The ports, protocol numbers and addresses that turn up in firewall rules, packet captures and router configs. Port numbers are the IANA assignments unless marked (convention), meaning a widely used default rather than an official assignment. "Both" means the service is assigned for TCP and UDP.
Routing and network control
| Port | Transport | Service | Notes |
|---|
| 179 | TCP | BGP | Firewall it to your configured neighbours only. |
| 646 | Both | LDP (MPLS label distribution) | UDP for discovery, TCP for sessions. |
| 520 | UDP | RIP | RIPng uses UDP 521. |
| 3784 | UDP | BFD, single-hop | 3785 for BFD echo, 4784 for multihop BFD. |
| 1985 | UDP | HSRP | Cisco's gateway redundancy protocol. VRRP isn't a port: it's IP protocol 112. |
| 323 | TCP | RPKI to router (RTR) | Validators commonly listen on 3323 (Routinator) or 8282 (StayRTR) (convention). |
Management and monitoring
| Port | Transport | Service | Notes |
|---|
| 22 | TCP | SSH | Also SCP and SFTP. |
| 23 | TCP | Telnet | Unencrypted; disable it. |
| 830 | TCP | NETCONF over SSH | |
| 161 | UDP | SNMP | Polling the device. |
| 162 | UDP | SNMP traps | Sent by the device to the collector. |
| 514 | UDP | Syslog | 6514 for syslog over TLS. |
| 123 | UDP | NTP | |
| 49 | TCP | TACACS+ | |
| 1812, 1813 | UDP | RADIUS | Authentication, accounting. |
| 2055 | UDP | NetFlow (convention) | Collectors also often use 9995 or 9996. |
| 4739 | Both | IPFIX | The standardised successor to NetFlow v9. |
| 6343 | UDP | sFlow | |
| 69 | UDP | TFTP | Still used to boot and provision devices. |
Addressing and naming
| Port | Transport | Service | Notes |
|---|
| 53 | Both | DNS | UDP for most queries, TCP for large answers and zone transfers. |
| 853 | TCP | DNS over TLS | DNS over HTTPS uses 443. |
| 67, 68 | UDP | DHCP | Server 67, client 68. |
| 547, 546 | UDP | DHCPv6 | Server and relay 547, client 546. |
| 43 | TCP | WHOIS | Also how IRR databases are queried. RDAP, its successor, runs over HTTPS. |
Web, VPN and tunnels
| Port | Transport | Service | Notes |
|---|
| 80 | TCP | HTTP | |
| 443 | TCP, UDP | HTTPS | UDP 443 is HTTP/3 (QUIC). |
| 8080 | TCP | Alternative HTTP (convention) | |
| 500 | UDP | IKE (IPsec key exchange) | |
| 4500 | UDP | IPsec NAT traversal | ESP wrapped in UDP when there's NAT on the path. |
| 51820 | UDP | WireGuard (convention) | The default listen port; any port works. |
| 1194 | UDP | OpenVPN | Can also run over TCP. |
| 1701 | UDP | L2TP | |
| 4789 | UDP | VXLAN | |
| 6081 | UDP | Geneve | |
IP protocol numbers
Some protocols don't use ports at all: they ride directly on IP, identified by the protocol number in the IPv4 header (the Next Header field in IPv6). A firewall rule for these matches the protocol, not a port.
| Number | Protocol | Notes |
|---|
| 1 | ICMP | Ping, traceroute replies, "fragmentation needed". |
| 2 | IGMP | IPv4 multicast group membership. |
| 4 | IP in IP | IPv4 encapsulated in IPv4. |
| 6 | TCP | |
| 17 | UDP | |
| 41 | IPv6 in IPv4 | 6in4 tunnels. |
| 47 | GRE | |
| 50 | ESP | IPsec encryption. |
| 51 | AH | IPsec authentication only. |
| 58 | ICMPv6 | Includes neighbour discovery; don't block it wholesale. |
| 88 | EIGRP | |
| 89 | OSPF | OSPFv2 and OSPFv3. |
| 103 | PIM | Multicast routing. |
| 112 | VRRP | |
| 132 | SCTP | |
IS-IS uses none of these: it runs directly over the link layer, not over IP.
Multicast addresses you'll see in captures
| IPv4 | IPv6 | Who listens |
|---|
| 224.0.0.1 | ff02::1 | All hosts / all nodes on the link |
| 224.0.0.2 | ff02::2 | All routers on the link |
| 224.0.0.5 | ff02::5 | All OSPF routers |
| 224.0.0.6 | ff02::6 | OSPF designated routers |
| 224.0.0.9 | ff02::9 | RIP routers |
| 224.0.0.18 | ff02::12 | VRRP |
| — | ff02::1:2 | DHCPv6 servers and relays |
| — | ff02::1:ffXX:XXXX | Solicited-node address (neighbour discovery) |
EtherTypes
| Value | Carries |
|---|
| 0x0800 | IPv4 |
| 0x0806 | ARP |
| 0x86DD | IPv6 |
| 0x8100 | 802.1Q VLAN tag |
| 0x88A8 | 802.1ad (QinQ) outer tag |
| 0x8847 | MPLS |
| 0x88CC | LLDP |
To see which of these a host is actually using, ss -tulpn on Linux lists listening sockets, and tcpdump -ni eth0 port 179 (or any port) shows the traffic itself — see Linux Network Connectivity and Packets That Never Come Back. For writing firewall rules around these, see Zone-based firewall on VyOS.