Blue Screen of Death, a slow-booting system, a recent program install that's made everything slower than molasses going uphill in January -- I turn to these tools to set things right. All of them are free for personal use, some are open source, and each of them deserves a place in the toolbox of the savvy Windows user.

[ There's no shortage of great free tools for Windows. See also "Top 10 Windows tools for IT pros" and "The best free open source software for Windows." ]

Sysinternals's Process Explorer
"Task Manager on steroids" -- that's how someone described Process Explorer to me when Mark Russinovich first released it many years ago. It can replace Task Manager or run side by side with it, but either way it's an absolute must-have for technically savvy users. I typically use it as the replacement for Task Manager on any PC I run; it's just too handy not to have installed.

When you launch Process Explorer, you'll see a tree view of processes; they're nominally organized by which process spawned which, but you can click on the column headers to change the sorting as you please. The top portion of the window has four graphs: CPU usage, commit history, I/O bytes history, and physical memory history. Click on one to bring up a full-sized window view that's akin to the Performance tab in Task Manager -- but with a level of detail and insight into what programs are doing that Task Manager doesn't even come close to providing.

Double-click on the name of a process, and up pops a window with a startling amount of detail: the process's running threads (and the stack for each thread), which can be frozen or killed; its permissions; its network access; the program it was launched from; even a dump of text strings in either the on-disk program image or its copy in memory. Processes, or whole trees of them, can be killed off, frozen, resumed, or have their windows or priorities manipulated -- handy if a process window vanishes behind something else and you need to force it to the front. You can also toggle on or off a lower pane that contains detailed information about a process, find the process for a particular window by pointing to it, or search by name for any running process, handle, or DLL.

System Information for Windows
No other free tool I've encountered packs as much true utility into a single executable as this one. System Information for Windows, abbreviated as SIW, has replaced more than a dozen other programs I've used that dump one kind of system or application data or another. SIW lists application license keys, probes installed hardware, fetches device temperatures, catalogs installed multimedia codecs -- the list seems endless.

SIW is organized into four basic categories. Three of them are available through a tree view on the left side of the program window: Software, Hardware, and Network. Click on a branch of any of those items and you'll see the right-hand window pane fill with the corresponding data. The harvesting process may take a moment, especially for things like device lists, so don't freak out if you have to wait a bit before SIW pulls everything together. Half the fun of using the program is just spelunking through these three lists and seeing what's available.

The fourth category is a gaggle of miscellaneous tools in the program's Tools drop-down menu. This is stuff program author Gabriel Topala apparently couldn't fit in one of the previous three areas, but still wanted to include. Among them are such goodies as Eureka, a way to expose starred-out password fields in most any program; a tool for sending a wake-on-LAN packet to the MAC address of your choice; a BIOS dumping tool; a Base64/UUencoder-decoder; a CPU stress test; and plenty more. SIW even runs in the Windows Recovery Environment.

One caveat: SIW is mostly read-only. While it's good at listing or dumping out system information, it doesn't always allow you to change those settings. If you wanted to disable or enable ActiveX controls listed through SIW, for instance, you'd need to do that with a third-party utility such as Nirsoft's ActiveXHelper.

BlueScreenView
In Windows, there's little worse than dealing with a Blue Screen of Death, or BSOD for short. Aside from being cryptic and difficult to decipher -- especially since some BSODs can have multiple causes -- they're just plain annoying. Granted, BSODs happen much less frequently these days, but when they do it's no less of a chore. After dealing with a whole slew of BSODs the other month -- which turned out to be a hardware issue -- I hunted around for tools to help analyze BSODs and found one that did the job and more: BlueScreenView.

When a BSOD occurs the results are, whenever possible, saved into a dump file that can be examined later. BlueScreenView scans your system for these files and produces a report from them, which you can read within BlueScreenView itself or save to HTML for separate analysis. Each line in the report describes the BSOD's crash code, the time and date of its occurrence, any parameters that might have been passed with the crash (useful for debugging), and a slew of other minor details. The results are searchable, so you can hunt for a particular crash code, driver, or DLL that you think might be present.

Another thing BlueScreenView does is list all of the device drivers that were running at the time of the crash. If a particular driver was listed as the cause of the crash, it's flagged and displayed in red. You can filter out all the other drivers that were loaded at the time if you just want to focus on the culprit. You can also load dump files copied in from elsewhere by pointing to a folder, or even from computers accessible across the local network (provided you have permission to do so).

One minor annoyance with BlueScreenView involves the reporting function. If you want to print out both a crash message and its attendant driver stack, you have to treat them as separate reports. That said, the core crash message typically lists the offending driver; if nothing else, you can use the basic BSOD report to derive all the most crucial information.
Sysinternals' Autoruns
One of the great banes of any Windows user's life is software that insists on shoehorning things into the system to launch at startup, whether or not you actually need or want any of it. Scanner and printer drivers are among the worst offenders in this regard. They often insist on installing a bunch of system-tray-resident utilities of dubious usefulness.

Autoruns -- by Mark Russinovich, of Process Explorer fame -- not only roots out these annoyances, but it comes in handy for so many other things that it's simply indispensible. Autoruns probes your system and dumps out lists of programs and system components that start automatically, without user intervention -- from apps in your Startup folder to scheduled tasks, from services to device drivers, from Sidebar gadgets to codecs. By default it dumps out data pertinent to the current user context, but the program's User menu lets you switch contexts. (You'll need to run the program as Administrator, though.)

Autoruns organizes its views into the system by tabs (Logon, Services, Explorer, Internet Explorer, Drivers), making it easy to drill down to the entries you're most concerned about. You can disable any app or service without actually deleting it, simply by unchecking a box, or you can remove it entirely with a selection from the right-click menu. That same menu also has options for jumping to the service's entry in the Registry, verifying its code signature, and looking it up on Google.

Select Options | Hide Microsoft and Windows Entries, and when you next run Autoruns or click Refresh, you'll see only third-party applications -- a handy way to focus only on programs added to Windows after the fact and, thus, might be a problem. If Process Explorer is currently running, you can right-click on an item and bring up its Properties pane in Process Explorer, assuming said item is actually running.

Autoruns also comes in a command-line version, which can be used with scripts or other automation. Finally, check out a video for some neat Autoruns usage tips, from Mark Russinovich himself.