Services
What the catalog recognised in the last 7 days, and what it could not.
In use
21 distinct service/port combinations| Service | Category | Port | Servers | Clients | Conversations | Observations | Last seen |
|---|---|---|---|---|---|---|---|
| sip | voip | udp/5060 | 5 | 7 | 10 | 1M | 5d ago |
| netbios-ns | infra | udp/137 | 1 | 9 | 9 | 3.2M | 5d ago |
| http | web | tcp/80 | 3 | 6 | 9 | 333.9k | 43s ago |
| netbios-dgm | infra | udp/138 | 1 | 8 | 8 | 19.3k | 5d ago |
| dns | dns | udp/53 | 1 | 6 | 7 | 2.5M | 54s ago |
| tcp/29814 | unknown | tcp/29814 | 1 | 5 | 5 | 2.5M | 29s ago |
| udp/68 | unknown | udp/68 | 3 | 1 | 3 | 1.4k | 5d ago |
| rtp | unknown | udp/22222 | 1 | 3 | 3 | 1.1k | 5d ago |
| udp/3289 | unknown | udp/3289 | 1 | 3 | 3 | 571 | 5d ago |
| node-exporter | monitoring | tcp/9100 | 2 | 1 | 2 | 1.4M | 23s ago |
| ssh | remote | tcp/22 | 1 | 2 | 2 | 324.4k | 8h ago |
| rtp | unknown | udp/27036 | 1 | 2 | 2 | 1.7k | 5d ago |
| mysql | database | tcp/3306 | 1 | 1 | 1 | 3.7M | 5d ago |
| grafana | monitoring | tcp/3000 | 1 | 1 | 1 | 694.6k | 7h ago |
| sip-tcp | voip | tcp/5060 | 1 | 1 | 1 | 217.7k | 5d ago |
| sip-5160 | voip | udp/5160 | 1 | 1 | 1 | 141.3k | 5d ago |
| udp/57621 | unknown | udp/57621 | 1 | 1 | 1 | 8.4k | 6d ago |
| tomcat | web | tcp/8009 | 1 | 1 | 1 | 21 | 6d ago |
| rtp | unknown | udp/18634 | 1 | 1 | 1 | 7 | 5d ago |
| rtp | unknown | udp/19408 | 1 | 1 | 1 | 7 | 5d ago |
| rtp | unknown | udp/17085 | 1 | 1 | 1 | 7 | 5d ago |
Unclassified ports
each row is a service worth naming| Port | Servers | Clients | Observations | Client process | Teach the catalog |
|---|---|---|---|---|---|
| tcp/29814 | 1 | 5 | 2.5M | — | INSERT INTO services (name, port, proto, category, builtin) VALUES ('name', 29814, 'tcp', 'other', 0); |
| udp/57621 | 1 | 1 | 8.4k | — | INSERT INTO services (name, port, proto, category, builtin) VALUES ('name', 57621, 'udp', 'other', 0); |
| udp/27036 | 1 | 2 | 1.7k | — | INSERT INTO services (name, port, proto, category, builtin) VALUES ('name', 27036, 'udp', 'other', 0); |
| udp/68 | 3 | 1 | 1.4k | — | INSERT INTO services (name, port, proto, category, builtin) VALUES ('name', 68, 'udp', 'other', 0); |
| udp/22222 | 1 | 3 | 1.1k | — | INSERT INTO services (name, port, proto, category, builtin) VALUES ('name', 22222, 'udp', 'other', 0); |
| udp/3289 | 1 | 3 | 571 | — | INSERT INTO services (name, port, proto, category, builtin) VALUES ('name', 3289, 'udp', 'other', 0); |
| udp/17085 | 1 | 1 | 7 | — | INSERT INTO services (name, port, proto, category, builtin) VALUES ('name', 17085, 'udp', 'other', 0); |
| udp/18634 | 1 | 1 | 7 | — | INSERT INTO services (name, port, proto, category, builtin) VALUES ('name', 18634, 'udp', 'other', 0); |
| udp/19408 | 1 | 1 | 7 | — | INSERT INTO services (name, port, proto, category, builtin) VALUES ('name', 19408, 'udp', 'other', 0); |
Catalog
134 known ports| Name | Port | Category | Description | Source |
|---|---|---|---|---|
| consul | tcp/8500 | cache | Consul HTTP API | built in |
| etcd | tcp/2379 | cache | etcd client API | built in |
| memcached | tcp/11211 | cache | Memcached | built in |
| redis | tcp/6379 | cache | Redis | built in |
| redis-tls | tcp/6380 | cache | Redis over TLS | built in |
| cassandra | tcp/9042 | database | Cassandra CQL | built in |
| clickhouse-http | tcp/8123 | database | ClickHouse HTTP | built in |
| couchdb | tcp/5984 | database | CouchDB | built in |
| influxdb | tcp/8086 | database | InfluxDB | built in |
| mongodb | tcp/27017 | database | MongoDB | built in |
| mssql | tcp/1433 | database | Microsoft SQL Server | built in |
| mysql | tcp/3306 | database | MySQL / MariaDB | built in |
| mysqlx | tcp/33060 | database | MySQL X protocol | built in |
| neo4j | tcp/7687 | database | Neo4j bolt | built in |
| oracle | tcp/1521 | database | Oracle TNS listener | built in |
| postgres | tcp/5432 | database | PostgreSQL | built in |
| kerberos | tcp/88 | directory | Kerberos KDC | built in |
| ldap | tcp/389 | directory | LDAP | built in |
| ldaps | tcp/636 | directory | LDAP over TLS | built in |
| radius | udp/1812 | directory | RADIUS authentication | built in |
| radius-acct | udp/1813 | directory | RADIUS accounting | built in |
| smb | tcp/445 | directory | SMB / CIFS | built in |
| vault | tcp/8200 | directory | HashiCorp Vault | built in |
| dns | udp/53 | dns | DNS | built in |
| dns-tcp | tcp/53 | dns | DNS over TCP | built in |
| dot | tcp/853 | dns | DNS over TLS | built in |
| dhcp | udp/67 | infra | DHCP server | built in |
| dhcpv6-client | udp/546 | infra | DHCPv6 client | built in |
| dhcpv6-server | udp/547 | infra | DHCPv6 server | built in |
| ftp | tcp/21 | infra | FTP control | built in |
| geneve | udp/6081 | infra | Geneve | built in |
| haproxy-stats | tcp/1936 | infra | HAProxy statistics | built in |
| ipsec-nat-t | udp/4500 | infra | IPsec NAT traversal | built in |
| isakmp | udp/500 | infra | IPsec IKE | built in |
| keepalived-vrrp | udp/112 | infra | VRRP | built in |
| l2tp | udp/1701 | infra | L2TP | built in |
| llmnr | udp/5355 | infra | Link-Local Multicast Name Resolution | built in |
| mdns | udp/5353 | infra | Multicast DNS / Bonjour | built in |
| netbios-dgm | udp/138 | infra | NetBIOS datagram service | built in |
| netbios-ns | udp/137 | infra | NetBIOS name service | built in |
| ntp | udp/123 | infra | NTP | built in |
| openvpn | udp/1194 | infra | OpenVPN | built in |
| rpcbind | udp/111 | infra | RPC portmapper | built in |
| snmp | udp/161 | infra | SNMP | built in |
| snmp-trap | udp/162 | infra | SNMP trap | built in |
| ssdp | udp/1900 | infra | SSDP / UPnP discovery | built in |
| syslog | udp/514 | infra | Syslog | built in |
| syslog-tls | tcp/6514 | infra | Syslog over TLS | built in |
| tftp | tcp/69 | infra | TFTP | built in |
| vxlan | udp/4789 | infra | VXLAN | built in |
| wireguard | udp/51820 | infra | WireGuard | built in |
| ws-discovery | udp/3702 | infra | WS-Discovery (printers, cameras) | built in |
| imap | tcp/143 | IMAP | built in | |
| imaps | tcp/993 | IMAP over TLS | built in | |
| pop3 | tcp/110 | POP3 | built in | |
| pop3s | tcp/995 | POP3 over TLS | built in | |
| smtp | tcp/25 | SMTP | built in | |
| smtps | tcp/465 | SMTP over TLS | built in | |
| submission | tcp/587 | SMTP submission | built in | |
| alertmanager | tcp/9093 | monitoring | Alertmanager | built in |
| grafana | tcp/3000 | monitoring | Grafana (also common for Node/Rails dev servers) | built in |
| graphite | tcp/2003 | monitoring | Graphite carbon | built in |
| jaeger | tcp/14268 | monitoring | Jaeger collector | built in |
| loki | tcp/3100 | monitoring | Loki | built in |
| nagios-nrpe | tcp/5666 | monitoring | Nagios NRPE | built in |
| netflow | udp/2055 | monitoring | NetFlow collector | built in |
| node-exporter | tcp/9100 | monitoring | Prometheus node exporter | built in |
| otlp-grpc | tcp/4317 | monitoring | OpenTelemetry OTLP gRPC | built in |
| otlp-http | tcp/4318 | monitoring | OpenTelemetry OTLP HTTP | built in |
| prometheus | tcp/9090 | monitoring | Prometheus | built in |
| sflow | udp/6343 | monitoring | sFlow collector | built in |
| statsd | udp/8125 | monitoring | StatsD | built in |
| zabbix-agent | tcp/10050 | monitoring | Zabbix agent | built in |
| zabbix-server | tcp/10051 | monitoring | Zabbix server | built in |
| port-9000 | tcp/9000 | other | Ambiguous: PHP-FPM, ClickHouse native or SonarQube | built in |
| amqp | tcp/5672 | queue | RabbitMQ / AMQP | built in |
| amqps | tcp/5671 | queue | AMQP over TLS | built in |
| beanstalkd | tcp/11300 | queue | Beanstalkd | built in |
| kafka | tcp/9092 | queue | Kafka broker | built in |
| mqtt | tcp/1883 | queue | MQTT | built in |
| nats | tcp/4222 | queue | NATS | built in |
| rabbitmq-mgmt | tcp/15672 | queue | RabbitMQ management UI | built in |
| zookeeper | tcp/2181 | queue | ZooKeeper | built in |
| docker-api | tcp/2375 | remote | Docker API (cleartext) | built in |
| docker-tls | tcp/2376 | remote | Docker API over TLS | built in |
| ipmi | udp/623 | remote | IPMI / BMC | built in |
| kube-api | tcp/6443 | remote | Kubernetes API server | built in |
| rdp | tcp/3389 | remote | RDP | built in |
| ssh | tcp/22 | remote | SSH | built in |
| telnet | tcp/23 | remote | Telnet (cleartext) | built in |
| vnc | tcp/5900 | remote | VNC | built in |
| winrm | tcp/5985 | remote | WinRM HTTP | built in |
| winrm-https | tcp/5986 | remote | WinRM HTTPS | built in |
| iscsi | tcp/3260 | storage | iSCSI | built in |
| nfs | tcp/2049 | storage | NFS | built in |
| nfs-udp | udp/2049 | storage | NFS over UDP | built in |
| rsync | tcp/873 | storage | rsync daemon | built in |
| asterisk-ami | tcp/5038 | voip | Asterisk Manager Interface | built in |
| asterisk-ari | tcp/8088 | voip | Asterisk ARI / HTTP | built in |
| freeswitch-esl | tcp/8021 | voip | FreeSWITCH event socket | built in |
| h323 | tcp/1720 | voip | H.323 call signalling | built in |
| homer-hep | udp/9060 | voip | HOMER HEP capture | built in |
| iax2 | udp/4569 | voip | IAX2 trunking | built in |
| iax2-tcp | tcp/4569 | voip | IAX2 over TCP | built in |
| kamailio-rpc | tcp/5062 | voip | Kamailio RPC / control | built in |
| mgcp | udp/2727 | voip | MGCP gateway | built in |
| provisioning-tftp | udp/69 | voip | TFTP phone provisioning | built in |
| rtcp-mux | udp/3479 | voip | STUN/TURN alternate | built in |
| rtpengine-ng | udp/2223 | voip | rtpengine NG control | built in |
| sip | udp/5060 | voip | SIP signalling | built in |
| sip-5062 | udp/5062 | voip | SIP alternate | built in |
| sip-5070 | udp/5070 | voip | SIP alternate | built in |
| sip-5090 | udp/5090 | voip | SIP alternate | built in |
| sip-5160 | udp/5160 | voip | SIP (FreePBX chan_sip default) | built in |
| sip-5160-tcp | tcp/5160 | voip | SIP over TCP (FreePBX chan_sip) | built in |
| sip-5161 | udp/5161 | voip | SIP alternate (FreePBX) | built in |
| sip-alt | udp/5080 | voip | SIP alternate (FreeSWITCH external) | built in |
| sip-tcp | tcp/5060 | voip | SIP signalling over TCP | built in |
| sip-tls-udp | udp/5061 | voip | SIP over DTLS | built in |
| sips | tcp/5061 | voip | SIP over TLS | built in |
| skinny | tcp/2000 | voip | Cisco SCCP / Skinny | built in |
| skinny-udp | udp/2000 | voip | Cisco SCCP keepalives | built in |
| stun | udp/3478 | voip | STUN / TURN | built in |
| turns | tcp/5349 | voip | TURN over TLS | built in |
| elastic-transport | tcp/9300 | web | Elasticsearch transport | built in |
| elasticsearch | tcp/9200 | web | Elasticsearch HTTP | built in |
| http | tcp/80 | web | HTTP | built in |
| http-alt | tcp/8080 | web | HTTP alternate | built in |
| https | tcp/443 | web | HTTPS | built in |
| https-alt | tcp/8443 | web | HTTPS alternate | built in |
| opensearch-dash | tcp/5601 | web | Kibana / OpenSearch Dashboards | built in |
| quic | udp/443 | web | HTTP/3 over QUIC | built in |
| quic-alt | udp/8443 | web | QUIC alternate | built in |
| tomcat | tcp/8009 | web | Tomcat AJP | built in |