Network desk / port registry
A port number tells you what to check first.
111 TCP and UDP ports, each with the thing a lookup table usually leaves out: whether the protocol encrypts anything by default, how far out it should be reachable, what the encrypted replacement is, and the firewall rule that verdict actually implies.
Start from what you found
Paste nmap output, ss -tulpn, a netstat dump, or a Compose ports block into the finder. It reads the port numbers out, ranks the matches worst first, and counts what it could not identify.
22/tcp open ssh
0.0.0.0:6379 LISTEN
- "8080:80"
How far out each port belongs
derived verdictInternet-facing
Designed to answer from anywhere. Security comes from the protocol and the service, not the firewall.
Behind a gateway
Reachable remotely, but through a proxy, VPN, or source allow-list — never a direct port forward.
Trusted network only
Legitimate inside a trusted network. Answering a perimeter scan is a firewall defect.
Localhost only
Bind to 127.0.0.1. A listener on 0.0.0.0 here is the change that turns a service into an incident.
The registry by family
coverageWeb & proxies
11Databases & caches
13Remote access
11File transfer & shares
12Directory & auth
6Network services
27Messaging & media
16Containers & platform
8Every port in the library
port · serviceWeb & proxies
HTTP, HTTPS, proxies, and the unprivileged ports application servers and dev tooling default to.
11Transfer, submission, and retrieval — and the encrypted counterpart of each plaintext port.
7Databases & caches
Relational engines, document stores, caches, and search clusters. Almost none belong on a public interface.
13Remote access
Shells, graphical sessions, management controllers, and agents that execute commands on your behalf.
11File transfer & shares
Transfer protocols and network shares, from cleartext FTP to SMB, NFS, and block storage targets.
12Directory & auth
The services that answer 'who is this and what may they do' for the rest of the network.
6Network services
Naming, addressing, timekeeping, routing, discovery, logging, and printing infrastructure.
27Messaging & media
Queues, brokers, chat, VoIP signalling, and streaming media.
16Containers & platform
Container daemons, cluster APIs, coordination stores, and the dashboards in front of them.
8An open port is a question, not a verdict
A port number is a convention, not a guarantee. Anything can listen on 443, and a database moved to 5433 is exactly as exposed as it was on 5432. What a scan result tells you is which protocol to expect and which questions to ask next: what process owns the socket, which interface it is bound to, and who can route to that interface.
58 of the ports here are marked high risk when internet-facing, and 49 carry no transport encryption at all by default. Where an encrypted replacement exists — 32 records name one — moving to it is a better answer than a firewall rule, because the rule only protects the network you thought about.