Securing Windows NT/2000 Servers for the Internet

Appendix A. Well-Known Ports Used by Windows NT/2000

Sometimes it’s hard to remember what port a service is running on. For convenience, I’ve included a collection of some commonly used TCP/IP ports in Windows NT/2000 and Microsoft Back Office applications in Table 1.1.

Table A-1. TCP/IP Ports Used by Windows Services

Function	Static Ports
Windows Base Services
Active Directory (LDAP)	TCP: 389
Active Directory (LDAP-SSL)	TCP: 636
Browsing	UDP: 137, 138
DHCP Lease	UDP: 67, 68
DHCP Manager	TCP: 135
Directory Replication	TCP: 139 UDP: 138
Direct Host	TCP: 445
DNS Administration	TCP: 135
DNS Resolution	TCP: 53 UDP: 53
Event Viewer	TCP: 139
File Sharing	TCP: 139
Global Catalog (LDAP)	TCP: 3268
Global Catalog (LDAP-SSL)	TCP: 3269
IPSec	UDP: 500 (IKE) IP Protocol: 50 (ESP), 51 (AH)
Internet Printing Protocol (IPP)	TCP: 631
Kerberos	TCP: 88UDP: 88
Layer 2 Tunneling Protocol (L2TP)	UDP: 1701
Logon Sequence	TCP: 139UDP: 137, 138
NetLogon	UDP: 138
Pass Through Validation	TCP: 139UDP: 137, 138
Performance Monitor	TCP: 139
Point-to-Point Tunneling Protocol (PPTP)	TCP: 1723IP Protocol: 47 (GRE)
Printing	TCP: 139UDP: 137, 138
Registry Editor	TCP: 139
Server Manager	TCP: 139
Trusts	TCP: 139UDP: 137, 138
User Manager	TCP: 139
WinNT Diagnostics	TCP: 139
WinNT Secure Channel	TCP: 139UDP: 137, 138
WINS Replication	TCP: 42
WINS Manager	TCP: 135
WINS Registration	TCP: 137
Convoy Clustering (WLBS)
Convoy	UDP: 1717
WLBS	UDP: 2504 ...