| Port | Typ | Service | 
| 1 | TCP Port Service Multiplexer | |
| 2 | Management Utility | |
| 2 | tcp | Death | 
| 3 | Compression Process | |
| 5 | Remote Job Entry | |
| 7 | udp / tcp | Echo | 
| 9 | udp / tcp | Discard (sink null) | 
| 11 | Active Users | |
| 11 | tcp | systat (users) | 
| 13 | udp / tcp | Daytime | 
| 15 | tcp | netstat | 
| 17 | udp / tcp | Quote of the Day | 
| 18 | tcp | Message Send Protocol | 
| 19 | udp / tcp | Character Generator (ttytst source) | 
| 20 | tcp | File Transfer [Default Data] | 
| 21 | tcp | File Transfer Protocol [Control] | 
| 21 | tcp | Back Construction; Blade Runner; Doly Trojan; Fore; 7tp trojan; Invisible FTP; Larva; MBT; Motiv; Ne | 
| 22 | TCP | SSH Secure Shell (Remote Login Protocol) Daten verschlüsselt, Überprüfung der "Echtheit" | 
| 22 | tcp | abc | 
| 23 | tcp | Telnet | 
| 23 | tcp | Prosiak (telnet); Tiny Telnet Server; Truva Atl; Wingate | 
| 24 | any private mail system | |
| 25 | tcp | Simple Mail Transfer Protokol | 
| 25 | tcp | Aji; Antigen; Email Password Sender; Email Worms; Gip; Happy99/Ska; Haebu Coceda; Loveletter; Kuang2 | 
| 27 | NSW User System FE | |
| 29 | MSG ICP | |
| 31 | MSG Authentication | |
| 31 | tcp | Agent 31; Hackers Paradise; Masters Paradise; Masters Paradise.80 | 
| 33 | Display Support Protocol | |
| 35 | any private printer server | |
| 37 | udp / tcp | Time | 
| 38 | Route Access Protocol | |
| 39 | udp | RIP Resource Location Protocol | 
| 41 | Graphics | |
| 41 | tcp | DeepThroat | 
| 42 | udp / tcp | WINS Host Name Server | 
| 43 | tcp | whois (Who is) | 
| 44 | MPM FLAGS Protocol | |
| 45 | Message Processing Module [recv] | |
| 46 | MPM [default send] | |
| 47 | NI FTP | |
| 48 | Digital Audit Daemon | |
| 48 | tcp | DRAT | 
| 49 | Login Host Protocol (TACACS) | |
| 50 | Remote Mail Checking Protocol | |
| 50 | tcp | DRAT | 
| 51 | IMP Logical Address Maintenance | |
| 52 | XNS Time Protocol | |
| 53 | udp / tcp | DNS Domain Name Server | 
| 53 | tcp | Bonk (DoS) | 
| 54 | XNS Clearinghouse | |
| 55 | ISI Graphics Language | |
| 56 | XNS Authentication | |
| 57 | tcp | mtp | 
| 57 | any private terminal access | |
| 58 | XNS Mail | |
| 58 | tcp | DMSetup | 
| 59 | any private file service | |
| 59 | tcp | DMSetup | 
| 60 | Unassigned | |
| 61 | NI MAIL | |
| 62 | ACA Services | |
| 63 | whois++ | |
| 64 | Communications Integrator (CI) | |
| 65 | TACACS-Database Service | |
| 66 | Oracle SQL*NET | |
| 67 | udp | Bootstrap Protocol Server | 
| 68 | Bootstrap Protocol Client | |
| 69 | udp | Trivial File Transfer | 
| 70 | Gopher | |
| 71 | Remote Job Service | |
| 72 | Remote Job Service | |
| 73 | Remote Job Service | |
| 74 | Remote Job Service | |
| 75 | any private dial out service | |
| 76 | Distributed External Object Store | |
| 77 | tcp | any private RJE service | 
| 78 | vettcp | |
| 79 | tcp | Finger | 
| 79 | tcp | Firehotcker | 
| 80 | tcp | World Wide Web HTTP | 
| 80 | tcp | Back End; Executor; Hooker; RingZero | 
| 81 | HOSTS2 Name Server | |
| 82 | XFER Utility | |
| 83 | MIT ML Device | |
| 84 | Common Trace Facility | |
| 85 | MIT ML Device | |
| 86 | Micro Focus Cobol | |
| 87 | tcp | any private terminal link | 
| 88 | tcp | kerberos | 
| 89 | SU/MIT Telnet Gateway | |
| 90 | DNSIX Securit Attribute Token Map | |
| 91 | MIT Dover Spooler | |
| 92 | Network Printing Protocol | |
| 93 | Device Control Protocol | |
| 94 | tcp | Tivoli Object Dispatcher | 
| 95 | tcp | SUPDUP | 
| 96 | DIXIE Protocol Specification | |
| 97 | Swift Remote Virtural File Protocol | |
| 98 | TAC News | |
| 99 | Metagram Relay | |
| 99 | tcp | Hidden Port | 
| 100 | [unauthorized use] | |
| 101 | tcp | NIC Host Name Server | 
| 102 | tcp | ISO-TSAP Class 0 | 
| 103 | Genesis Point-to-Point Trans Net | |
| 103 | tcp | dictionary | 
| 103 | tcp | X400 | 
| 104 | tcp | x400-snd | 
| 104 | ACR-NEMA Digital Imag. & Comm. 300 | |
| 105 | tcp | CSNET name server protocol | 
| 106 | 3COM-TSMUX | |
| 107 | Remote Telnet Service | |
| 108 | SNA Gateway Access Server | |
| 109 | tcp | Post Office Protocol - Version 2 | 
| 110 | tcp | Post Office Protocol - Version 3 | 
| 110 | tcp | ProMail trojan | 
| 111 | ucp / tcp | portmap | 
| 111 | ucp / tcp | rpc SUN Remote Procedure Call | 
| 112 | McIDAS Data Transmission Protocol | |
| 113 | tcp | Authentication Service (Ping) | 
| 113 | tcp | Invisible Identd Deamon; Kazimas | 
| 114 | Audio News Multicast | |
| 115 | tcp | Simple File Transfer Protocol | 
| 116 | ANSA REX Notify | |
| 117 | tcp | Path | 
| 117 | tcp | UUCP Path Service | 
| 118 | SQL Services | |
| 118 | tcp | Infector 1.4.2 | 
| 119 | tcp | Network News Transfer Protocol (Newsgroups) | 
| 119 | tcp | Happy99/Ska | 
| 120 | CFDPTKT | |
| 121 | Encore Expedited Remote Pro.Call | |
| 121 | tcp | JammerKillah; BO jammerkilla | 
| 122 | SMAKYNET | |
| 123 | udp | Network Time Protocol / Zeitdienst | 
| 123 | tcp | Net Controller | 
| 124 | ANSA REX Trader | |
| 125 | Locus PC-Interface Net Map Ser | |
| 126 | Unisys Unitary Login | |
| 127 | Locus PC-Interface Conn Server | |
| 128 | GSS X License Verification | |
| 129 | Password Generator Protocol | |
| 130 | cisco FNATIVE | |
| 131 | cisco TNATIVE | |
| 132 | cisco SYSMAINT | |
| 133 | Statistics Service | |
| 133 | tcp | Farnaz | 
| 134 | INGRES-NET Service | |
| 135 | tcp | RPC Mapi Clients (Netbeui Client) | 
| 135 | DCE endpoint resolution | |
| 136 | udp | RPC NETBIOS Name Service (hier horcht der Netbeui Server) | 
| 136 | PROFILE Naming System | |
| 137 | udp | RPC NETBIOS Name Service (hier horcht der Netbeui Server) | 
| 138 | udp | NETBIOS Datagram Service (RPC) | 
| 139 | tcp | RPC NETBIOS Session Service (Netbeui Client) | 
| 140 | EMFIS Data Service | |
| 141 | EMFIS Control Service | |
| 142 | Britton-Lee IDM | |
| 143 | IMAP Internet Message Access Protocol | |
| 144 | NewS | |
| 145 | UAAC Protocol | |
| 146 | ISO-IP0 | |
| 146 | tcp | Infector 1.x | 
| 147 | ISO-IP | |
| 148 | Jargon | |
| 149 | AED 512 Emulation Service | |
| 150 | SQL-NET | |
| 151 | HEMS | |
| 152 | Background File Transfer Program | |
| 153 | tcp | SGMP | 
| 154 | NETSC | |
| 155 | NETSC | |
| 156 | SQL Service | |
| 157 | KNET/VM Command/Message Protocol | |
| 158 | tcp | tcprepo PCMail Server | 
| 159 | NSS-Routing | |
| 160 | SGMP-TRAPS | |
| 161 | udp | SNMP | 
| 162 | udp | SNMPTRAP | 
| 163 | CMIP Manager | |
| 164 | CMIP Agent | |
| 165 | Xerox | |
| 166 | Sirius Systems | |
| 167 | NAMP | |
| 168 | RSVD | |
| 169 | SEND | |
| 170 | tcp | print-srv | 
| 170 | Network PostScript | |
| 170 | tcp | A-Trojan | 
| 171 | Network Innovations Multiplex | |
| 172 | Network Innovations CL/1 | |
| 173 | Xyplex | |
| 174 | MAILQ | |
| 175 | tcp | VMNET | 
| 176 | GENRAD-MUX | |
| 177 | X Display Manager Control Protocol | |
| 178 | NextStep Window Server | |
| 179 | Border Gateway Protocol | |
| 180 | Intergraph | |
| 181 | Unify | |
| 182 | Unisys Audit SITP | |
| 183 | OCBinder | |
| 184 | OCServer | |
| 185 | Remote-KIS | |
| 186 | KIS Protocol | |
| 187 | Application Communication Interface | |
| 188 | Plus Five's MUMPS | |
| 189 | Queued File Transport | |
| 190 | Gateway Access Control Protocol | |
| 191 | Prospero Directory Service | |
| 192 | OSU Network Monitoring System | |
| 193 | Spider Remote Monitoring Protocol | |
| 194 | Internet Relay Chat Protocol | |
| 195 | DNSIX Network Level Module Audit | |
| 196 | DNSIX Session Mgt Module Audit Redir | |
| 197 | Directory Location Service | |
| 198 | Directory Location Service Monitor | |
| 199 | SMUX | |
| 200 | IBM System Resource Controller | |
| 201 | AppleTalk Routing Maintenance | |
| 202 | AppleTalk Name Binding | |
| 203 | AppleTalk Unused | |
| 204 | AppleTalk Echo | |
| 205 | AppleTalk Unused | |
| 206 | AppleTalk Zone Information | |
| 207 | AppleTalk Unused | |
| 208 | AppleTalk Unused | |
| 209 | The Quick Mail Transfer Protocol | |
| 210 | ANSI Z39.50 | |
| 211 | Texas Instruments 914C/G Terminal | |
| 212 | ATEXSSTR | |
| 213 | IPX | |
| 214 | VM PWSCS | |
| 215 | Insignia Solutions | |
| 216 | Computer Associates Int'l License Server | |
| 217 | dBASE Unix | |
| 218 | Netix Message Posting Protocol | |
| 219 | Unisys ARPs | |
| 220 | tcp | Interactive Mail Access Protocol v3 | 
| 220 | tcp | pop3 | 
| 221 | Berkeley rlogind with SPX auth | |
| 222 | Berkeley rshd with SPX auth | |
| 223 | Certificate Distribution Center | |
| 242 | Direct | |
| 243 | Survey Measurement | |
| 244 | Dayna | |
| 245 | LINK | |
| 246 | Display Systems Protocol | |
| 256 | RAP | |
| 257 | Secure Electronic Transaction | |
| 258 | Yak Winsock Personal Chat | |
| 259 | Efficient Short Remote Operations | |
| 260 | Openport | |
| 261 | IIOP Naming Service (SSL) | |
| 262 | Arcisdms | |
| 263 | HDAP | |
| 280 | http-mgmt | |
| 281 | Personal Link | |
| 282 | Cable Port A/X | |
| 309 | EntrustTime | |
| 315 | udp | load | 
| 315 | tcp | The Invasor | 
| 344 | Prospero Data Access Protocol | |
| 345 | Perf Analysis Workbench | |
| 346 | Zebra server | |
| 347 | Fatmen Server | |
| 348 | Cabletron Management Protocol | |
| 349 | mftp | |
| 350 | MATIP Type A | |
| 351 | MATIP Type B | |
| 371 | Clearcase | |
| 372 | ListProcessor | |
| 373 | Legent Corporation | |
| 374 | Legent Corporation | |
| 375 | Hassle | |
| 376 | Amiga Envoy Network Inquiry Proto | |
| 377 | NEC Corporation | |
| 378 | NEC Corporation | |
| 379 | TIA/EIA/IS-99 modem client | |
| 380 | TIA/EIA/IS-99 modem server | |
| 381 | hp performance data collector | |
| 382 | hp performance data managed node | |
| 383 | hp performance data alarm manager | |
| 384 | A Remote Network Server System | |
| 385 | IBM Application | |
| 386 | ASA Message Router Object Def. | |
| 387 | Appletalk Update-Based Routing Pro. | |
| 388 | Unidata LDM Version 4 | |
| 389 | Windows Logon Application (LDAP) | |
| 389 | Lightweight Directory Access Protocol | |
| 390 | UIS | |
| 391 | SynOptics SNMP Relay Port | |
| 392 | SynOptics Port Broker Port | |
| 393 | Data Interpretation System | |
| 394 | EMBL Nucleic Data Transfer | |
| 395 | NETscout Control Protocol | |
| 396 | Novell Netware over IP | |
| 397 | Multi Protocol Trans. Net. | |
| 398 | Kryptolan | |
| 399 | ISO Transport Class 2 Non-Control over TCP | |
| 400 | tcp | vmnet0 | 
| 400 | Workstation Solutions | |
| 401 | Uninterruptible Power Supply | |
| 402 | Genie Protocol | |
| 403 | decap | |
| 404 | nced | |
| 405 | ncld | |
| 406 | Interactive Mail Support Protocol | |
| 407 | Timbuktu | |
| 408 | Prospero Resource Manager Sys. Man. | |
| 409 | Prospero Resource Manager Node Man. | |
| 410 | DECLadebug Remote Debug Protocol | |
| 411 | Remote MT Protocol | |
| 412 | Trap Convention Port | |
| 413 | SMSP | |
| 414 | InfoSeek | |
| 415 | BNet | |
| 416 | Silverplatter | |
| 417 | Onmux | |
| 418 | Hyper-G | |
| 419 | Ariel | |
| 420 | SMPTE | |
| 421 | Ariel | |
| 421 | tcp | (TCP Wrappers) | 
| 422 | Ariel | |
| 423 | IBM Operations Planning and Control Start | |
| 424 | IBM Operations Planning and Control Track | |
| 425 | ICAD | |
| 426 | smartsdp | |
| 427 | Server Location | |
| 428 | OCS_CMU | |
| 429 | OCS_AMU | |
| 430 | UTMPSD | |
| 431 | UTMPCD | |
| 432 | IASD | |
| 433 | NNSP | |
| 434 | MobileIP-Agent | |
| 435 | MobilIP-MN | |
| 436 | DNA-CML | |
| 437 | comscm | |
| 438 | dsfgw | |
| 439 | dasp Thomas Obermair | |
| 440 | sgcp | |
| 441 | decvms-sysmgt | |
| 442 | cvc_hostd | |
| 443 | https SSL-Verschlüsselung, MCom | |
| 444 | Simple Network Paging Protocol | |
| 445 | Microsoft-DS | |
| 446 | DDM-RDB | |
| 447 | DDM-RFM | |
| 448 | DDM-BYTE | |
| 449 | AS Server Mapper | |
| 450 | TServer | |
| 451 | Cray Network Semaphore server | |
| 452 | Cray SFS config server | |
| 453 | CreativeServer | |
| 454 | ContentServer | |
| 455 | CreativePartnr | |
| 456 | macon-tcp | |
| 456 | tcp | Hackers Paradise | 
| 457 | scohelp | |
| 458 | apple quick time | |
| 459 | ampr-rcmd | |
| 460 | skronk | |
| 461 | DataRampSrv | |
| 462 | DataRampSrvSec | |
| 463 | alpes | |
| 464 | kpasswd | |
| 465 | ssmtp | |
| 466 | digital-vrc | |
| 467 | mylex-mapd | |
| 468 | proturis | |
| 469 | Radio Control Protocol | |
| 470 | scx-proxy | |
| 471 | Mondex | |
| 472 | ljk-login | |
| 473 | hybrid-pop | |
| 474 | tn-tl-w1 | |
| 475 | tcpnethaspsrv | |
| 476 | tn-tl-fd1 | |
| 477 | ss7ns | |
| 478 | spsc | |
| 479 | iafserver | |
| 480 | iafdbase | |
| 481 | Ph service | |
| 482 | bgs-nsi | |
| 483 | ulpnet | |
| 484 | Integra Software Management Environment | |
| 485 | Air Soft Power Burst | |
| 486 | avian | |
| 487 | saft | |
| 488 | gss-http | |
| 489 | nest-protocol | |
| 490 | micom-pfs | |
| 491 | go-login | |
| 492 | Transport Independent Convergence for FNA | |
| 493 | Transport Independent Convergence for FNA | |
| 494 | POV-Ray | |
| 495 | intecourier | |
| 496 | PIM-RP-DISC | |
| 497 | dantz | |
| 498 | siam | |
| 499 | ISO ILL Protocol | |
| 500 | udp | ipsec/ike Schlüsselaustausch für VPNs auf IPsec-Basis | 
| 500 | isakmp | |
| 501 | STMF | |
| 502 | asa-appl-proto | |
| 503 | Intrinsa | |
| 504 | citadel | |
| 505 | mailbox-lm | |
| 506 | ohimsrv | |
| 507 | crs | |
| 508 | xvttp | |
| 509 | snare | |
| 510 | FirstClass Protocol | |
| 511 | mynet-as | |
| 512 | udp | biff (comsat) | 
| 512 | tcp | exec | 
| 512 | remote process execution; | |
| 513 | tcp | remote login a la telnet; | 
| 513 | udp | who | 
| 514 | udp | syslog | 
| 514 | tcp | cmd (shell) | 
| 515 | tcp | spooler | 
| 516 | videotex | |
| 517 | udp | talk | 
| 517 | like tenex link | |
| 518 | unp | ntalk | 
| 519 | unixtime | |
| 520 | udp | route | 
| 520 | tcp | extended file name server | 
| 521 | ripng | |
| 522 | ULP | |
| 523 | IBM-DB2 | |
| 524 | NCP | |
| 525 | udp | timeserver | 
| 526 | tcp | tempo newdate | 
| 527 | Stock IXChange | |
| 528 | Customer IXChange | |
| 529 | IRC-SERV | |
| 530 | tcp | rpc courier | 
| 531 | tcp | chat | 
| 531 | tcp | Rasmin | 
| 531 | udp | rdv-control (MIT Disk) | 
| 532 | tcp | readnews | 
| 533 | udp | for emergency broadcasts | 
| 534 | MegaMedia Admin | |
| 535 | iiop | |
| 536 | opalis-rdv | |
| 537 | Networked Media Streaming Protocol | |
| 538 | gdomap | |
| 539 | Apertus Technologies Load Determination | |
| 540 | tcp | uucpd | 
| 541 | uucp-rlogin | |
| 542 | commerce | |
| 543 | tcp | Kerberos authenticated rlogin | 
| 544 | tcp | kshell (cmd & remote shell) | 
| 545 | appleqtcsrvr | |
| 546 | DHCPv6 Client | |
| 547 | DHCPv6 Server | |
| 548 | AFP over TCP | |
| 549 | IDFP | |
| 550 | udp | new-who | 
| 551 | cybercash | |
| 552 | deviceshare | |
| 553 | pirp | |
| 554 | Real Time Stream Control Protocol | |
| 555 | tcp | Ini-Killer; NeTAdministrator; Phase Zero; Stealth Spy | 
| 556 | tcp | rfs server (Brunhoff remote filesystem) | 
| 557 | openvms-sysipc | |
| 558 | SDNSKMP | |
| 559 | TEEDTAP | |
| 560 | udp | rmonitord | 
| 561 | udp | monitor | 
| 562 | chcmd | |
| 563 | snews | |
| 563 | NNTP Protocol over TLS/SSL | |
| 564 | plan 9 file service | |
| 565 | whoami | |
| 566 | streettalk | |
| 567 | banyan-rpc | |
| 568 | microsoft shuttle | |
| 569 | microsoft rome | |
| 570 | demon | |
| 571 | udemon | |
| 572 | sonar | |
| 573 | banyan-vip | |
| 574 | FTP Software Agent System | |
| 575 | VEMMI | |
| 576 | ipcd | |
| 577 | vnas | |
| 578 | ipdd | |
| 579 | decbsrv | |
| 580 | SNTP HEARTBEAT | |
| 581 | Bundle Discovery Protocol | |
| 591 | FileMaker | |
| 592 | Eudora Set | |
| 600 | tcp | garcon | 
| 600 | Sun IPC server | |
| 601 | tcp | maitrd | 
| 602 | tcp | busboy | 
| 606 | Cray Unified Resource Manager | |
| 606 | tcp | Secret Service | 
| 607 | nqs | |
| 608 | Sender-Initiated/Unsolicited File Transfer | |
| 609 | npmp-trap | |
| 610 | npmp-local | |
| 611 | npmp-gui | |
| 612 | HMMP Indication | |
| 613 | HMMP Operation | |
| 614 | SSLshell | |
| 615 | Internet Configuration Manager | |
| 616 | SCO System Administration Server | |
| 617 | SCO Desktop Administration Server | |
| 618 | DEI-ICDA | |
| 619 | Digital EVM | |
| 620 | SCO WebServer Manager | |
| 631 | tcp | IPP (Internet Printing Protocol) | 
| 633 | Service Status update (Sterling Software) | |
| 634 | ginad | |
| 635 | RLZ DBase | |
| 636 | SSL-LDAP | |
| 637 | lanserver | |
| 666 | tcp | Attack FTP; Satanz Backdoor | 
| 667 | campaign contribution disclosures - SDR Technologies | |
| 667 | tcp | SniperNet | 
| 668 | MeComm | |
| 669 | MeRegister | |
| 669 | tcp | DP Trojan | 
| 670 | VACDSM-SWS | |
| 671 | VACDSM-APP | |
| 672 | VPPS-QUA | |
| 673 | CIMPLEX | |
| 674 | ACAP | |
| 683 | CORBA IIOP | |
| 684 | CORBA IIOP SSL | |
| 692 | tcp | GayOL | 
| 692 | tcp | GayOL | 
| 700 | udp | acctmaster | 
| 701 | udp | acctslave | 
| 702 | udp | acct | 
| 703 | udp | acctlogin | 
| 704 | udp | acctprinter | 
| 704 | udp | elcsd (errlog) | 
| 705 | udp | acctinfo | 
| 705 | AgentX | |
| 706 | udp | acctslave2 | 
| 707 | udp | acctdisk | 
| 709 | Entrust Key Management Service Handler | |
| 710 | Entrust Administration Service Handler | |
| 729 | IBM NetView DM/6000 Server/Client | |
| 730 | IBM NetView DM/6000 send | |
| 731 | IBM NetView DM/6000 receive | |
| 741 | netGW | |
| 742 | Network based Rev. Cont. Sys. | |
| 744 | Flexible License Manager | |
| 747 | Fujitsu Device Control | |
| 748 | Russell Info Sci Calendar Manager | |
| 749 | kerberos administration | |
| 750 | udp /tcp | Kerberos (authentication ) | 
| 751 | udp /tcp | Kerberos_master (authentication ) | 
| 752 | udp | passwd_server (Kerberos authentication ) | 
| 753 | udp | userreg_server (Kerberos authentication ) | 
| 754 | tcp | krb_prop (Kerberos slave propagation) | 
| 754 | tcp | send | 
| 758 | ? | |
| 759 | ? | |
| 760 | ? | |
| 761 | ? | |
| 762 | ? | |
| 763 | ? | |
| 764 | ? | |
| 765 | ? | |
| 767 | phone | |
| 769 | ? | |
| 770 | ? | |
| 771 | ? | |
| 772 | ? | |
| 773 | ? | |
| 774 | ? | |
| 775 | ? | |
| 776 | ? | |
| 777 | tcp | Aim Spy | 
| 780 | ? | |
| 786 | Concert | |
| 800 | ? | |
| 801 | ? | |
| 808 | tcp | WinHole | 
| 815 | tcp | Everyone's Darling | 
| 886 | ICL coNETion locate server | |
| 887 | ICL coNETion server info | |
| 888 | tcp | erlogin ( Login and enviroment passing) | 
| 888 | AccessBuilder | |
| 911 | xact-backup | |
| 911 | tcp | Dark Shadow | 
| 991 | Netnews Administration System | |
| 992 | tcp/udp | Telnet Protocol over TLS/SSL | 
| 993 | tcp/udp | IMAP4 Protocol over TLS/SSL | 
| 995 | tcp/udp | POP3 over SSL | 
| 996 | vsinet | |
| 997 | ? | |
| 998 | ? | |
| 999 | udp | Applix ac | 
| 999 | tcp | DeepThroat | 
| 1000 | tcp | Der Spaeher 3 | 
| 1001 | WEB ex trojan, Der Spaeher 3; Le Guardian; Silencer; WebEx | |
| 1001 | tcp | Der Spaeher 3; Le Guardian; Silencer; WebEx | 
| 1003 | tcp | BackDoor 2.0x | 
| 1010 | tcp | Doly Trojan 1.3 + 1.35; CafeIni 0.9 (1010:1100) | 
| 1011 | tcp | Doly Trojan 1.1/1.2 | 
| 1012 | tcp | Doly Trojan 1.5 | 
| 1015 | tcp | Doly Trojan 1.6 | 
| 1016 | tcp | Doly Trojan | 
| 1020 | tcp | Vampire | 
| 1023 | Reserved | |
| 1024 | Reserved | |
| 1024 | tcp | NetSpy, Latinus | 
| 1025 | tcp | network blackjack, NetSpy; Maverick's Matrix; RemoteStorm | 
| 1027 | ICQ? | |
| 1029 | tcp | InCommand | 
| 1030 | BBN IAD | |
| 1031 | BBN IAD | |
| 1032 | BBN IAD | |
| 1033 | tcp | NetSpy | 
| 1033 | tcp | NetSpy | 
| 1042 | tcp | Bla 1.1 | 
| 1043 | tcp | Bla 1.1 | 
| 1045 | tcp | Rasmin | 
| 1047 | Sun's NEO Object Request Broker | |
| 1047 | tcp | GateCrasher.b, GateCrasher.c | 
| 1048 | Sun's NEO Object Request Broker | |
| 1050 | tcp | MiniCommand | 
| 1058 | nim | |
| 1059 | nimreg | |
| 1067 | Installation Bootstrap Proto. Serv. | |
| 1068 | Installation Bootstrap Proto. Cli. | |
| 1080 | Socks | |
| 1080 | tcp | WinHole; Wingate | 
| 1081 | tcp | WinHole | 
| 1082 | tcp | WinHole | 
| 1083 | tcp | WinHole | 
| 1083 | Anasoft License Manager | |
| 1084 | Anasoft License Manager | |
| 1089 | SocksServer trojan | |
| 1090 | tcp | Xtreme | 
| 1095 | tcp | Rat | 
| 1097 | tcp | Rat | 
| 1098 | tcp | Rat | 
| 1099 | tcp | BFevolution, Rat | 
| 1100 | tcp | CafeIni 0.9 (1010:1100) | 
| 1109 | tcp | kpop (POP with Kerberos) | 
| 1110 | Cluster status info | |
| 1123 | Murray | |
| 1137 | tcp | MTX | 
| 1137 | tcp | MTX | 
| 1155 | Network File Access | |
| 1167 | udp | phone | 
| 1170 | tcp | Psyber Stream Server, Streaming Audio Trojan; Voice | 
| 1200 | tcp | NoBackO | 
| 1201 | tcp | NoBackO | 
| 1207 | tcp | SoftWAR | 
| 1208 | tcp | Infector 1.3 + 1.4.1 | 
| 1212 | tcp | lupa, Kaos | 
| 1212 | tcp | Kaos | 
| 1222 | SNI R&D network | |
| 1225 | tcp | Scarab | 
| 1225 | tcp | Scarab | 
| 1234 | tcp | Ultors Trojan; SubSeven 2.0 | 
| 1243 | tcp | BackDoor-G; SubSeven; Sub7(*); SubSeven Apocalypse; Tiles | 
| 1245 | tcp | VooDoo Doll | 
| 1248 | ? | |
| 1255 | tcp | Scarab | 
| 1256 | tcp | Project nEXT | 
| 1269 | tcp | Maverick's Matrix | 
| 1313 | tcp | BMC_PATROLDB, NETrojan | 
| 1313 | tcp | NETrojan | 
| 1314 | tcp | Photoscript Distributed Printing System | 
| 1338 | tcp | Millenium Worm | 
| 1345 | VPJP | |
| 1346 | Alta Analytics License Manager | |
| 1347 | multi media conferencing | |
| 1349 | Registration Network Protocol | |
| 1349 | tcp | BO DLL | 
| 1350 | Registration Network Protocol | |
| 1351 | Digital Tool Works (MIT) | |
| 1352 | tcp | Lotus Notes / Domino (sync) | 
| 1353 | Relief Consulting | |
| 1354 | RightBrain Software | |
| 1355 | Intuitive Edge | |
| 1356 | CuillaMartin Company | |
| 1357 | Electronic PegBoard | |
| 1358 | CONNLCLI | |
| 1359 | FTSRV | |
| 1360 | MIMER | |
| 1361 | LinX | |
| 1362 | TimeFlies | |
| 1363 | Network DataMover Requester | |
| 1364 | Network DataMover Server | |
| 1365 | Network Software Associates | |
| 1366 | Novell NetWare Comm Service Platform | |
| 1367 | DCS | |
| 1368 | ScreenCast | |
| 1369 | GlobalView to Unix Shell | |
| 1370 | Unix Shell to GlobalView | |
| 1371 | Fujitsu Config Protocol | |
| 1372 | Fujitsu Config Protocol | |
| 1373 | Chromagrafx | |
| 1374 | EPI Software Systems | |
| 1375 | Bytex | |
| 1376 | IBM Person to Person Software | |
| 1377 | Cichlid License Manager | |
| 1378 | Elan License Manager | |
| 1379 | Integrity Solutions | |
| 1380 | Telesis Network License Manager | |
| 1381 | Apple Network License Manager | |
| 1382 | ? | |
| 1383 | GW Hannaway Network License Manager | |
| 1384 | Objective Solutions License Manager | |
| 1385 | Atex Publishing License Manager | |
| 1386 | CheckSum License Manager | |
| 1387 | Computer Aided Design Software Inc LM | |
| 1388 | Objective Solutions DataBase Cache | |
| 1389 | Document Manager | |
| 1390 | Storage Controller | |
| 1391 | Storage Access Server | |
| 1392 | Print Manager | |
| 1393 | Network Log Server | |
| 1394 | Network Log Client | |
| 1395 | PC Workstation Manager software | |
| 1396 | DVL Active Mail | |
| 1397 | Audio Active Mail | |
| 1398 | Video Active Mail | |
| 1399 | Cadkey License Manager | |
| 1400 | Cadkey Tablet Daemon | |
| 1401 | Goldleaf License Manager | |
| 1402 | Prospero Resource Manager | |
| 1403 | Prospero Resource Manager | |
| 1404 | Infinite Graphics License Manager | |
| 1405 | IBM Remote Execution Starter | |
| 1406 | NetLabs License Manager | |
| 1407 | DBSA License Manager | |
| 1408 | Sophia License Manager | |
| 1409 | Here License Manager | |
| 1410 | HiQ License Manager | |
| 1411 | AudioFile | |
| 1412 | InnoSys | |
| 1413 | Innosys-ACL | |
| 1414 | IBM MQSeries | |
| 1415 | DBStar | |
| 1416 | Novell LU6.2 | |
| 1417 | Timbuktu Service 1 Port | |
| 1418 | Timbuktu Service 2 Port | |
| 1419 | Timbuktu Service 3 Port | |
| 1420 | Timbuktu Service 4 Port | |
| 1421 | Gandalf License Manager | |
| 1422 | Autodesk License Manager | |
| 1423 | Essbase Arbor Software | |
| 1424 | Hybrid Encryption Protocol | |
| 1425 | Zion Software License Manager | |
| 1426 | Satellite-data Acquisition System 1 | |
| 1427 | mloadd monitoring tool | |
| 1428 | Informatik License Manager | |
| 1429 | Hypercom NMS | |
| 1430 | Hypercom TPDU | |
| 1431 | Reverse Gossip Transport | |
| 1432 | Blueberry Software License Manager | |
| 1433 | Microsoft-SQL-Server | |
| 1434 | Microsoft-SQL-Monitor | |
| 1435 | IBM CICS | |
| 1436 | Satellite-data Acquisition System 2 | |
| 1437 | Tabula | |
| 1438 | Eicon Security Agent/Server | |
| 1439 | Eicon X25/SNA Gateway | |
| 1440 | Eicon Service Location Protocol | |
| 1441 | Cadis License Management | |
| 1441 | tcp | RemoteStorm | 
| 1442 | Cadis License Management | |
| 1443 | Integrated Engineering Software | |
| 1444 | Marcam License Management | |
| 1445 | Proxima License Manager | |
| 1446 | Optical Research Associates License Manager | |
| 1447 | Applied Parallel Research LM | |
| 1448 | OpenConnect License Manager | |
| 1449 | PEport | |
| 1450 | Tandem Distributed Workbench Facility | |
| 1451 | IBM Information Management | |
| 1452 | GTE Government Systems License Man | |
| 1453 | Genie License Manager | |
| 1454 | interHDL License Manager | |
| 1455 | ESL License Manager | |
| 1456 | DCA | |
| 1457 | Valisys License Manager | |
| 1458 | Nichols Research Corp. | |
| 1459 | Proshare Notebook Application | |
| 1460 | Proshare Notebook Application | |
| 1461 | IBM Wireless LAN | |
| 1462 | World License Manager | |
| 1463 | Nucleus | |
| 1464 | MSL License Manager | |
| 1465 | Pipes Platform | |
| 1466 | Ocean Software License Manager | |
| 1467 | CSDMBASE | |
| 1468 | CSDM | |
| 1469 | Active Analysis Limited License Manager | |
| 1470 | Universal Analytics | |
| 1471 | csdmbase | |
| 1472 | csdm | |
| 1473 | OpenMath | |
| 1474 | Telefinder | |
| 1475 | Taligent License Manager | |
| 1476 | clvm-cfg | |
| 1477 | ms-sna-server | |
| 1478 | ms-sna-base | |
| 1479 | dberegister | |
| 1480 | PacerForum | |
| 1481 | AIRS | |
| 1482 | Miteksys License Manager | |
| 1483 | AFS License Manager | |
| 1484 | Confluent License Manager | |
| 1485 | LANSource | |
| 1486 | nms_topo_serv | |
| 1487 | LocalInfoSrvr | |
| 1488 | DocStor | |
| 1489 | dmdocbroker | |
| 1490 | insitu-conf | |
| 1491 | anynetgateway | |
| 1492 | stone-design-1 | |
| 1492 | tcp | FTP99CMP; Back.Orifice.FTP | 
| 1493 | netmap_lm | |
| 1494 | ica | |
| 1495 | cvc | |
| 1496 | liberty-lm | |
| 1497 | rfx-lm | |
| 1498 | Watcom-SQL | |
| 1499 | Federico Heinz Consultora | |
| 1500 | VLSI License Manager | |
| 1501 | Satellite-data Acquisition System 3 | |
| 1502 | Shiva | |
| 1503 | Databeam | |
| 1504 | EVB Software Engineering License Manager | |
| 1505 | Funk Software | |
| 1506 | Universal Time daemon (utcd) | |
| 1507 | symplex | |
| 1508 | diagmond | |
| 1509 | Robcad | |
| 1509 | tcp | Psyber Streaming Server | 
| 1510 | Midland Valley Exploration Ltd. Lic. Man. | |
| 1511 | 3l-l1 | |
| 1512 | Microsoft's Windows Internet Name Service | |
| 1513 | Fujitsu Systems Business of America | |
| 1514 | Fujitsu Systems Business of America | |
| 1515 | ifor-protocol | |
| 1516 | Virtual Places Audio data | |
| 1517 | Virtual Places Audio control | |
| 1518 | Virtual Places Video data | |
| 1519 | Virtual Places Video control | |
| 1520 | atm zip office | |
| 1521 | nCube License Manager | |
| 1522 | Ricardo North America License Manager | |
| 1523 | cichild | |
| 1524 | tcp | ingreslock | 
| 1524 | tcp | Trin00 (DDoS) | 
| 1525 | oracle | |
| 1526 | Prospero Data Access Prot non-priv | |
| 1527 | oracle | |
| 1528 | micautoreg | |
| 1529 | oracle | |
| 1530 | rap-service | |
| 1531 | rap-listen | |
| 1532 | miroconnect | |
| 1533 | Virtual Places Software | |
| 1534 | micromuse-lm | |
| 1535 | ampr-info | |
| 1536 | ampr-inter | |
| 1537 | isi-lm | |
| 1538 | 3ds-lm | |
| 1539 | Intellistor License Manager | |
| 1540 | rds | |
| 1541 | rds2 | |
| 1542 | gridgen-elmd | |
| 1543 | simba-cs | |
| 1544 | aspeclmd | |
| 1545 | vistium-share | |
| 1546 | abbaccuray | |
| 1547 | laplink | |
| 1548 | Axon License Manager | |
| 1549 | Shiva Hose | |
| 1550 | Image Storage license manager 3M Company | |
| 1551 | HECMTL-DB | |
| 1552 | pciarray | |
| 1553 | sna-cs | |
| 1554 | CACI Products Company License Manager | |
| 1555 | livelan | |
| 1556 | AshWin CI Tecnologies | |
| 1557 | ArborText License Manager | |
| 1558 | xingmpeg | |
| 1559 | web2host | |
| 1560 | asci-val | |
| 1561 | facilityview | |
| 1562 | pconnectmgr | |
| 1563 | Cadabra License Manager | |
| 1564 | Pay-Per-View | |
| 1565 | WinDD | |
| 1566 | CORELVIDEO | |
| 1567 | jlicelmd | |
| 1568 | tsspmap | |
| 1569 | ets | |
| 1570 | orbixd | |
| 1571 | Oracle Remote Data Base | |
| 1572 | Chipcom License Manager | |
| 1573 | itscomm-ns | |
| 1574 | mvel-lm | |
| 1575 | oraclenames | |
| 1576 | moldflow-lm | |
| 1577 | hypercube-lm | |
| 1578 | Jacobus License Manager | |
| 1579 | ioc-sea-lm | |
| 1580 | tn-tl-r1 | |
| 1581 | vmf-msg-port | |
| 1582 | MSIMS | |
| 1583 | simbaexpress | |
| 1584 | tn-tl-fd2 | |
| 1585 | intv | |
| 1586 | ibm-abtact | |
| 1587 | pra_elmd | |
| 1588 | triquest-lm | |
| 1589 | VQP | |
| 1590 | gemini-lm | |
| 1591 | ncpm-pm | |
| 1592 | commonspace | |
| 1593 | mainsoft-lm | |
| 1594 | sixtrak | |
| 1595 | radio | |
| 1596 | radio-sm | |
| 1597 | orbplus-iiop | |
| 1598 | picknfs | |
| 1599 | simbaservices | |
| 1600 | tcp | Shivka-Burka | 
| 1601 | aas | |
| 1602 | inspect | |
| 1603 | pickodbc | |
| 1604 | icabrowser | |
| 1605 | Salutation Manager (Salutation Protocol) | |
| 1606 | Salutation Manager (SLM-API) | |
| 1607 | stt | |
| 1608 | Smart Corp. License Manager | |
| 1609 | isysg-lm | |
| 1610 | taurus-wh | |
| 1611 | Inter Library Loan | |
| 1612 | NetBill Transaction Server | |
| 1613 | NetBill Key Repository | |
| 1614 | NetBill Credential Server | |
| 1615 | NetBill Authorization Server | |
| 1616 | NetBill Product Server | |
| 1617 | Nimrod Inter-Agent Communication | |
| 1618 | skytelnet | |
| 1619 | xs-openstorage | |
| 1620 | faxportwinport | |
| 1621 | softdataphone | |
| 1622 | ontime | |
| 1623 | jaleosnd | |
| 1624 | udp-sr-port | |
| 1625 | svs-omagent | |
| 1636 | CableNet Control Protocol | |
| 1637 | CableNet Admin Protocol | |
| 1638 | CableNet Info Protocol | |
| 1639 | cert-initiator | |
| 1640 | cert-responder | |
| 1641 | InVision | |
| 1642 | isis-am | |
| 1643 | isis-ambc | |
| 1644 | Satellite-data Acquisition System 4 | |
| 1645 | datametrics | |
| 1646 | sa-msg-port | |
| 1647 | rsap | |
| 1648 | concurrent-lm | |
| 1649 | inspect | |
| 1650 | ? | |
| 1651 | shiva_confsrvr | |
| 1652 | xnmp | |
| 1653 | alphatech-lm | |
| 1654 | stargatealerts | |
| 1655 | dec-mbadmin | |
| 1656 | dec-mbadmin-h | |
| 1657 | fujitsu-mmpdc | |
| 1658 | sixnetudr | |
| 1659 | Silicon Grail License Manager | |
| 1660 | skip-mc-gikreq | |
| 1661 | netview-aix-1 | |
| 1662 | netview-aix-2 | |
| 1663 | netview-aix-3 | |
| 1664 | netview-aix-4 | |
| 1665 | netview-aix-5 | |
| 1666 | udp | maze | 
| 1666 | netview-aix-6 | |
| 1667 | netview-aix-7 | |
| 1668 | netview-aix-8 | |
| 1669 | netview-aix-9 | |
| 1670 | netview-aix-10 | |
| 1671 | netview-aix-11 | |
| 1672 | netview-aix-12 | |
| 1673 | Intel Proshare Multicast | |
| 1674 | Intel Proshare Multicast | |
| 1675 | Pacific Data Products | |
| 1676 | netcomm1 | |
| 1677 | groupwise | |
| 1678 | prolink | |
| 1679 | darcorp-lm | |
| 1680 | microcom-sbp | |
| 1681 | sd-elmd | |
| 1682 | lanyon-lantern | |
| 1683 | ncpm-hip | |
| 1684 | SnareSecure | |
| 1685 | n2nremote | |
| 1686 | cvmon | |
| 1687 | nsjtp-ctrl | |
| 1688 | nsjtp-data | |
| 1689 | firefox | |
| 1690 | ng-umds | |
| 1691 | empire-empuma | |
| 1692 | sstsys-lm | |
| 1693 | rrirtr | |
| 1694 | rrimwm | |
| 1695 | rrilwm | |
| 1696 | rrifmm | |
| 1697 | rrisat | |
| 1698 | RSVP-ENCAPSULATION-1 | |
| 1699 | RSVP-ENCAPSULATION-2 | |
| 1700 | mps-raft | |
| 1700 | tcp | Rux.Tick | 
| 1701 | l2f | |
| 1702 | deskshare | |
| 1703 | hb-engine | |
| 1704 | bcs-broker | |
| 1705 | slingshot | |
| 1706 | jetform | |
| 1707 | vdmplay | |
| 1708 | gat-lmd | |
| 1709 | centra | |
| 1710 | impera | |
| 1711 | pptconference | |
| 1712 | resource monitoring service | |
| 1713 | ConferenceTalk | |
| 1714 | sesi-lm | |
| 1715 | houdini-lm | |
| 1716 | xmsg | |
| 1717 | fj-hdnet | |
| 1718 | h323gatedisc | |
| 1719 | h323gatestat | |
| 1720 | h323hostcall | |
| 1721 | caicci | |
| 1722 | HKS License Manager | |
| 1723 | pptp | |
| 1724 | csbphonemaster | |
| 1725 | iden-ralp | |
| 1726 | IBERIAGAMES | |
| 1727 | winddx | |
| 1728 | TELINDUS | |
| 1729 | CityNL License Management | |
| 1730 | roketz | |
| 1731 | MSICCP | |
| 1732 | proxim | |
| 1733 | sipat | |
| 1734 | Camber Corporation License Management | |
| 1735 | PrivateChat | |
| 1736 | street-stream | |
| 1737 | ultimad | |
| 1738 | GameGen1 | |
| 1739 | webaccess | |
| 1740 | encore | |
| 1741 | cisco-net-mgmt | |
| 1742 | 3Com-nsd | |
| 1743 | Cinema Graphics License Manager | |
| 1744 | ncpm-ft | |
| 1745 | remote-winsock | |
| 1746 | ftrapid-1 | |
| 1747 | ftrapid-2 | |
| 1748 | oracle-em1 | |
| 1749 | aspen-services | |
| 1750 | Simple Socket Library's PortMaster | |
| 1751 | SwiftNet | |
| 1752 | Leap of Faith Research License Manager | |
| 1753 | Translogic License Manager | |
| 1754 | oracle-em2 | |
| 1755 | ms-streaming | |
| 1756 | capfast-lmd | |
| 1757 | cnhrp | |
| 1758 | tftp-mcast | |
| 1759 | SPSS License Manager | |
| 1760 | www-ldap-gw | |
| 1761 | cft-0 | |
| 1762 | cft-1 | |
| 1763 | cft-2 | |
| 1764 | cft-3 | |
| 1765 | cft-4 | |
| 1766 | cft-5 | |
| 1767 | cft-6 | |
| 1768 | cft-7 | |
| 1769 | bmc-net-adm | |
| 1770 | bmc-net-svc | |
| 1771 | vaultbase | |
| 1772 | EssWeb Gateway | |
| 1773 | KMSControl | |
| 1774 | global-dtserv | |
| 1776 | Federal Emergency Management Information System | |
| 1777 | powerguardian | |
| 1777 | tcp | Scarab | 
| 1778 | prodigy-internet | |
| 1779 | pharmasoft | |
| 1780 | dpkeyserv | |
| 1781 | answersoft-lm | |
| 1782 | hp-hcip | |
| 1783 | Fujitsu Remote Install Service | |
| 1784 | Finle License Manager | |
| 1784 | tcp | Snid X2 | 
| 1785 | Wind River Systems License Manager | |
| 1786 | funk-logger | |
| 1787 | funk-license | |
| 1788 | psmond | |
| 1789 | hello | |
| 1790 | Narrative Media Streaming Protocol | |
| 1791 | EA1 | |
| 1792 | ibm-dt-2 | |
| 1793 | rsc-robot | |
| 1794 | cera-bcm | |
| 1795 | dpi-proxy | |
| 1796 | Vocaltec Server Administration | |
| 1797 | UMA | |
| 1798 | Event Transfer Protocol | |
| 1799 | NETRISK | |
| 1800 | ANSYS-License manager | |
| 1801 | Microsoft Message Que | |
| 1802 | ConComp1 | |
| 1803 | HP-HCIP-GWY | |
| 1804 | ENL | |
| 1805 | ENL-Name | |
| 1806 | Musiconline | |
| 1807 | Fujitsu Hot Standby Protocol | |
| 1807 | tcp | SpySender | 
| 1808 | Oracle-VP2 | |
| 1809 | Oracle-VP1 | |
| 1810 | Jerand License Manager | |
| 1811 | Scientia-SDB | |
| 1812 | RADIUS Remote Authentication Dial In User Service | |
| 1813 | RADIUS Accounting | |
| 1814 | TDP Suite | |
| 1815 | MMPFT | |
| 1818 | Enhanced Trivial File Transfer Protocol | |
| 1819 | Plato License Manager | |
| 1820 | mcagent | |
| 1821 | donnyworld | |
| 1822 | es-elmd | |
| 1823 | Unisys Natural Language License Manager | |
| 1824 | metrics-pas | |
| 1901 | Fujitsu ICL Terminal Emulator Program A | |
| 1902 | Fujitsu ICL Terminal Emulator Program B | |
| 1903 | Local Link Name Resolution | |
| 1904 | Fujitsu ICL Terminal Emulator Program C | |
| 1905 | Secure UP.Link Gateway Protocol | |
| 1906 | TPortMapperReq | |
| 1907 | IntraSTAR | |
| 1908 | Dawn | |
| 1909 | Global World Link | |
| 1911 | Starlight Networks Multimedia Transport Protocol | |
| 1912 | Unassigned | |
| 1913 | armadp | |
| 1914 | Elm-Momentum | |
| 1915 | FACELINK | |
| 1916 | Persoft Persona | |
| 1917 | nOAgent | |
| 1918 | Candle Directory Service - NDS | |
| 1919 | Candle Directory Service - DCH | |
| 1920 | Candle Directory Service - FERRET | |
| 1944 | close-combat | |
| 1945 | dialogic-elmd | |
| 1946 | tekpls | |
| 1947 | hlserver | |
| 1948 | eye2eye | |
| 1949 | ISMA Easdaq Live | |
| 1950 | ISMA Easdaq Test | |
| 1951 | bcs-lmserver | |
| 1966 | tcp | Fake FTP | 
| 1969 | tcp | OpC BO | 
| 1973 | Data Link Switching Remote Access Protocol | |
| 1978 | TCP | Wurm "Slapper.C\" eine Sicherheitslücke von OpenSSL auf nicht gepatchten Linux-Systemen mit dem Apache | 
| 1981 | tcp | Shockrave | 
| 1985 | Folio Remote Server | |
| 1986 | cisco license management | |
| 1987 | cisco RSRB Priority 1 port | |
| 1988 | cisco RSRB Priority 2 port | |
| 1989 | cisco RSRB Priority 3 port | |
| 1990 | cisco STUN Priority 1 port | |
| 1991 | cisco STUN Priority 2 port | |
| 1992 | cisco STUN Priority 3 port | |
| 1993 | cisco SNMP TCP port | |
| 1994 | cisco serial tunnel port | |
| 1995 | cisco perf port | |
| 1996 | cisco Remote SRB port | |
| 1997 | cisco Gateway Discovery Protocol | |
| 1998 | cisco X.25 service (XOT) | |
| 1999 | cisco identification port | |
| 1999 | tcp | BackDoor; BackDoor 1.00-1.03; BackDoor 2.x; TransScout 1.x | 
| 2000 | tcp | Der Spaeher 3; TransScout; Insane Network | 
| 2001 | tcp | Der Spaeher 3; TransScout; Trojan Cow | 
| 2002 | tcp | TransScout | 
| 2003 | tcp | TransScout | 
| 2004 | tcp | TransScout | 
| 2005 | tcp | TransScout | 
| 2006 | ? | |
| 2007 | ? | |
| 2008 | ? | |
| 2009 | n | |
| 2010 | ? | |
| 2011 | raid | |
| 2012 | ? | |
| 2013 | ? | |
| 2014 | ? | |
| 2015 | ? | |
| 2016 | ? | |
| 2017 | ? | |
| 2018 | ? | |
| 2019 | ? | |
| 2020 | ? | |
| 2021 | ? | |
| 2022 | ? | |
| 2023 | tcp | HackCity Ripper Pro | 
| 2024 | ? | |
| 2025 | ? | |
| 2026 | ? | |
| 2027 | ? | |
| 2028 | ? | |
| 2030 | ? | |
| 2032 | ? | |
| 2033 | ? | |
| 2034 | ? | |
| 2035 | ? | |
| 2038 | ? | |
| 2040 | ? | |
| 2041 | ? | |
| 2042 | isis | |
| 2043 | isis-bcast | |
| 2044 | ? | |
| 2045 | ? | |
| 2046 | ? | |
| 2047 | ? | |
| 2048 | ? | |
| 2049 | udp | NSF (Sun NSF) | 
| 2053 | tcp | knetd (Kerberos de-multiplexor | 
| 2065 | Data Link Switch Read Port Number | |
| 2067 | Data Link Switch Write Port Number | |
| 2080 | tcp | WinHole | 
| 2102 | Zephyr server | |
| 2103 | Zephyr serv-hm connection | |
| 2104 | Zephyr hostmanager | |
| 2105 | tcp | eklogin (Kerberos encrypted rlogin) | 
| 2105 | MiniPay | |
| 2115 | tcp | Bugs | 
| 2140 | tcp | Deep Throat (all versions); The Invasor | 
| 2201 | Advanced Training System Program | |
| 2202 | Int. Multimedia Teleconferencing Cosortium | |
| 2208 | tcp | Rux.PSW | 
| 2213 | Kali | |
| 2221 | Allen-Bradley unregistered port | |
| 2222 | Allen-Bradley unregistered port | |
| 2223 | Allen-Bradley unregistered port | |
| 2232 | IVS Video default | |
| 2233 | INFOCRYPT | |
| 2234 | DirectPlay | |
| 2235 | Sercomm-WLink | |
| 2236 | Nani | |
| 2237 | Optech Port1 License Manager | |
| 2238 | AVIVA SNA SERVER | |
| 2239 | Image Query | |
| 2241 | IVS Daemon | |
| 2279 | xmquery | |
| 2280 | LNVPOLLER | |
| 2281 | LNVCONSOLE | |
| 2282 | LNVALARM | |
| 2283 | LNVSTATUS | |
| 2283 | tcp | HLV Rat 5; Rat | 
| 2284 | LNVMAPS | |
| 2285 | LNVMAILMON | |
| 2286 | NAS-Metering | |
| 2287 | DNA | |
| 2288 | NETML | |
| 2300 | tcp | Xplorer | 
| 2301 | Compaq Insight Manager | |
| 2307 | pehelp | |
| 2401 | cvspserver | |
| 2500 | Resource Tracking system server | |
| 2501 | Resource Tracking system client | |
| 2564 | HP 3000 NS/VT block mode telnet | |
| 2565 | tcp | Striker | 
| 2583 | Wincrash V2.0 trojan | |
| 2583 | tcp | WinCrash 2 | 
| 2592 | netrek | |
| 2600 | tcp | Digital RootBeer | 
| 2700 | tqdata | |
| 2718 | tcp | The Prayer 2 | 
| 2773 | tcp | BackDoor-G; SubSeven; Sub7(*) | 
| 2784 | world wide web - development | |
| 2785 | aic-np | |
| 2786 | aic-oncrpc - Destiny MCD database | |
| 2787 | piccolo - Cornerstone Software | |
| 2788 | NetWare Loadable Module - Seagate Software | |
| 2789 | Media Agent | |
| 2801 | Phineas trojan, Phineas Phucker | |
| 2801 | tcp | Phineas Phucker | 
| 2908 | mao | |
| 2909 | Funk Dialout | |
| 2910 | TDAccess | |
| 2911 | Blockade | |
| 2912 | Epicon | |
| 2989 | tcp | Rat 1.2 | 
| 3000 | tcp | HBCI (Home Banking, 256Bit encryptet) | 
| 3000 | tcp | Remote Shutdown | 
| 3001 | Redwood Broker | |
| 3002 | EXLM Agent | |
| 3010 | Telerate Workstation | |
| 3011 | Trusted Web | |
| 3024 | tcp | WinCrash | 
| 3047 | Fast Security HL Server | |
| 3048 | Sierra Net PC Trader | |
| 3049 | ? | |
| 3128 | Squid Proxy | |
| 3128 | tcp | RingZero | 
| 3129 | tcp | Masters Paradise; MastersParadise.92 | 
| 3141 | VMODEM | |
| 3142 | RDC WH EOS | |
| 3143 | Sea View | |
| 3144 | Tarantella | |
| 3145 | CSI-LFAP | |
| 3150 | tcp | Deep Throat; Deep Throat 10; The Invasor | 
| 3264 | cc:mail/lotus | |
| 3306 | My SQL | |
| 3333 | DEC Notes | |
| 3421 | Bull Apprise portmapper | |
| 3454 | Apple Remote Access Protocol | |
| 3455 | RSVP Port | |
| 3456 | VAT default data | |
| 3456 | tcp | Teror Trojan | 
| 3457 | VAT default control | |
| 3459 | tcp | Eclipse 2000; Sanctuary | 
| 3586 | tcp | Snid X2 | 
| 3700 | tcp | Portal of Doom (PoD); al of Doom | 
| 3791 | tcp | Total Eclipse (FTP) | 
| 3801 | tcp | Total Eclipse | 
| 3883 | Deep Throat 2 trojan | |
| 3900 | Unidata UDT OS | |
| 3984 | MAPPER network node manager | |
| 3985 | MAPPER TCP/IP server | |
| 3986 | MAPPER workstation server | |
| 4000 | tcp | Skydance | 
| 4008 | NetCheque accounting | |
| 4009 | Chimera HWM | |
| 4092 | tcp | WinCrash | 
| 4132 | NUTS Daemon | |
| 4133 | NUTS Bootp Server | |
| 4134 | NIFTY-Serve HMI protocol | |
| 4242 | tcp | Virtual hacking Machine | 
| 4245 | tcp | Rux.Backdoor | 
| 4321 | Remote Who Is | |
| 4321 | tcp | BoBo; Schoolbus 1.0 | 
| 4343 | UNICALL | |
| 4444 | KRB524 | |
| 4444 | tcp | Prosiak; Swift remote | 
| 4445 | UPNOTIFYP | |
| 4446 | N1-FWP | |
| 4447 | N1-RMGMT | |
| 4448 | ASC Licence Manager | |
| 4449 | ARCrypto IP | |
| 4450 | Camp | |
| 4451 | CTI System Msg | |
| 4452 | CTI Program Load | |
| 4453 | NSS Alert Manager | |
| 4454 | NSS Agent Manager | |
| 4500 | sae-urn | |
| 4501 | urn-x-cdchoice | |
| 4567 | tcp | File Nail | 
| 4590 | tcp | ICQTrojan | 
| 4672 | remote file access server | |
| 4711 | tcp | Olfactor | 
| 4950 | tcp | ICQTrojan; Icq Trojan | 
| 5000 | tcp | Bubbel; Back Door Setup; Blazer 5; Socket 23; Sockets de Troie | 
| 5001 | tcp | Back Door Setup; Sockets de Troie | 
| 5002 | radio free ethernet | |
| 5003 | Claris FileMaker Pro | |
| 5004 | avt-profile-1 | |
| 5005 | avt-profile-2 | |
| 5010 | TelepathStart | |
| 5011 | tcp | TelepathAttack, OOTLT | 
| 5020 | zenginkyo-1 | |
| 5021 | zenginkyo-2 | |
| 5031 | tcp | NetMetropolitan 1.0; NetMetropolitan 1.04 | 
| 5032 | tcp | NetMetropolitan 1.04 | 
| 5050 | multimedia conference control tool | |
| 5145 | ? | |
| 5150 | Ascend Tunnel Management Protocol | |
| 5190 | America-Online | |
| 5191 | AmericaOnline1 | |
| 5192 | AmericaOnline2 | |
| 5193 | AmericaOnline3 | |
| 5236 | ? | |
| 5300 | # HA cluster heartbeat | |
| 5301 | # HA cluster general services | |
| 5302 | # HA cluster configuration | |
| 5303 | # HA cluster probing | |
| 5304 | # HA Cluster Commands | |
| 5305 | # HA Cluster Test | |
| 5321 | tcp | Firehotcker | 
| 5333 | tcp | Backage Trojan Box 3 | 
| 5343 | tcp | WCrat | 
| 5400 | Excerpt Search | |
| 5400 | tcp | Blade Runner; Back Construction 1.2 | 
| 5401 | Excerpt Search Secure | |
| 5401 | tcp | Blade Runner 1.x; Back Construction | 
| 5402 | tcp | Blade Runner 2.x; Back Construction | 
| 5512 | tcp | Illusion Mailer | 
| 5521 | tcp | Illusion Mailer | 
| 5550 | tcp | Xtcp 2 | 
| 5550 | tcp | Xtcp 2 | 
| 5555 | Personal Agent | |
| 5555 | tcp | ServeMe | 
| 5556 | tcp | MTB (Backup) | 
| 5556 | tcp | BO Facil; H0rtiga | 
| 5557 | tcp | BO Facil | 
| 5569 | tcp | RoboHack | 
| 5598 | tcp | BackDoor 2.03 | 
| 5631 | tcp | PcANYWHERE Data | 
| 5632 | tcp | pcANYWHERE Status | 
| 5637 | tcp | PC Crasher | 
| 5638 | tcp | PC Crasher | 
| 5678 | Remote Replication Agent Connection | |
| 5679 | Direct Cable Connect Manager | |
| 5698 | tcp | BackDoor.203 | 
| 5713 | proshare conf audio | |
| 5714 | proshare conf video | |
| 5714 | tcp | WinCrash; WinCrash 3 | 
| 5715 | proshare conf data | |
| 5716 | proshare conf request | |
| 5717 | proshare conf notify | |
| 5729 | Openmail User Agent Layer | |
| 5741 | tcp | WinCrash; WinCrash 3 | 
| 5742 | tcp | Wincrash V1.03 | 
| 5745 | fcopy-server | |
| 5755 | OpenMail Desk Gateway server | |
| 5757 | OpenMail X.500 Directory Server | |
| 5766 | OpenMail NewMail Server | |
| 5767 | OpenMail Suer Agent Layer (Secure) | |
| 5800 | tcp | VNC over http (Virtual Network Computing server) | 
| 5881 | tcp | Y3K RAT | 
| 5882 | tcp | Y3K RAT | 
| 5888 | tcp | Y3K RAT | 
| 5889 | tcp | Y3K RAT | 
| 5900 | tcp | VNC (Virtual Network Computing server) | 
| 5991 | tcp | nuxsl - Network UniX Shell Logger www.nuxsl.org | 
| 6000 | 6000-6063 X Window System | |
| 6000 | tcp | The Thing; APStrojan | 
| 6006 | tcp | The Thing; APStrojan | 
| 6110 | HP SoftBench CM | |
| 6111 | HP SoftBench Sub-Process Control | |
| 6112 | dtspcd | |
| 6123 | Backup Express | |
| 6141 | Meta Corporation License Manager | |
| 6142 | Aspen Technology License Manager | |
| 6143 | Watershed License Manager | |
| 6144 | StatSci License Manager - 1 | |
| 6145 | StatSci License Manager - 2 | |
| 6146 | Lone Wolf Systems License Manager | |
| 6147 | Montage License Manager | |
| 6148 | Ricardo North America License Manager | |
| 6149 | tal-pod | |
| 6253 | CRIP | |
| 6272 | tcp | Secret Service | 
| 6389 | clariion-evr01 | |
| 6400 | tcp | The Thing; APStrojan | 
| 6455 | SKIP Certificate Receive | |
| 6456 | SKIP Certificate Send | |
| 6500 | tcp | Devil 1.03 | 
| 6558 | ? | |
| 6588 | AnalogX Web Proxy | |
| 6666 | tcp | TCPshell.c | 
| 6667 | tcp | Schedule Agent | 
| 6669 | tcp | Host Control; Vampyre 1.0 | 
| 6670 | Vocaltec Global Online Directory | |
| 6670 | tcp | DeepThroat; BackWeb Server; WinNuke eXtreame | 
| 6672 | vision_server | |
| 6673 | vision_elmd | |
| 6711 | tcp | BackDoor-G; SubSeven; Sub7 | 
| 6712 | tcp | BackDoor-G; SubSeven; Sub7(*); Funny Trojan | 
| 6713 | tcp | BackDoor-G; SubSeven; Sub7 | 
| 6723 | tcp | Mstream | 
| 6767 | tcp | NT Remote Control | 
| 6771 | tcp | DeepThroat | 
| 6776 | tcp | 2000 Cracks; BackDoor-G; SubSeven; Sub7(*) | 
| 6789 | tcp | Doly Trojan | 
| 6831 | ambit-lm | |
| 6838 | tcp | Mstream | 
| 6883 | tcp | DeltaSource | 
| 6912 | tcp | Shit Heep | 
| 6939 | tcp | Indoctrination; Gatecrasher.a | 
| 6969 | acmsoda | |
| 6969 | tcp | GateCrasher; IRC 3; NetController; Priority | 
| 6970 | tcp | GateCrasher | 
| 7000 | file server itself | |
| 7000 | tcp | BackDoor-G; SubSeven; Sub7*; Remote Grab; Kazimas | 
| 7001 | callbacks to cache managers | |
| 7001 | tcp | Freak88 | 
| 7002 | users & groups database | |
| 7003 | volume location database | |
| 7004 | AFS/Kerberos authentication service | |
| 7005 | volume managment server | |
| 7006 | error interpretation service | |
| 7007 | basic overseer process | |
| 7008 | server-to-server updater | |
| 7009 | remote cache manager service | |
| 7010 | onlinet uninterruptable power supplies | |
| 7099 | lazy-ptop | |
| 7100 | X Font Service | |
| 7121 | Virtual Prototypes License Manager | |
| 7174 | Clutild | |
| 7200 | FODMS FLIP | |
| 7201 | DLIP | |
| 7201 | tcp | NetMonitor | 
| 7215 | tcp | BackDoor-G; SubSeven; Sub7(*) | 
| 7300 | tcp | NetMonitor | 
| 7301 | tcp | NetMonitor | 
| 7306 | tcp | NetMonitor | 
| 7307 | tcp | NetMonitor | 
| 7308 | tcp | NetMonitor | 
| 7395 | winqedit | |
| 7424 | tcp | Host Control | 
| 7491 | telops-lmd | |
| 7511 | pafec-lm | |
| 7597 | tcp | Qaz | 
| 7609 | tcp | Snid X2 | 
| 7777 | cbt | |
| 7781 | accu-lmgr | |
| 7789 | tcp | Back Door Setup; ICQKiller | 
| 7983 | tcp | Mstream | 
| 7999 | iRDMI2 | |
| 8000 | tcp | Lexmark Printer tcp over http | 
| 8000 | iRDMI/Shoutcast Server | |
| 8010 | Wingate web logfile | |
| 8032 | ProEd | |
| 8080 | Standard HTTP Proxy | |
| 8080 | tcp | RingZero | 
| 8200 | tcp | GL-Trade | 
| 8450 | npmp | |
| 8787 | tcp | Back Orifice 2000; BO2K(*) | 
| 8888 | NewsEDGE server TCP (TCP 1) | |
| 8889 | Desktop Data TCP 1 | |
| 8890 | Desktop Data TCP 2 | |
| 8891 | Desktop Data TCP 3: NESS application | |
| 8892 | Desktop Data TCP 4: FARM product | |
| 8893 | Desktop Data TCP 5: NewsEDGE/Web application | |
| 8894 | Desktop Data TCP 6: COAL application | |
| 8897 | tcp | HackOffice Armageddon | 
| 8989 | tcp | Rcon | 
| 9000 | CSlistener | |
| 9000 | tcp | Netministrator | 
| 9100 | RAW (HP JetDirect Printer Server) | |
| 9325 | tcp | Mstream | 
| 9400 | tcp | InCommand | 
| 9494 | tcp | Tivoli | 
| 9535 | tcp | man (remote man server) | 
| 9536 | tcp | w | 
| 9537 | tcp | mantst (remote man server, testing) | 
| 9872 | tcp | Portal of Doom (PoD) | 
| 9873 | tcp | Portal of Doom (PoD) | 
| 9874 | tcp | Portal of Doom (PoD) | 
| 9875 | tcp | Portal of Doom (PoD) | 
| 9876 | Session Director | |
| 9876 | tcp | Cyber Attacker; Rux.Backdoor | 
| 9878 | tcp | TransScout | 
| 9989 | tcp | iNi-Killer | 
| 9992 | Palace | |
| 9993 | Palace | |
| 9994 | Palace | |
| 9995 | Palace | |
| 9996 | Palace | |
| 9997 | Palace | |
| 9998 | Distinct32 | |
| 9999 | distinct | |
| 9999 | tcp | The Prayer 1 | 
| 10000 | tcp | bnews | 
| 10000 | udp | rscs0 | 
| 10000 | Network Data Management Protocol | |
| 10001 | tcp | queue | 
| 10001 | udp | rscs1 | 
| 10002 | tcp | poker | 
| 10002 | udp | rscs2 | 
| 10003 | tcp | gateway | 
| 10003 | udp | rscs3 | 
| 10004 | tcp | remp | 
| 10004 | udp | rscs4 | 
| 10005 | udp | rscs5 | 
| 10006 | udp | rscs6 | 
| 10007 | udp | rscs7 | 
| 10008 | udp | rscs8 | 
| 10009 | udp | rscs9 | 
| 10010 | udp | rcsca | 
| 10011 | udp | rcscb | 
| 10012 | udp /tcp | qmaster | 
| 10067 | tcp | Portal of Doom (PoD) | 
| 10085 | tcp | Syphillis | 
| 10086 | tcp | Syphillis | 
| 10101 | tcp | BrainSpy | 
| 10167 | tcp | Portal of Doom (PoD) | 
| 10520 | tcp | Acid Shivers | 
| 10528 | tcp | Host Control | 
| 10607 | tcp | Coma | 
| 10666 | tcp | Ambush | 
| 11000 | SSTROJG trojan | |
| 11000 | tcp | Senna Spy; Senna Spy Trojans | 
| 11050 | tcp | Host Control | 
| 11051 | tcp | Host Control | 
| 11223 | tcp | Progenic Trojan; Secret Agent | 
| 12076 | tcp | GJamer; MSH.104b | 
| 12223 | tcp | Hack'99 KeyLogger | 
| 12345 | TrendMicroOfficeScan / Netbus backdoor | |
| 12345 | tcp | GabanBus; NetBus 1.x; NetBus 1.7(*); Pie Bill Gates; WhackJob; X-bill | 
| 12346 | tcp | GabanBus; NetBus 1.x; NetBus 1.7(*); X-bill | 
| 12349 | tcp | BioNet | 
| 12361 | tcp | Whack-a-mole | 
| 12362 | tcp | Whack-a-mole | 
| 12623 | tcp | DUN Control | 
| 12624 | tcp | Buttman | 
| 12631 | tcp | WhackJob; WhackJob.NB1.7 | 
| 12701 | tcp | Eclipse 2000 | 
| 12753 | tsaf port | |
| 12754 | tcp | Mstream | 
| 13000 | tcp | Senna Spy | 
| 13010 | tcp | Hacker Brazil | 
| 13223 | PowWow chat program | |
| 13700 | tcp | Kuang2 The Virus | 
| 14456 | tcp | Solero | 
| 14500 | tcp | PC Invader 0.7 | 
| 14501 | tcp | PC Invader 0.7 | 
| 14502 | tcp | PC Invader 0.7 | 
| 14503 | tcp | PC Invader 0.7 | 
| 15000 | tcp | NetDaemon 1.0 | 
| 15092 | tcp | Host Control | 
| 15104 | tcp | Mstream | 
| 16484 | tcp | Mosucker | 
| 16660 | tcp | Stacheldraht (DDoS) | 
| 16772 | tcp | ICQ Revenge | 
| 16969 | tcp | Priority | 
| 17007 | ? | |
| 17166 | tcp | Mosaic | 
| 17300 | tcp | Kuang2 The Virus | 
| 17490 | tcp | CrazyNet | 
| 17500 | tcp | CrazyNet | 
| 17569 | tcp | Infector 1.4.x + 1.6.x | 
| 17777 | tcp | Nephron | 
| 18000 | Beckman Instruments | |
| 18753 | tcp | Shaft (DDoS) | 
| 19864 | tcp | ICQ Revenge | 
| 20000 | tcp | Millennium II | 
| 20001 | Millenium trojan | |
| 20001 | tcp | Millennium | 
| 20002 | tcp | AcidkoR | 
| 20024 | Netbus 2.0 Pro | |
| 20034 | tcp | NetBus 2.0 Pro; NetRex; WhackJob | 
| 20203 | tcp | Chupacabra; Logged! | 
| 20331 | tcp | Bla | 
| 20432 | tcp | Shaft (DDoS) | 
| 21544 | tcp | GirlFriend | 
| 21554 | GirlFriend trojan | |
| 21554 | tcp | GirlFriend; Schwindler; Schwindler 1.82; WinSp00fer; Kidterror | 
| 21845 | webphone | |
| 21846 | NetSpeak Corp. Directory Services | |
| 21847 | NetSpeak Corp. Connection Services | |
| 21848 | NetSpeak Corp. Automatic Call Distribution | |
| 21849 | NetSpeak Corp. Credit Processing System | |
| 22222 | tcp | Prosiak | 
| 22273 | wnn6 | |
| 22347 | WIBU dongle server | |
| 22555 | Vocaltec Web Conference | |
| 22800 | Telerate Information Platform LAN | |
| 22951 | Telerate Information Platform WAN | |
| 23005 | tcp | Net Trash 1.0 | 
| 23023 | tcp | Logged | 
| 23432 | tcp | Asylum | 
| 23456 | Evil FTP trojan | |
| 23456 | tcp | Evil FTP; Ugly FTP; WhackJob | 
| 23476 | tcp | Donald Dick | 
| 23477 | tcp | Donald Dick | 
| 25000 | icl-twobase1 | |
| 25001 | icl-twobase2 | |
| 25002 | icl-twobase3 | |
| 25003 | icl-twobase4 | |
| 25004 | icl-twobase5 | |
| 25005 | icl-twobase6 | |
| 25006 | icl-twobase7 | |
| 25007 | icl-twobase8 | |
| 25008 | icl-twobase9 | |
| 25009 | icl-twobase10 | |
| 25793 | Vocaltec Address Server | |
| 25867 | WebCam32 Admin | |
| 26000 | quake | |
| 26208 | wnn6-ds | |
| 26274 | tcp | Delta Source | 
| 26681 | tcp | Spy Voice | 
| 27374 | tcp | BackDoor-G; SubSeven; Sub7(*) | 
| 27444 | tcp | Trin00 (DDoS) | 
| 27665 | tcp | Trin00 (DDoS) | 
| 28431 | tcp | Hack'a'Tack | 
| 28432 | tcp | Hack'a'Tack | 
| 29104 | tcp | Host Control | 
| 29891 | tcp | The Unexplained | 
| 30001 | tcp | Terr0r32 | 
| 30029 | tcp | AOL Trojan | 
| 30100 | tcp | NetSphere 1.27a; NetSphere 1.31 | 
| 30101 | tcp | NetSphere 1.27a; NetSphere 1.31 | 
| 30102 | tcp | NetSphere 1.27a; NetSphere 1.31 | 
| 30103 | tcp | NetSphere 1.31 | 
| 30133 | tcp | NetSphere Final | 
| 30303 | Sockets De Troie trojan | |
| 30303 | tcp | Sockets de Troie; Socket 23 | 
| 30947 | tcp | Intruse | 
| 30999 | tcp | Kuang2 | 
| 31335 | tcp | Trin00 (DDoS) | 
| 31336 | tcp | BOWhack; ButtFunnel | 
| 31337 | udp | Backorifice | 
| 31337 | udp | Backorifice | 
| 31337 | tcp | BackFire; Baron Night; Back Orifice, BackOrificeLM.LEENTech; BO client; BO2K(*); Bo Facil; Deep BO; | 
| 31338 | tcp | Back Orifice; ButtFunnel; DeepBO; NetSpy DK | 
| 31339 | tcp | NetSpy DK | 
| 31554 | tcp | Schwindler | 
| 31666 | tcp | BOWhack; BOWackmole | 
| 31778 | tcp | Hack'a'Tack | 
| 31785 | tcp | Hack'a'Tack | 
| 31787 | tcp | Hack'a'Tack | 
| 31788 | tcp | Hack'a'Tack | 
| 31789 | tcp | Hack'a'Tack | 
| 31790 | tcp | Hack'a'Tack | 
| 31791 | tcp | Hack'a'Tack | 
| 31792 | tcp | Hack'a'Tack | 
| 32100 | tcp | Peanut Brittle; Project nEXT | 
| 32418 | tcp | Acid Battery | 
| 33333 | tcp | Blakharaz; Prosiak | 
| 33577 | tcp | PsychWard | 
| 33777 | tcp | PsychWard | 
| 33911 | tcp | Trojan Spirit 2001a | 
| 34324 | tcp | BigGluck; TN; Tiny Telnet Server | 
| 34555 | tcp | Trin00 (Windows) (DDoS) | 
| 35555 | tcp | Trin00 (Windows) (DDoS) | 
| 37651 | tcp | YAT | 
| 40412 | tcp | The Spy | 
| 40421 | tcp | Agent 40421; Masters Paradise; Master Paradise .96 | 
| 40422 | tcp | Masters Paradise 1.x | 
| 40423 | tcp | Masters Paradise; Masters Paradise .97 | 
| 40425 | tcp | Masters Paradise | 
| 40426 | tcp | Masters Paradise 3.x | 
| 41666 | tcp | Remote Boot | 
| 43210 | tcp | Schoolbus 1.6 / 2.0 | 
| 44444 | tcp | Prosiak | 
| 47262 | tcp | Delta Source | 
| 47557 | Databeam Corporation | |
| 47806 | ALC Protocol | |
| 47808 | Building Automation and Control Networks | |
| 49301 | tcp | Online Keylogger | 
| 50505 | tcp | Sockets de Troie | 
| 50766 | tcp | Fore; Schwindler | 
| 51996 | tcp | CafeIni | 
| 53001 | tcp | Remote Windows Shutdown | 
| 53217 | tcp | Acid Battery 2000 | 
| 54283 | tcp | BackDoor-G; SubSeven; Sub7(*) | 
| 54320 | Back Orifice 2000 | |
| 54320 | tcp | Back Orifice 2000; BO2K(*) | 
| 54321 | tcp | Schoolbus .69-1.11 + 1.6 + 2.0; Back Orifice 2000; BO2K(*) | 
| 57341 | tcp | NetRaider | 
| 58339 | tcp | ButtFunnel | 
| 60000 | tcp | Deep Throat 2.0 / 3.0 | 
| 60068 | tcp | Xzip 6000068 | 
| 60411 | tcp | Connection | 
| 61348 | tcp | Bunker-Hill | 
| 61466 | tcp | Telecommando | 
| 61603 | tcp | Bunker-Hill | 
| 63485 | tcp | Bunker-Hill | 
| 65000 | Devil trojan | |
| 65000 | tcp | Devil Trojan 1.03; Stacheldraht (DDoS) | 
| 65301 | PcAnywhere | |
| 65432 | tcp | The Traitor | 
| 65535 | tcp | R |