Common Network Ports: The Complete List

Three ranges

• 0–1023, well-known: standard services. Listening on them normally needs root; since Mojave, macOS lets any user listen on them on all interfaces (0.0.0.0), but not on a specific address like 127.0.0.1.
• 1024–49151, registered: assigned to specific applications, though many are used informally.
• 49152–65535, dynamic or ephemeral: your Mac picks one of these as the source port for each outgoing connection.

TCP and UDP are separate

Port 53/UDP and 53/TCP are different sockets. Most services use one protocol; DNS uses both, and HTTP/3 uses UDP 443 while HTTP/1.1 and HTTP/2 use TCP 443.

A port number is a convention, not a guarantee

Anything can listen on any port. Traffic on 443 is usually HTTPS, but VPNs and tunnels use it too precisely because it's rarely blocked. To know what's really behind a port, look at the process.

$ lsof -nP -iTCP -sTCP:LISTEN
COMMAND     PID  USER  FD  TYPE  …  NAME
ControlCe   612  me    9u  IPv4  …  TCP *:7000 (LISTEN)
ControlCe   612  me   10u  IPv4  …  TCP *:5000 (LISTEN)

ControlCenter listening on 5000 and 7000 is macOS's AirPlay Receiver, a frequent cause of “port 5000 already in use”.

• lsof -nP -iTCP -sTCP:LISTEN lists listening TCP ports and their processes; add -iUDP for UDP.
• /etc/services maps port numbers to names.
• nc -vz host port tests whether a remote port is open.

LightAtom's Ports view shows every listening port and the app behind it; the connections view shows the remote port of each connection.