Port Number Lookup

About Port Number Lookup

A working reference for the ports that actually turn up in firewall rules, packet captures and incident reviews - with a note on which ones have no business facing the internet.

Ephemeral port exhaustion

Each outbound TCP connection consumes a source port, and the dynamic range gives roughly 28,000 to 16,000 per destination tuple depending on platform. A busy proxy or NAT device making many short-lived connections to the same backend can exhaust the range, at which point new connections fail while the machine looks idle. Connections held in TIME_WAIT for 60 seconds are the usual cause, and connection pooling — not tuning the timeout down — is the correct fix.

Ephemeral ports and why they matter

Outbound connections use a source port from the dynamic range, typically 32768-60999 on Linux and 49152-65535 on Windows. A stateful firewall tracks the flow and permits the return traffic automatically, which is why you write rules for destination ports and not source ports. NAT devices are limited by this range too: roughly 64,000 concurrent translations per public address per protocol, which is the constraint behind CGNAT port block sizing.

Common use cases

• Identifying an unexpected listener found during an audit.
• Writing a firewall rule for a service you have not deployed before.
• Checking whether a port seen in logs is something to worry about.

Edge cases and gotchas

• A port number is a convention, not an identity - anything can listen on any port, and malware routinely uses 443 to blend in.
• Never forward RDP (3389), SMB (445) or Telnet (23) to the internet.