| Port No. | Protocol | Service | Description |
|---|
| 9000 | tcp/udp | cslistener | CSlistener |
| 9000 |
tcp |
# |
AltaVista HTTP Server
The may be an attempt to compromise
an AltaVista HTTP (web) server. |
| 9000 |
tcp |
# |
Sendmail Switch SDAP
Sendmail's "Switch" protocol listens on
this TCP port. It also listens on port 8890. |
| 9000 |
tcp |
# |
Netministrator |
| 9000 |
udp |
# |
Asheron's Call
This port is used in Microsoft's massively-
multiplayer game called "Asheron's Call".
The game can continue to contact the
player even after the player has logged out. |
| 9001 | tcp/udp | etlservicemgr | ETL Service Manager |
| 9002 | tcp/udp | dynamid | DynamID authentication |
| 9003-9005 | tcp/udp | # | Unassigned |
| 9006 | tcp/udp | # | "De-Commissioned Port 02/24/00, ms" |
| 9007-9008 | tcp/udp | # | Unassigned |
| 9009 | tcp/udp | pichat | Pichat Server |
| 9010-9019 | tcp/udp | # | Unassigned |
| 9010 |
tcp |
# |
Tumag |
| 9020 | tcp/udp | tambora | TAMBORA |
| 9021 | tcp/udp | panagolin-ident | Pangolin Identification |
| 9022 | tcp/udp | paragent | PrivateArk Remote Agent |
| 9023 | tcp/udp | swa-1 | Secure Web Access - 1 |
| 9024 | tcp/udp | swa-2 | Secure Web Access - 2 |
| 9025 | tcp/udp | swa-3 | Secure Web Access - 3 |
| 9026 | tcp/udp | swa-4 | Secure Web Access - 4 |
| 9027-9079 | tcp/udp | # | Unassigned |
| 9080 | tcp/udp | glrpc | Groove GLRPC |
| 9081-9089 | tcp/udp | # | Unassigned |
| 9090 | tcp/udp | websm | WebSM |
| 9091 | tcp/udp | xmltec-xmlmail | xmltec-xmlmail |
| 9092-9099 | tcp/udp | # | Unassigned |
| 9100 | tcp/udp | hp-pdl-datastr | PDL Data Streaming Port |
| 9100 | tcp/udp | pdl-datastream | Printer PDL Data Stream |
| 9101 | tcp/udp | bacula-dir | Bacula Director |
| 9102 | tcp/udp | bacula-fd | Bacula File Daemon |
| 9103 | tcp/udp | bacula-sd | Bacula Storage Daemon |
| 9104 | tcp/udp | peerwire | PeerWire |
| 9105-9159 | tcp/udp | # | Unassigned |
| 9136 |
tcp/udp |
# |
Sdbot |
| 9148 |
tcp/udp |
# |
W32.HLLW.Nautic |
| 9160 | tcp/udp | netlock1 | NetLOCK1 |
| 9161 | tcp/udp | netlock2 | NetLOCK2 |
| 9162 | tcp/udp | netlock3 | NetLOCK3 |
| 9163 | tcp/udp | netlock4 | NetLOCK4 |
| 9164 | tcp/udp | netlock5 | NetLOCK5 |
| 9165-9199 | tcp/udp | # | Unassigned |
| 9200 | tcp/udp | wap-wsp | WAP connectionless session service |
| 9200 |
tcp/udp |
# |
Lexmark printers open both TCP and
UDP port 9200 for some unknown purpose. |
| 9201 | tcp/udp | wap-wsp-wtp | WAP session service |
| 9202 | tcp/udp | wap-wsp-s | WAP secure connectionless session service |
| 9203 | tcp/udp | wap-wsp-wtp-s | WAP secure session service |
| 9204 | tcp/udp | wap-vcard | WAP vCard |
| 9205 | tcp/udp | wap-vcal | WAP vCal |
| 9206 | tcp/udp | wap-vcard-s | WAP vCard Secure |
| 9207 | tcp/udp | wap-vcal-s | WAP vCal Secure |
| 9208-9209 | tcp/udp | # | Unassigned |
| 9210 | tcp/udp | oma-mlp | OMA Mobile Location Protocol |
| 9211 | tcp/udp | oma-mlp-s | OMA Mobile Location Protocol Secure |
| 9212-9216 | tcp/udp | # | Unassigned |
| 9217 | tcp/udp | fsc-port | FSC Communication Port |
| 9218-9221 | tcp/udp | # | Unassigned |
| 9222 | tcp/udp | teamcoherence | QSC Team Coherence |
| 9223-9280 | tcp/udp | # | Unassigned |
| 9281 | tcp/udp | swtp-port1 | SofaWare transport port 1 |
| 9282 | tcp/udp | swtp-port2 | SofaWare transport port 2 |
| 9283 | tcp/udp | callwaveiam | CallWaveIAM |
| 9284 | tcp/udp | visd | VERITAS Information Serve |
| 9285 | tcp/udp | n2h2server | N2H2 Filter Service Port |
| 9286 | tcp/udp | # | Unassigned |
| 9287 | tcp/udp | cumulus | Cumulus |
| 9288-9291 | tcp/udp | # | Unassigned |
| 9292 | tcp/udp | armtechdaemon | ArmTech Daemon |
| 9293-9317 | tcp/udp | # | Unassigned |
| 9318 | tcp/udp | secure-ts | PKIX TimeStamp over TLS |
| 9319-9320 | tcp/udp | # | Unassigned |
| 9321 | tcp/udp | guibase | guibase |
| 9322-9342 | tcp/udp | # | Unassigned |
| 9325 |
udp |
# |
Mstream |
| 9343 | tcp/udp | mpidcmgr | MpIdcMgr |
| 9344 | tcp/udp | mphlpdmc | Mphlpdmc |
| 9345 | tcp/udp | # | Unassigned |
| 9346 | tcp/udp | ctechlicensing | C Tech Licensing |
| 9347-9373 | tcp/udp | # | Unassigned |
| 9374 | tcp/udp | fjdmimgr | fjdmimgr |
| 9375-9395 | tcp/udp | # | Unassigned |
| 9396 | tcp/udp | fjinvmgr | fjinvmgr |
| 9397 | tcp/udp | mpidcagt | MpIdcAgt |
| 9398-9499 | tcp/udp | # | Unassigned |
| 9400 |
tcp |
# |
InCommand |
| 9500 | tcp/udp | ismserver | ismserver |
| 9501-9534 | tcp/udp | # | Unassigned |
| 9535 | tcp/udp | mngsuite | Management Suite Remote Control |
| 9536-9554 | tcp/udp | # | Unassigned |
| 9555 | tcp/udp | trispen-sra | Trispen UDP tunnel |
| 9556-9592 | tcp/udp | # | Unassigned |
| 9593 | tcp/udp | cba8 | LANDesk Management Agent |
| 9594 | tcp/udp | msgsys | Message System |
| 9595 | tcp/udp | pds | Ping Discovery Service |
| 9596-9599 | tcp/udp | # | Unassigned |
| 9600 | tcp/udp | micromuse-ncpw | MICROMUSE-NCPW |
| 9601-9611 | tcp/udp | # | Unassigned |
| 9604 |
tcp |
# |
W32.Kibuv.Worm |
| 9612 | tcp/udp | streamcomm-ds | StreamComm User Directory |
| 9613-9746 | tcp/udp | # | Unassigned |
| 9696-9697 |
tcp |
# |
Gholame |
| 9704 |
tcp |
# |
A popular Linux rpc.statd exploit
will drop a root shell on this port. |
| 9704 |
tcp/udp |
# |
A popular wu-fptd exploit drops
a root shell on this port. |
| 9747 | tcp/udp | l5nas-parchan | L5NAS Parallel Channel |
| 9748-9752 | tcp/udp | # | Unassigned |
| 9753 | tcp/udp | rasadv | rasadv |
| 9754-9799 | tcp/udp | # | Unassigned |
| 9777-9778 |
tcp/udp |
# |
StealthEye |
| 9800 | tcp/udp | davsrc | WebDav Source Port |
| 9801 | tcp/udp | sstp-2 | Sakura Script Transfer Protocol-2 |
| 9802 | tcp/udp | davsrcs | WebDAV Source TLS/SSL |
| 9803-9874 | tcp/udp | # | Unassigned |
| 9867 |
tcp/udp |
# |
Sokeven |
| 9870 |
tcp/udp |
# |
Recerv, R3C |
| 9871 |
tcp |
# |
Theef |
| 9872-9875 |
tcp |
# |
Portal of Doom |
| 9875 | tcp/udp | sapv1 | Session Announcement v1 |
| 9876 | tcp/udp | sd | Session Director |
| 9876 |
tcp/udp |
# | A Norton Commander lookalike
for UNIX. The client portion can
browse files on the hard disk, in
tar files, and across the network
with this server component. This
protocol is Sun RPC based and
registers with portmapper. |
| 9876 |
tcp |
# |
Cyber Attacker, Rux, Lolok |
| 9878 |
tcp |
# |
TransScout |
| 9888 | tcp/udp | cyborg-systems | CYBORG Systems |
| 9898 | tcp/udp | monkeycom | MonkeyCom |
| 9898 |
tcp/udp |
# |
CrashCool, W32.Dabber |
| 9899 | tcp/udp | sctp-tunneling | SCTP TUNNELING |
| 9900 | tcp/udp | iua | IUA |
| 9900 |
tcp/udp |
# |
W32.HLLW.Gaobot |
| 9901-9908 | tcp/udp | # | Unassigned |
| 9909 | tcp/udp | domaintime | domaintime |
| 9910 | tcp/udp | # | Unassigned |
| 9911 | tcp/udp | sype-transport | SYPECom Transport Protocol |
| 9912-9949 | tcp/udp | # | Unassigned |
| 9950 | tcp/udp | apc-9950 | APC 9950 |
| 9951 | tcp/udp | apc-9951 | APC 9951 |
| 9952 | tcp/udp | apc-9952 | APC 9952 |
| 9953-9988 | tcp/udp | # | Unassigned |
| 9989 |
tcp |
# |
RAT:IniKiller
Destroys basic files, like .ini files |
| 9990 | tcp/udp | osm-appsrvr | OSM Applet Server |
| 9991 | tcp/udp | osm-oev | OSM Event Server |
| 9992 | tcp/udp | palace-1 | OnLive-1 |
| 9993 | tcp/udp | palace-2 | OnLive-2 |
| 9994 | tcp/udp | palace-3 | OnLive-3 |
| 9995 | tcp/udp | palace-4 | Palace-4 |
| 9996 | tcp/udp | palace-5 | Palace-5 |
| 9996 |
tcp/udp |
# |
W32.Sasser |
| 9997 | tcp/udp | palace-6 | Palace-6 |
| 9998 | tcp/udp | distinct32 | Distinct32 |
| 9999 | tcp/udp | distinct | distinct |
| 9999 |
tcp |
# |
The Prayer, Beasty |