| Port No. | Protocol | Service |
Description |
|---|
| 6000-6063 | tcp/udp | x11 | X Window System |
| 6000 |
tcp |
# |
The Thing, Lovgate |
| 6006 |
tcp |
# |
Bad Blood |
| 6050 |
tcp/udp |
# |
ARCserv |
| 6051 |
tcp/udp |
# |
Zdemon, SysXXX |
| 6060 |
tcp |
# |
W32.Lovgate |
| 6064 | tcp/udp | ndl-ahp-svc | NDL-AHP-SVC |
| 6065 | tcp/udp | winpharaoh | WinPharaoh |
| 6066 | tcp/udp | ewctsp | EWCTSP |
| 6067 | tcp/udp | srb | SRB |
| 6068 | tcp/udp | gsmp | GSMP |
| 6069 | tcp/udp | trip | TRIP |
| 6070 | tcp/udp | messageasap | Messageasap |
| 6071 | tcp/udp | ssdtp | SSDTP |
| 6072 | tcp/udp | diagnose-proc | DIAGNOSE-PROC |
| 6073 | tcp/udp | directplay8 | DirectPlay8 |
| 6074-6084 | tcp/udp | # | Unassigned |
| 6085 | tcp/udp | konspire2b | konspire2b p2p network |
| 6086-6099 | tcp/udp | # | Unassigned |
| 6100 | tcp/udp | synchronet-db | SynchroNet-db |
| 6101 | tcp/udp | synchronet-rtc | SynchroNet-rtc |
| 6102 | tcp/udp | synchronet-upd | SynchroNet-upd |
| 6103 | tcp/udp | rets | RETS |
| 6104 | tcp/udp | dbdb | DBDB |
| 6105 | tcp/udp | primaserver | Prima Server |
| 6106 | tcp/udp | mpsserver | MPS Server |
| 6107 | tcp/udp | etc-control | ETC Control |
| 6108 | tcp/udp | sercomm-scadmin | Sercomm-SCAdmin |
| 6109 | tcp/udp | globecast-id | GLOBECAST-ID |
| 6110 | tcp/udp | softcm | HP SoftBench CM |
| 6111 | tcp/udp | spc | HP SoftBench Sub-Process Control |
| 6112 | tcp/udp | dtspcd | dtspcd |
| 6112 |
tcp/udp |
# |
BattleNet
The popular multiplayer game "Diablo" runs on this port. |
| 6113-6122 | tcp/udp | # | Unassigned |
| 6123 | tcp/udp | backup-express | Backup Express |
| 6124-6132 | tcp/udp | # | Unassigned |
| 6133 | tcp/udp | nbt-wol | New Boundary Tech WOL |
| 6134-6140 | tcp/udp | # | Unassigned |
| 6129 |
tcp/udp |
# |
W32.Mockbot. |
| 6141 | tcp/udp | meta-corp | Meta Corporation License Manager |
| 6142 | tcp/udp | aspentec-lm | Aspen Technology License Manager |
| 6143 | tcp/udp | watershed-lm | Watershed License Manager |
| 6144 | tcp/udp | statsci1-lm | StatSci License Manager - 1 |
| 6145 | tcp/udp | statsci2-lm | StatSci License Manager - 2 |
| 6146 | tcp/udp | lonewolf-lm | Lone Wolf Systems License Manager |
| 6147 | tcp/udp | montage-lm | Montage License Manager |
| 6148 | tcp/udp | ricardo-lm | Ricardo North America License Manager |
| 6149 | tcp/udp | tal-pod | tal-pod |
| 6150-6252 | tcp/udp | # | Unassigned |
| 6187 |
tcp/udp |
# |
Tilser |
| 6253 | tcp/udp | crip | CRIP |
| 6254-6299 | tcp/udp | # | Unassigned |
| 6272 |
tcp |
# |
Secret Service |
| 6300 | tcp/udp | bmc-grx | BMC GRX |
| 6301-6320 | tcp/udp | # | Unassigned |
| 6321 | tcp/udp | emp-server1 | Empress Software Connectivity Server 1 |
| 6322 | tcp/udp | emp-server2 | Empress Software Connectivity Server 2 |
| 6323-6345 | tcp/udp | # | Unassigned |
| 6343 | tcp/udp | sflow | sFlow traffic monitoring |
| 6344-6345 | tcp/udp | # | Unassigned |
| 6346 | tcp/udp | gnutella-svc | gnutella-svc |
| 6347 | tcp/udp | gnutella-rtr | gnutella-rtr |
| 6348-6381 | tcp/udp | # | Unassigned |
| 6382 | tcp/udp | metatude-mds | Metatude Dialogue Server |
| 6383-6388 | tcp/udp | # | Unassigned |
| 6384 |
tcp |
# |
W32.HLLW.Gaobot |
| 6389 | tcp/udp | clariion-evr01 | clariion-evr01 |
| 6390-6399 | tcp/udp | # | Unassigned |
| 6400 | tcp/udp | info-aps | |
| 6400 |
tcp |
# |
The Thing |
| 6401 | tcp/udp | info-was | |
| 6402 | tcp/udp | info-eventsvr | |
| 6403 | tcp/udp | info-cachesvr | |
| 6404 | tcp/udp | info-filesvr | |
| 6405 | tcp/udp | info-pagesvr | |
| 6406 | tcp/udp | info-processvr | |
| 6407 | tcp/udp | reserved1 | |
| 6408 | tcp/udp | reserved2 | |
| 6409 | tcp/udp | reserved3 | |
| 6410 | tcp/udp | reserved4 | |
| 6411-6454 | tcp/udp | # | Unassigned |
| 6430 |
tcp/udp |
# |
Mirab File Transfer |
| 6455 | tcp | skip-cert-recv | SKIP Certificate Receive |
| 6456 | tcp | skip-cert-send | SKIP Certificate Send |
| 6457-6470 | tcp/udp | # | Unassigned |
| 6471 | tcp/udp | lvision-lm | LVision License Manager |
| 6472-6499 | tcp/udp | # | Unassigned |
| 6499-6500 |
tcp |
# |
Netscape CoolTalk Watchdog |
| 6500 | tcp/udp | boks | BoKS Master |
| 6501 | tcp/udp | boks_servc | BoKS Servc |
| 6502 | tcp/udp | boks_servm | BoKS Servm |
| 6502 |
tcp/udp |
# |
Netscape Conference |
| 6503 | tcp/udp | boks_clntd | BoKS Clntd |
| 6504 | tcp/udp | # | Unassigned |
| 6505 | tcp/udp | badm_priv | BoKS Admin Private Port |
| 6506 | tcp/udp | badm_pub | BoKS Admin Public Port |
| 6507 | tcp/udp | bdir_priv | "BoKS Dir Server, Private Port" |
| 6508 | tcp/udp | bdir_pub | "BoKS Dir Server, Public Port" |
| 6509 | tcp/udp | mgcs-mfp-port | MGCS-MFP Port |
| 6510 | tcp/udp | mcer-port | MCER Port |
| 6511-6542 | tcp/udp | # | Unassigned |
| 6543 | tcp/udp | lds-distrib | lds_distrib |
| 6544-6546 | tcp/udp | # | Unassigned |
| 6547 | tcp/udp | apc-6547 | APC 6547 |
| 6548 | tcp/udp | apc-6548 | APC 6548 |
| 6549 | tcp/udp | apc-6549 | APC 6549 |
| 6550 | tcp/udp | fg-sysupdate | fg-sysupdate |
| 6551-6557 | tcp/udp | # | Unassigned |
| 6558 | tcp/udp | xdsxdm | |
| 6559-6579 | tcp/udp | # | Unassigned |
| 6564 |
tcp/udp |
# |
Sdbot |
| 6565 |
tcp |
# |
Nemog |
| 6566 | tcp/udp | sane-port | SANE Control Port |
| 6567-6579 | tcp/udp | # | Unassigned |
| 6580 | tcp/udp | parsec-master | Parsec Masterserver |
| 6581 | tcp/udp | parsec-peer | Parsec Peer-to-Peer |
| 6582 | tcp/udp | parsec-game | Parsec Gameserver |
| 6583-6587 | tcp/udp | # | Unassigned |
| 6588 | tcp/udp | # | Unassigned
Unofficial use of port 6588 by AnalogX and Microsoft |
| 6589-6627 | tcp/udp | # | Unassigned |
| 6595 |
tcp/udp |
# |
Assasin |
| 6628 | tcp/udp | afesc-mc | AFE Stock Channel M/C |
| 6629-6630 | tcp/udp | # | Unassigned |
| 6631 | tcp/udp | # | Unassigned |
| 6631 |
tcp/udp |
# |
Sdbot |
| 6632-6664 | tcp/udp | # | Unassigned |
| 6664-6665 |
tcp |
# |
Futro |
| 6665-6669 | tcp/udp | ircu | IRCU |
| 6661 |
tcp |
# |
TEMan, Weia-Meia |
| 6666 |
tcp |
# |
AltaVista Tunnel server also uses this port. |
| 6666 |
tcp |
# |
Script kiddies trying to compromise
Real Server servers might mistakenly use this port. |
| 6666 |
tcp |
# |
Many sites running "napster" may use this port. |
| 6666 |
tcp |
# |
Dark Connection Inside, NetBus worm,
W32.HLLW.Warpigs, BAT.Boohoo.Worm |
| 6666 |
udp |
# |
Kali uses UDP 6666. |
| 6667 |
tcp |
# |
VocalTec Internet Phone
An alternate port other than 6670
used to connect to servers. |
| 6667 |
tcp |
# |
IRC Clients can connect to servers on this port. |
| 6667 |
tcp |
# |
Dark FTP, ScheduleAgent, SubSeven,
Subseven 2.1.4 DefCon 8, Trinity, WinSatan,
W32.HLLW.Gaobot, IrcContact, Deftcode, IRC.Flood
W32.HLLW.Nool, W32.HLLW.Warpigs, Spigot,
W32.HLLW.Studd, W32.Cissi, W32.Mimail
W32.Opasa, Sdbot, W32.Korgo, Hacarmy, W32.Mota,
W32.Spybot, Alnica, W32.Mydoom, Maxload,
W32.Bofra |
| 6669 |
tcp |
# |
Host Control, Vampire |
| 6670 | tcp/udp | vocaltec-gold | Vocaltec Global Online Directory |
| 6670 |
tcp |
# |
BackWeb Server, Deep Throat, Foreplay,
WinNuke eXtreame |
| 6671 | tcp/udp | # | Unassigned |
| 6672 | tcp/udp | vision_server | vision_server |
| 6673 | tcp/udp | vision_elmd | vision_elmd |
| 6674-6700 | tcp/udp | # | Unassigned |
| 6697 |
tcp/udp |
# |
Feardoor |
| 6699 |
tcp |
# |
A program called "napster" for exchanging
MP3 files defaults to this port. |
| 6701 | tcp/udp | kti-icad-srvr | KTI/ICAD Nameserver |
| 6702-6713 | tcp/udp | # | Unassigned |
| 6711 |
tcp |
# |
BackDoor-G, SubSeven, VP Killer, Kilo |
| 6712 |
tcp |
# |
Funny trojan, SubSeven |
| 6713 |
tcp |
# |
SubSeven |
| 6714 | tcp/udp | ibprotocol | Internet Backplane Protocol |
| 6715-6766 | tcp/udp | # | Unassigned |
| 6718 |
tcp |
# |
Kilo |
| 6723 |
tcp |
# |
Mstream |
| 6754 |
tcp/udp |
# |
Mapsy |
| 6767 | tcp/udp | bmc-perf-agent | BMC PERFORM AGENT |
| 6768 | tcp/udp | bmc-perf-mgrd | BMC PERFORM MGRD |
| 6769-6787 | tcp/udp | # | Unassigned |
| 6771 |
tcp |
# |
Deep Throat, Foreplay |
| 6776 |
tcp/udp |
hnmp |
RAT:SubSeven
This port often seen as part of the Sub7
communication. You may see a steady
stream of connection attempts: this is
because it uses this port separately from
the command port in order to transfer
information. Sometimes the control-
connection thinks the agent is alive,
and will continue to attempt this
connection as well. Backdoor port in Sub7 |
| 6776 |
tcp |
# |
2000 Cracks, BackDoor-G, VP Killer |
| 6788 | tcp/udp | smc-http | SMC-HTTP |
| 6789 | tcp/udp | smc-https | SMC-HTTPS |
| 6789 |
tcp |
# |
W32.Netsky |
| 6790 | tcp/udp | hnmp | HNMP |
| 6791-6830 | tcp/udp | # | Unassigned |
| 6831 | tcp/udp | ambit-lm | ambit-lm |
| 6832-6840 | tcp/udp | # | Unassigned |
| 6838 |
udp |
# |
Mstream |
| 6841 | tcp/udp | netmo-default | Netmo Default |
| 6842 | tcp/udp | netmo-http | Netmo HTTP |
| 6843-6849 | tcp/udp | # | Unassigned |
| 6850 | tcp/udp | iccrushmore | ICCRUSHMORE |
| 6851-6887 | tcp/udp | # | Unassigned |
| 6883 |
tcp |
# |
Delta Source DarkStar |
| 6888 | tcp/udp | muse | MUSE |
| 6889-6960 | tcp/udp | # | Unassigned |
| 6912 |
tcp |
# |
Shit Heep |
| 6939 |
tcp |
# |
Indoctrination |
| 6961 | tcp/udp | jmact3 | JMACT3 |
| 6962 | tcp/udp | jmevt2 | jmevt2 |
| 6963 | tcp/udp | swismgr1 | swismgr1 |
| 6964 | tcp/udp | swismgr2 | swismgr2 |
| 6965 | tcp/udp | swistrap | swistrap |
| 6966 | tcp/udp | swispol | swispol |
| 6967-6968 | tcp/udp | # | Unassigned |
| 6969 | tcp/udp | acmsoda | acmsoda |
| 6969 |
tcp |
# |
GateCrasher, IRC 3, Net Controller, Priority,
Robi, Sparta, Floodnet, Assasin, Khaos, Ratega,
Danton |
| 6970-6997 | tcp/udp | # | Unassigned |
| 6970 |
tcp |
# |
GateCrasher |
| 6970-6971 |
udp |
# |
RTP(RealTime Protocol) |
| 6998 | tcp/udp | iatp-highpri | IATP-highPri |
| 6999 | tcp/udp | iatp-normalpri | IATP-normalPri |