Logs, firewall rules, and scan reports are full of bare port numbers, and every one of them raises the same question: what service is this supposed to be? Port 443 is HTTPS and port 22 is SSH, but beyond the famous handful the numbers blur together, and guessing wrong can send an investigation down the wrong path. This lookup answers from a built-in table of well-known and registered services, so it works offline and instantly. It tells you the conventional service for a port, with a reminder that any service can in principle run on any port: the table names the expectation, not a guarantee about what is actually listening.
Quick Answer: Type a port number from 0 to 65535 and click Look Up to see its conventional service name.
Free Online Tool
Port Number Lookup
Enter a port number and get its well-known service name from a built-in table.
How to Use the Port Number Lookup
- Type the port number you saw in a log or rule.
- Click Look Up.
- Read the service name and its usual protocol, TCP or UDP.
- Check the note if the port is registered rather than well-known.
- If the port is unassigned, treat that as a clue, not a verdict.
- Investigate the actual service before changing any firewall rule.
Key Features
- Covers well-known ports below 1024 and common registered ports above them.
- Shows TCP, UDP, or both, as applicable to each service.
- Flags unassigned ports honestly instead of inventing a service.
- Validates the 0 to 65535 range before looking anything up.
- Fully offline: the table ships inside the page.
- Includes web, mail, DNS, database, and remote-access services.
What the Result Means
A named service means that port is conventionally used for that protocol, which is the right starting hypothesis for an investigation. An unassigned result means no standard service claims the port, which is common for custom applications and ephemeral ports. Either way, the table cannot tell you what is actually listening right now: a web server can run on port 8080 or 8000, malware can hide on port 443, and only a banner check or a process listing on the host settles what is really there.
Worked Example
A firewall log shows repeated connection attempts to port 3389 on a server that should only serve web pages. Looking up 3389 gives RDP, remote desktop, which has no business being open on a web-only server, so the finding goes straight to the top of the investigation list. By contrast, a log entry for port 443 on the same server gives HTTPS, which is exactly what a web server should serve. The same lookup habit turns a meaningless number into a decision in seconds.
Best Practices and Tips
- Start from the conventional service, then verify with a banner or host process list before acting.
- Treat unexpected services on well-known ports as a red flag worth a second look.
- Remember that UDP and TCP ports are separate namespaces: DNS uses UDP 53 and TCP 53 for different jobs.
- When documenting a firewall change, record both the port and the intended service.
- Ephemeral client ports above 32768 are usually not services at all.
Common Mistakes to Avoid
- Assuming the table proves what is listening on a port.
- Forgetting that TCP and UDP port numbers are independent.
- Blocking a port by number alone without checking what legitimately uses it.
- Treating an unassigned port as automatically suspicious.
Frequently Asked Questions
What is port 443?
HTTPS: encrypted web traffic over TLS. It is the standard secure web port.
Why do some ports show both TCP and UDP?
Because the service uses both transports for different parts of its job, as DNS does.
Can a service run on a different port?
Yes, freely. The table gives the convention; configuration decides the reality.
What does unassigned mean?
No service is officially registered for that number. It may still be used by a custom application.