Which Ports are scanned by Patrowl?

Top 100 TCP ports - (All assets)

A fast openness check across the 100 most common ports, used to establish liveness and guide protection-mode selection. No service detection is performed at this stage.

7, 9, 13, 21, 22, 23, 25, 26, 37, 53, 79, 80, 81, 88, 106, 110, 111, 113, 119, 135, 139, 143, 144, 179, 199, 389, 427, 443, 444, 445, 465, 513, 514, 515, 543, 544, 548, 554, 587, 631, 646, 873, 990, 993, 995, 1025, 1026, 1027, 1028, 1029, 1110, 1433, 1720, 1723, 1755, 1900, 2000, 2001, 2049, 2121, 2717, 3000, 3128, 3306, 3389, 3986, 4899, 5000, 5009, 5051, 5060, 5101, 5190, 5357, 5432, 5631, 5666, 5800, 5900, 6000, 6001, 6646, 7070, 8000, 8008, 8009, 8080, 8081, 8443, 8888, 9100, 9999, 10000, 32768, 49152, 49153, 49154, 49155, 49156, 49157

294 TCP ports - Deep scan on protected assets

A precise TCP scan across the full list of 294 ports, with service detection (version identification, banner grabbing, etc.). See the port/service mapping table below for the full breakdown.

7, 9, 13, 21, 22, 23, 25, 26, 37, 53, 79, 80, 81, 82, 83, 84, 85, 88, 90, 106, 110, 111, 113, 119, 135, 139, 143, 144, 179, 199, 222, 389, 427, 443, 444, 445, 465, 513, 515, 523, 543, 544, 548, 554, 587, 631, 636, 646, 808, 873, 888, 990, 993, 995, 1024, 1025, 1026, 1028, 1029, 1099, 1110, 1177, 1234, 1337, 1400, 1414, 1433, 1521, 1522, 1523, 1720, 1723, 1755, 1883, 1900, 1935, 2000, 2001, 2012, 2049, 2052, 2053, 2077, 2079, 2082, 2083, 2086, 2087, 2095, 2096, 2121, 2222, 2323, 2345, 2375, 2480, 2717, 3000, 3001, 3050, 3128, 3268, 3269, 3299, 3306, 3307, 3310, 3388, 3389, 3522, 3690, 3702, 3780, 3790, 3986, 4000, 4022, 4040, 4430, 4433, 4443, 4444, 4500, 4567, 4848, 4899, 4911, 5000, 5001, 5005, 5006, 5007, 5009, 5010, 5051, 5060, 5080, 5081, 5101, 5190, 5201, 5222, 5269, 5357, 5432, 5555, 5560, 5601, 5631, 5666, 5671, 5672, 5800, 5900, 5901, 5938, 5984, 5985, 5986, 6000, 6001, 6002, 6080, 6363, 6370, 6379, 6443, 6646, 6666, 7000, 7001, 7070, 7071, 7080, 7081, 7170, 7171, 7443, 7474, 7547, 7548, 7676, 7777, 7779, 8000, 8001, 8002, 8003, 8008, 8009, 8010, 8015, 8020, 8060, 8069, 8080, 8081, 8082, 8083, 8084, 8085, 8086, 8087, 8088, 8089, 8090, 8091, 8096, 8098, 8099, 8112, 8123, 8126, 8139, 8140, 8159, 8181, 8200, 8443, 8602, 8800, 8834, 8880, 8881, 8882, 8883, 8884, 8885, 8886, 8887, 8888, 8889, 8899, 8999, 9000, 9001, 9002, 9009, 9080, 9090, 9091, 9100, 9160, 9191, 9200, 9295, 9302, 9303, 9304, 9305, 9306, 9307, 9443, 9600, 9800, 9943, 9998, 9999, 10000, 10001, 10026, 10250, 10348, 10443, 11000, 11211, 12345, 18081, 20000, 20080, 22222, 27017, 28017, 30002, 30003, 31337, 32400, 32768, 33060, 44443, 44444, 44445, 44446, 49152, 49153, 49157, 50000, 50389, 51005, 51443, 52869, 52881, 55000, 60001

Note: the Top 100 liveness list and the 294-port deep-scan list are two separately curated sets and overlap on 95 ports. Five ports are checked in the quick liveness scan only (514, 1027, 49154, 49155, 49156) and are not part of the 294-port deep scan.

Port / service mapping

Port	Common service(s)
`7`	Echo
`9`	Discard / Wake-on-LAN
`13`	Daytime
`21`	FTP
`22`	SSH (remote administration)
`23`	Telnet
`25`	SMTP
`26`	SMTP (alternate)
`37`	Time
`53`	DNS
`79`	Finger
`80`	HTTP (web)
`81`	HTTP (alternate)
`82`	HTTP (alternate)
`83`	HTTP (alternate)
`84`	HTTP (alternate)
`85`	HTTP (alternate)
`88`	Kerberos
`90`	HTTP (alternate) / DNSIX
`106`	POP3PW (password change)
`110`	POP3
`111`	RPCbind / Portmapper
`113`	Ident / Auth
`119`	NNTP (Usenet)
`135`	MSRPC (Microsoft RPC Endpoint Mapper)
`139`	NetBIOS Session Service
`143`	IMAP
`144`	News / NeWS
`179`	BGP
`199`	SMUX (SNMP multiplexing)
`222`	SSH (alternate)
`389`	LDAP
`427`	SLP (Service Location Protocol)
`443`	HTTPS (secure web)
`444`	SNPP (Simple Network Paging Protocol)
`445`	Microsoft-DS / SMB (Windows file sharing)
`465`	SMTPS
`513`	rlogin
`515`	LPD (line printer daemon)
`523`	IBM DB2
`543`	klogin (Kerberos rlogin)
`544`	kshell (Kerberos rsh)
`548`	AFP (Apple Filing Protocol)
`554`	RTSP (streaming)
`587`	SMTP Submission
`631`	IPP / CUPS (printing)
`636`	LDAPS
`646`	LDP (MPLS Label Distribution)
`808`	CCProxy HTTP
`873`	rsync
`888`	HTTP (alternate) / AccessBuilder
`990`	FTPS (control)
`993`	IMAPS
`995`	POP3S
`1024`	Reserved / first ephemeral (DCOM)
`1025`	Microsoft RPC / NFS-or-IIS
`1026`	Windows RPC / DCOM
`1028`	Windows RPC / DCOM
`1029`	Windows RPC / DCOM
`1099`	Java RMI Registry
`1110`	NFS status / webadmin
`1177`	DKMessenger / various
`1234`	VLC stream / various
`1337`	WASTE / common backdoor & alternate service
`1400`	Cadkey License Manager / various
`1414`	IBM MQ (WebSphere MQ)
`1433`	Microsoft SQL Server
`1521`	Oracle DB (TNS Listener)
`1522`	Oracle DB (alternate)
`1523`	Oracle DB (alternate)
`1720`	H.323 / Q.931 (VoIP)
`1723`	PPTP (VPN)
`1755`	MMS (Microsoft Media Server)
`1883`	MQTT
`1900`	UPnP / SSDP
`1935`	RTMP (Flash Media / streaming)
`2000`	Cisco SCCP (Skinny)
`2001`	Cisco DC / various
`2012`	ttyinfo / various
`2049`	NFS
`2052`	Cloudflare HTTP / various
`2053`	Cloudflare HTTPS / various
`2077`	WebDAV (cPanel) / various
`2079`	idware router / various
`2082`	cPanel (HTTP)
`2083`	cPanel (HTTPS)
`2086`	WHM / WebHost Manager (HTTP)
`2087`	WHM / WebHost Manager (HTTPS)
`2095`	cPanel Webmail (HTTP)
`2096`	cPanel Webmail (HTTPS)
`2121`	FTP (alternate) / CCProxy FTP
`2222`	SSH (alternate) / DirectAdmin / EtherNet-IP
`2323`	Telnet (alternate)
`2345`	dbm / various
`2375`	Docker API (unencrypted)
`2480`	OrientDB / various
`2717`	IBM Informix / PN-REQUESTER
`3000`	Web app (Node.js / Grafana / Ruby dev)
`3001`	Web app (alternate) / Nessus
`3050`	Firebird / InterBase
`3128`	Squid Proxy
`3268`	Global Catalog (LDAP)
`3269`	Global Catalog (LDAPS)
`3299`	SAP Router
`3306`	MySQL
`3307`	MySQL (alternate)
`3310`	ClamAV daemon
`3388`	RDP (alternate) / CB Server
`3389`	RDP (Remote Desktop)
`3522`	DTP-net / various
`3690`	Subversion (SVN)
`3702`	WS-Discovery (WSD)
`3780`	Nexpose console / various
`3790`	Nexpose Security Console / GTP-Control
`3986`	OpenVPN Management / MAPPER
`4000`	Web app / ICQ / various
`4022`	DNOX / various
`4040`	Spark UI / Fastnet / various
`4430`	HTTPS (alternate)
`4433`	HTTPS (alternate)
`4443`	HTTPS (alternate) / Pharos
`4444`	Metasploit default / krb524 / common backdoor
`4500`	IPSec NAT-T (IKE)
`4567`	Sinatra dev / Tram / various
`4848`	GlassFish Admin
`4899`	Radmin
`4911`	Jetstream / various
`5000`	Web/API (Flask / Docker Registry / UPnP / Synology)
`5001`	Web app (alternate) / Synology
`5005`	Java JDWP debugger / AVT profile / various
`5006`	wsm-server / various
`5007`	wsm-server-ssl / various
`5009`	Apple AirPort Admin / WinFS
`5010`	TelePathStart / various
`5051`	SIP (alternate) / ITA agent
`5060`	SIP (VoIP / IP telephony)
`5080`	SIP (alternate) / OnScreen
`5081`	SDL-ETS / various
`5101`	Talarian / various
`5190`	AIM / ICQ
`5201`	iperf3
`5222`	XMPP client (Jabber)
`5269`	XMPP server-to-server
`5357`	WSDAPI (Web Services on Devices)
`5432`	PostgreSQL
`5555`	ADB (Android Debug) / HP Data Protector / various
`5560`	Oracle iSQL*Plus / various
`5601`	Kibana
`5631`	pcAnywhere (data)
`5666`	NRPE (Nagios)
`5671`	AMQP over TLS (RabbitMQ)
`5672`	AMQP (RabbitMQ)
`5800`	VNC over HTTP
`5900`	VNC (Remote Desktop)
`5901`	VNC (display :1)
`5938`	TeamViewer
`5984`	CouchDB
`5985`	WinRM (HTTP)
`5986`	WinRM (HTTPS)
`6000`	X11
`6001`	X11 (display :1)
`6002`	X11 (display :2)
`6080`	noVNC (VNC web) / various
`6363`	Named Data Networking / various
`6370`	Aphelion / various
`6379`	Redis
`6443`	Kubernetes API server
`6646`	McAfee ePO
`6666`	IRC / common backdoor
`7000`	Cassandra (inter-node) / AFS / web app
`7001`	Oracle WebLogic / AFS / web app
`7070`	RealServer / web app
`7071`	IceWarp admin / various
`7080`	HTTP (alternate) / EmpowerID
`7081`	Web app (alternate)
`7170`	AltaVista Firewall / various
`7171`	Discovery / various
`7443`	HTTPS (alternate) / Oracle HTTP
`7474`	Neo4j (HTTP)
`7547`	CWMP / TR-069 (CPE WAN Management)
`7548`	CWMP / TR-069 over TLS
`7676`	Sun/Java Message Queue (IMQ)
`7777`	Web app / iChat / Oracle / backdoor
`7779`	VSTAT / various
`8000`	HTTP (alternate) / web app
`8001`	HTTP (alternate) / VCOM
`8002`	HTTP (alternate) / Teradata
`8003`	HTTP (alternate) / Mulberry
`8008`	HTTP (alternate) / IBM HTTP
`8009`	AJP (Apache JServ / Tomcat)
`8010`	HTTP (alternate) / XMPP file transfer
`8015`	Web app (alternate)
`8020`	Hadoop NameNode / HTTP (alternate)
`8060`	HTTP (alternate) / Roku ECP
`8069`	Odoo (OpenERP)
`8080`	HTTP proxy / web app (alternate)
`8081`	HTTP (alternate) / Sonatype Nexus
`8082`	HTTP (alternate) / BlackIce
`8083`	HTTP (alternate) / VMware VAMI / proxy
`8084`	HTTP (alternate)
`8085`	HTTP (alternate)
`8086`	InfluxDB / HTTP (alternate)
`8087`	Riak / HTTP (alternate)
`8088`	Hadoop YARN / HTTP (alternate)
`8089`	Splunkd / HTTP (alternate)
`8090`	Atlassian Confluence / HTTP (alternate)
`8091`	Couchbase web admin / HTTP (alternate)
`8096`	Jellyfin / Emby
`8098`	Riak HTTP / various
`8099`	HTTP (alternate)
`8112`	Deluge Web UI / various
`8123`	Home Assistant / Polipo proxy
`8126`	StatsD / various
`8139`	Puppet / various
`8140`	Puppet Master
`8159`	Web app (alternate)
`8181`	HTTP (alternate) / GlassFish / Intermapper
`8200`	VMware VAMI / GoToMyPC / various
`8443`	HTTPS (alternate) (Tomcat, Plesk)
`8602`	Web app (alternate)
`8800`	Sun Web Console / various
`8834`	Nessus Web UI
`8880`	WebSphere / CDDBP / HTTP (alternate)
`8881`	Web app (alternate)
`8882`	Web app (alternate)
`8883`	MQTT over TLS (secure MQTT)
`8884`	Web app (alternate)
`8885`	Web app (alternate)
`8886`	Web app (alternate)
`8887`	Web app (alternate)
`8888`	HTTP (alternate) / Jupyter / various
`8889`	Web app (alternate)
`8899`	OSPF-lite / various
`8999`	Bacula / various
`9000`	SonarQube / PHP-FPM / Portainer / web app
`9001`	Tor ORPort / Supervisor / various
`9002`	DynamID / various
`9009`	Pichat / various
`9080`	WebSphere HTTP / HTTP (alternate)
`9090`	Prometheus / Cockpit / Openfire admin / HTTP (alternate)
`9091`	Transmission web UI / HTTP (alternate)
`9100`	JetDirect (raw printing)
`9160`	Cassandra (Thrift)
`9191`	Sun AS JPDA / various
`9200`	Elasticsearch
`9295`	Web app / various
`9302`	Various
`9303`	Various
`9304`	Various
`9305`	Various
`9306`	ProxySQL admin / various
`9307`	Various
`9443`	HTTPS (alternate) / VMware / Tungsten
`9600`	Logstash / IBM Netcool / various
`9800`	WebDAV / various
`9943`	Web app (alternate)
`9998`	Distinct32 / various
`9999`	Web admin / Urchin / Abyss / various
`10000`	Webmin / NDMP / BackupExec
`10001`	Ubiquiti discovery / SCP-config / various
`10026`	Various
`10250`	Kubernetes Kubelet API
`10348`	Various
`10443`	HTTPS (alternate) / FortiGate SSL VPN
`11000`	IRISA / SynCE / various
`11211`	Memcached
`12345`	NetBus (backdoor) / various
`18081`	Monero RPC / various
`20000`	DNP3 (SCADA) / Usermin / various
`20080`	HTTP (alternate)
`22222`	Webmin (alternate) / DiscoDNS / various
`27017`	MongoDB
`28017`	MongoDB HTTP status
`30002`	Various
`30003`	ADS-B feed / various
`31337`	Back Orifice (backdoor)
`32400`	Plex Media Server
`32768`	RPC dynamic (first ephemeral) / Filenet
`33060`	MySQL X Protocol
`44443`	HTTPS (alternate) / various
`44444`	Various
`44445`	Various
`44446`	Various
`49152`	Windows RPC dynamic (ephemeral)
`49153`	Windows RPC dynamic (ephemeral)
`49157`	Windows RPC dynamic (ephemeral)
`50000`	SAP / IBM DB2 / various
`50389`	LDAP (alternate) / various
`51005`	Various
`51443`	HTTPS (alternate) / various
`52869`	Realtek SDK UPnP (known CVE) / various
`52881`	Various
`55000`	Various
`60001`	Trinity (backdoor) / various

Commonly encountered services for each of the 294 scanned ports (protected mode). Top 5 ports are :

80 443 21 22 25