Network Port Ranges: Well-Known, Registered, and Dynamic Ports
Network port numbers run from 0 to 65535. IANA divides them into well-known ports (0–1023), registered ports (1024–49151), and dynamic or private ports (49152–65535). These ranges describe number assignment; a port number alone does not identify the application communicating or determine what a firewall should allow.
The three port-number ranges
The Internet Assigned Numbers Authority (IANA) maintains the registry of service names and port numbers for transport protocols. RFC 6335 defines these ranges as follows.
| Category | Port numbers | Meaning |
|---|---|---|
| Well-known ports System / Well-Known Ports |
0~1023 | Service numbers assigned through IANA’s stricter system-port procedures |
| Registered ports User / Registered Ports |
1024~49151 | Service numbers registered and assigned through IANA |
| Dynamic or private ports Dynamic / Private Ports |
49152~65535 | Local and dynamic use; IANA does not assign these as service identifiers |
Not every number in the registered-port range is actually registered. Distinguish assigned, unassigned and reserved numbers. Although 0 is within the numerical range, the IANA registry reserves it for both TCP and UDP; it is not an ordinary service-port example.
Why the number and TCP or UDP must be considered together
An IP address identifies a source or destination address, while a port helps distinguish the service or socket handling communication at that address. Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) use separate port-number spaces. TCP 53 and UDP 53 therefore require separate consideration despite having the same number.
Common examples include HTTP on TCP 80, HTTPS on TCP 443 and Secure Shell (SSH) on TCP 22. The Domain Name System (DNS) uses port 53 with TCP and UDP. Examples in the registered range include MySQL on TCP 3306 and remote desktop on TCP 3389. These are representative uses, not an exhaustive list of registered transports or a substitute for actual settings.
A server may listen on a different number, and another program may use a familiar one. An open TCP 3306 alone does not confirm MySQL or safe traffic. IANA also states that registration neither endorses a product nor guarantees that traffic on the number belongs to the assigned service.
Server ports versus client ephemeral ports
A client connecting to a server’s TCP 443 does not necessarily use 443 at both ends. The following hypothetical connection uses source port 51514. Actual numbers depend on the operating system and connection.
TCP: client:51514 -> server:443
TCP: server:443 -> client:51514The server’s 443 is the destination port used to reach the service; the client’s 51514 is its local ephemeral port. Source and destination reverse in the response. A TCP connection is distinguished by its protocol and both IP address/port pairs, so one port does not mean only one connection.
“Private” in dynamic/private ports does not mean a private IP address or automatic blocking from outside. Nor is a number in this range always free. If a device or intermediate network address translation (NAT) changes addresses or ports, the observed connection details can differ by observation point.
Inspecting the operating system’s ephemeral-port range
Distinguish IANA’s dynamic range from the range an operating system uses automatically. Microsoft’s dynamic-port documentation describes the default as 49152–65535 starting with Windows Vista and Server 2008, but inspect the current device to confirm its configuration.
On Windows, run these queries in PowerShell or Command Prompt. Check IPv4 and IPv6 separately for TCP and UDP. The commands do not change settings.
netsh int ipv4 show dynamicport tcp
netsh int ipv4 show dynamicport udp
netsh int ipv6 show dynamicport tcp
netsh int ipv6 show dynamicport udpRead the start port and number of ports. For example, a start of 49152 and count of 16384 gives a last port of 49152 + 16384 - 1 = 65535. Do not mistake the count for the final port. The result describes the automatic-selection range, not the availability of every number.
On Linux, read the following file to inspect the local range. Run it in the Linux environment that actually handles the communication.
cat /proc/sys/net/ipv4/ip_local_port_rangeThe two integers are the first and last port numbers. The Linux kernel documentation for ip_local_port_range gives defaults of 32768 and 60999; distribution and environment configuration may differ. Reserved-port settings also affect automatic allocation, so not every port in the range is necessarily selectable.
Checks for connection problems and firewall configuration
- Identify the target and protocol. Establish the server IP, TCP or UDP, and destination port. Compare the IANA entry with the actual service configuration.
- Check where the server listens. A running application may listen on another port or only a local address. Installed software is different from a service listening on the intended address and port.
- Inspect the path. Consider host and network firewalls, cloud rules, port forwarding and NAT. Specify direction, source and destination; knowing the ephemeral range does not justify exposing the entire range.
- Verify with the actual application. A successful TCP connection does not prove application authentication or functionality. Do not apply TCP test results to UDP; use a service-appropriate check.
