| 20 | FTP Data | TCP | File Transfer | FTP data transfer channel |
| 21 | FTP Control | TCP | File Transfer | FTP command/control channel |
| 22 | SSH | TCP | Remote Access | Secure Shell — encrypted remote login and file transfer |
| 23 | Telnet | TCP | Remote Access | Unencrypted remote terminal access (insecure) |
| 25 | SMTP | TCP | Email | Simple Mail Transfer Protocol — sending email |
| 53 | DNS | TCP/UDP | Name Resolution | Domain Name System — resolves domain names to IPs |
| 67 | DHCP Server | UDP | Network Config | Dynamic Host Configuration Protocol — server side |
| 68 | DHCP Client | UDP | Network Config | Dynamic Host Configuration Protocol — client side |
| 69 | TFTP | UDP | File Transfer | Trivial File Transfer Protocol — simple, no authentication |
| 80 | HTTP | TCP | Web | Hypertext Transfer Protocol — unencrypted web traffic |
| 88 | Kerberos | TCP/UDP | Authentication | Kerberos authentication protocol |
| 110 | POP3 | TCP | Email | Post Office Protocol v3 — retrieving email |
| 119 | NNTP | TCP | News | Network News Transfer Protocol |
| 123 | NTP | UDP | Time Sync | Network Time Protocol — clock synchronization |
| 135 | RPC/DCOM | TCP | Windows | Microsoft RPC Endpoint Mapper |
| 137 | NetBIOS Name | UDP | Windows | NetBIOS Name Service |
| 138 | NetBIOS Datagram | UDP | Windows | NetBIOS Datagram Service |
| 139 | NetBIOS Session | TCP | Windows | NetBIOS Session Service — file/printer sharing |
| 143 | IMAP | TCP | Email | Internet Message Access Protocol — retrieving email |
| 161 | SNMP | UDP | Network Mgmt | Simple Network Management Protocol — queries |
| 162 | SNMP Trap | UDP | Network Mgmt | SNMP Trap — agent-initiated alerts |
| 389 | LDAP | TCP | Directory | Lightweight Directory Access Protocol |
| 443 | HTTPS | TCP | Web | HTTP over TLS — encrypted web traffic |
| 445 | SMB | TCP | File Sharing | Server Message Block — Windows file/printer sharing |
| 465 | SMTPS | TCP | Email | SMTP over TLS (implicit) |
| 500 | IKE | UDP | VPN | Internet Key Exchange — IPSec VPN negotiation |
| 514 | Syslog | UDP | Logging | System logging protocol |
| 587 | SMTP Submission | TCP | Email | SMTP message submission with STARTTLS |
| 636 | LDAPS | TCP | Directory | LDAP over SSL/TLS — encrypted directory queries |
| 993 | IMAPS | TCP | Email | IMAP over SSL/TLS — encrypted email retrieval |
| 995 | POP3S | TCP | Email | POP3 over SSL/TLS — encrypted email retrieval |
| 1433 | MS SQL | TCP | Database | Microsoft SQL Server |
| 1521 | Oracle DB | TCP | Database | Oracle database listener |
| 1723 | PPTP | TCP | VPN | Point-to-Point Tunneling Protocol (legacy VPN) |
| 3306 | MySQL | TCP | Database | MySQL / MariaDB database |
| 3389 | RDP | TCP | Remote Access | Remote Desktop Protocol — Windows remote GUI |
| 5060 | SIP | TCP/UDP | VoIP | Session Initiation Protocol — voice/video calls |
| 5061 | SIP TLS | TCP | VoIP | SIP over TLS — encrypted voice/video signaling |
| 5432 | PostgreSQL | TCP | Database | PostgreSQL database |
| 5900 | VNC | TCP | Remote Access | Virtual Network Computing — remote desktop |
| 6379 | Redis | TCP | Database | Redis in-memory data store |
| 8080 | HTTP Alt | TCP | Web | Common HTTP alternative/proxy port |
| 8443 | HTTPS Alt | TCP | Web | Common HTTPS alternative port |
| 27017 | MongoDB | TCP | Database | MongoDB NoSQL database |
| 49152 | Dynamic/Private | TCP/UDP | Ephemeral | Start of dynamic/private port range (49152-65535) |
