AOL TCP 5190 #AOL Instant Messanger AP-Defender TCP 2626 #Defender Authentication Service BackDoor-Setup TCP 5000 #Use by Boinet Lite, Blazer 5, Bubbel Trojans Backage TCP 411 #Backage Trojan BackDoor-G TCP 1243 #Also used by Subseven, Tiles Trojans Citrix-ICA TCP 1494 #ICA Gerneral Service Connect-BackDoor TCP 4000 #Also used by SkyDance Trojan CrackDown TCP 4444 #Crackdown Trojan DaCryptic TCP 1074 #DaCryptic Trojan DameWare TCP 6129 #DameWare Mini Remote Control Protocol DayTime TCP 13 UDP 13 #DayTime Server Protocol DerSphere TCP 1000 #Also used by Insane Network Trojans DerSphere-II TCP 2000 #Also used by SennaSpy Trojan Generator Direct-Connect TCP 411-412 #Direct Connect P2P Application Discard TCP 9 #Discard Server Protocol DNS TCP 53 UDP 53 #Domain Name Service Echo TCP 7 #Echo Protocol eDonkey-4661 TCP 4661 #eDonkey Protocol eDonkey-4662 TCP 4662 #eDonkey Protocol nTrust-Admin TCP 710 #nTrust CA Administration Service nTrust-Key-Mgmt TCP 709 #nTrust Key Management Service ERP-1 TCP 12345-12349 #ERP Service Exec TCP 512 #Remote Execution Finger TCP 79 #UNIX Finger Protocol Freak2K TCP 7001 #Also used by Freak88, NetSnooper Gold Trojans FTP TCP 21 #File Transfer Protocol GateCrasher TCP 6970 #GateCrasher Trojan GNUtella-RTR TCP 6347 UDP 6347 #Also used by BearShare, ToadNode, LimeWire GNUtella TCP 6346 UDP 6346 #Also used by BearShare, ToadNode, LimeWire Gopher TCP 70 #Internet Gopher Protocol GoToMyPC TCP 8200 #GotoMy PC H323 TCP 1720 #Video Conference Transmission over IP HackaTACK-31785 TCP 31785 #HackAttack HackaTACK-31787 TCP 31787 #HackAttack HackaTACK-31788 TCP 31788 #HackAttack HackaTACK-31790 TCP 31790 #HackAttack HackaTACK-31792 TCP 31792 #HackAttack HotLine-Client TCP 5500-5503 #HotLine Client Connection HTTP TCP 80 #Hyper-Text Transfer Protocol HTTPS TCP 443 #TLS/SSL ICKiller TCP 1027 #ICKiller IDENT TCP 113 #Identify RCS Keyword String in Files IKE TCP 500 UDP 500 #IPSec Internet Key Exchange IMAP TCP 143 #Interactive Mail Protocol iMesh TCP 5000 #Also used by many Trojans and UPNP Service InCommand TCP 1029 #Also used by ICQ Nuke 98 Trojan IPSO-CMP TCP 1111 #IPSO Clustering Management Protocol IRC-1 TCP 6660-6670 #Internet Relay Chat IRC-2 TCP 7000 #Internet Relay Chat Jade TCP 1024 #Also used by Latinus, NetSPY, Rat Trojans Kaos TCP 1212 #Kaos Trojan KazzaA TCP 1214 #Fast Track P2P Protocol Kerberos-v5 TCP 88 UDP 88 #Kerberos Authentication Version 5 Kerberos TCP 750 UDP 750 #Kerberos Authentication Kuang2 TCP 17300 #Kuang2 Trojan LDAP TCP 389 #Lightweight Directory Access Protocol LDAP-SSL TCP 636 #Lightweight Directory Access Protocol over TLS/SSL Rlogin TCP 513 #Rlogin iNotes TCP 1352 #Lotus iNotes Web Access Protocol lpdw0rm TCP 515 #Used by Ramen Trojans and Printer Service Madster TCP 5025 #Formally called Aimster ####Microsoft-TS TCP 445 #Microsoft CIFS's over TCP Mneah TCP 4666 #The Mneah Trojan MSN-File Transfer TCP 6891-6900 #MSN File Tranfer MSN-Messenger TCP 1863 #MSN Instant Messenger MSSQL-Mon TCP 1434 #MSSQL Monitor MSSQL TCP 1433 #MSSQL Server mysql TCP 3306 #MySQL Server MultiDropper TCP 1035 #MultiDropper Trojan Napster-Client TCP 6600-6699 #Napster Client also used by WinMX Napster-Dir4 TCP 4444 #Napster Directory Connections Napster-Dir5 TCP 5555 #Napster Directory Connections Napster-Dir6 TCP 6666 #Napster Directory Connections Napster-Dir7 TCP 7777 #Napster Directory Connections Napster-Dir8 TCP 8888 #Napster Directory Connections Napster-Redirector TCP 8875 #Napster Redirector NBSession TCP 139 #NetBios Session Service NCP TCP 524 #Novell Netware Core Protocol NetShow TCP 1755 #Microsoft NetShow-Windows Media Player NetSTAT TCP 15 #UNIX NetSTAT Protocol NFSD TCP 2049 UDP 2049 #Network File System Deamon NNTP TCP 119 #Network News Tranfer Protocol NTP TCP 123 UDP 123 #Network Time Protocol OAS-NameServer TCP 2649 #Oracle Application Server OAS-ORB TCP 2651 #Oracle Application Server OpenWindows TCP 2000 #Open Windows ####Orbix-1570 TCP 1570 #IONA Orbix Deamon ####Orbix-1571 TCP 1571 #IONA Orbix Deamon PcAnywhere-Date TCP 5631 #pcAnywhere PcTele-FileSync TCP 2299 #Symantec PcTelecommute File Syncronization POP2 TCP 109 #Post Office Protocol Verion 2 POP3 TCP 110 #Post Office Protocol Verion 3 667-Trojans TCP 667 #Misc Trojans PPTP TCP 1723 #Point 2 Point Tunnelling Protocol Quake TCP 26000 UDP 26000 #Quake RainWall Command TCP 6374 #RainWall High Avaiablility Deamon RAT TCP 1097-1098 #Remote Administration Tool Trojan ####Real-Audio TCP 7070 #Real Audio Remote-Strom TCP 1025 #Used by Fraggle Rock, NetSPY and MD5 BackDoor Trojans ####RTSP TCP 554 #RealTime Streaming Protocol Secure-ID-Prop TCP 5510 #Token based Authentication Service ShadyShell TCP 1337 #ShadyShell Trojan ####RSH TCP 514 #Remote Shell SMTP TCP 25 #Simple Mail Tranfer Protocol Sockets-DES TCP 1 #Also used by the TCP MUX Service SQLNET-1 TCP 1521 #Oracle SQL Net Verison 1 Service SQLNET-2-1521 TCP 1521 #Part of Oracle SQLNet Verison 2 Service SQLNET-2-1525 TCP 1525 #Part of Oracle SQLNet Verison 2 Service SQLNET-2-1526 TCP 1526 #Part of Oracle SQLNet Verison 2 Service SSH TCP 22 #Secure Shell ####SSH2 TCP 22 #Secure Shell Version 2 also blocks version 1 Safe-T-Net TCP 32557 #Safe-T-Net Configuration Squid TCP 3128 #Squid Proxy StoneBeat-Control TCP 3002 #StoneBeat Control StoneBeat-Deamon TCP 3001 #StoneBeat Deamon HeartBeat SubSeven TCP 27374 #Also used by BadBlood, EGO, Lion and WebHead Trojans T120 TCP 1503 #H323 Application Sharing Protocol TACACS+ TCP 49 #Terminal Access Control Access Control System Term-Serv TCP 3389 #Terminal Server High-Ports TCP 1024-65535 #TCP High Ports Telnet TCP 23 #Telnet Protocol TerrorTrojan TCP 3456 #Terror Trojan TheFLU TCP 5534 #The FLU Trojan Time TCP 37 #Time Server Protocol TransScout TCP 2004-2005 #TransScout Trojan Trinoo TCP 1524 #Trinoo Trojan UltorsTrojan TCP 1234 #Also used by SubSeven Java Client UUCP TCP 540 #Unix 2 Unix Copy Program WAIS TCP 210 #Wide Area Information Servers ####Winframe TCP 1494 #Winframe X11 TCP 6000-6063 #XWindows System Yahoo-Messenger TCP 5050 #Yahoo Messenger Yahoo-Voice TCP 5000-5001 #Yahoo Voice Yahoo-WebCam TCP 5100 #Yahoo WebCam Webmin TCP 10000 Usermin TCP 20000 Archie UDP 1525 #Archie Internet Protocol Biff UDP 512 #Give notice of incoming mail messages Blubster UDP 41170 #Uses Manolito Protocol P2P Bootp UDP 67 #Bootstrap Protocol Server Citrix-ICABrowse UDP 1640 #Citrix ICA Browsing CU-SeeMe UDP 7648-7652 #Video Conferencing DHCP-Reply UDP 68 #DHCP Reply DHCP-Request UDP 67 #DHCP Request DirectConnect UDP 411-412 #DirectConnect P2p Application Discard UDP 9 #Discard Server Protocol Echo UDP 7 #Echo eDonkey-4665 UDP 4665 #eDonkey FreeTel-out UDP 21300 #RealTime Full Duplex Voice Communication H323-RAS UDP 1719 #RAS and Associated connection H323 H323-RASOnly UDP 1719 #Endpoint to Gatekeeper communications HackaTack-31789 UDP 31789 #HackaTack Trojan HackaTack-31791 UDP 31791 #HackaTack Trojan HotLine-Tracker UDP 5499 #HotLine Tracker Connections ICQ-Locator UDP 4000 #Mirabilis ICQ Version Interphone UDP 22555 #VocalTec Internet Phone L2TP UDP 1701 #Layer 2 Tunnelling Protocol Microsoft-DS UDP 445 #CIFS over UDP MSN-1863 UDP 1863 #MSN MSN-1590 UDP 5190 #MSN MSN-Voice UDP 6901 #MSN Voice MSSQL-MON UDP 1434 #MSSQL Monitor MSSQL-Server UDP 1433 #MSSQL Server Name UDP 42 #HostName Server NBDatagram UDP 138 #NetBIOS Datagram Service NBName UDP 137 #NetBIOS Name Service RADIUS-2 UDP 1812 #Remote Authentication Dial-In User Service V2 NoBackO UDP 1201 #NoBackO Trojan OnTime UDP 1622 #OnTime PcAnywhere UDP 5632 #PcAnywhere RADIUS UDP 1645 #Remote Authentication Dial-In User Service RainWall-Deamon UDP 6372 #RainWall Deamon RailWall-Status UDP 6374 #RainWall Remote Management Status RainWall-Stop UDP 6373 #RainWall Monitoring RexxRave UDP 1104 #RexxRave Trojan RIP UDP 520 #Routing Information Protocol SecureID UDP 5500 #Token Based Authentication SIP UDP 5060 #Shared Whiteboard and Instant Messenger Apps SNMP UDP 161 #Simple Network Management Protocol SNMP-Trap UDP 162 #SNMP Trap SteamWorks UDP 1558 #Steamworks SWTP-SMS UDP 9282 #Software Management Server Syslog UDP 514 #UNIX Syslog Protocol TACACS UDP 49 #Terminal Access Control Access Control System TFTP UDP 69 #Trivial File Transfer Protocol TIME UDP 37 #Time Server Protocol High-Ports UDP 1024-65535 #High Ports Vosaic-Data UDP 20000-20030 #Vosaic Data Who UDP 513 #UNIX Who Protocol WinMX UDP 6257 #Also uses Napster Ports Yahoo V-Chat UDP 5000-5010 #Yahoo Voice Chat Dest-Unreach ICMP 3 #ICMP Destination Unreachable Echo-Reply ICMP 0 #ICMP Echo-Reply Echo-Request ICMP 8 #ICMP Echo-Request Info-Reply ICMP 16 #ICMP Info Reply Info-Request ICMP 15 #ICMP Info Request Mask-Reply ICMP 18 #ICMP Mask Reply Mask-Request ICMP 17 #ICMP Mask Request Param-Prblm ICMP 12 #ICMP Parameter Problem Redirect ICMP 5 #ICMP Route Redirect Source-Quench ICMP 4 #ICMP Source Quench Time-exceeded ICMP 11 #ICMP Time to Live Exceeded TimeStamp ICMP 13 #ICMP Time Stamp TimeStamp-Reply ICMP 14 #ICMP TimeStamp Reply AH IP 51 #IPSec Authentication Header Protocol BackWeb IP 17 #Push Web Application Directly to Desktops EGP IP 8 #Exterior Gateway Protocol ESP IP 50 #IPsec Encapsulation Security Paylod Protocol WEB_Mapped IP 6 #HTTP and FTP Port Mapping Service IGMP IP 2 #Internet Group Management Protocol IGRP IP 9 #Cisco Interior Gateway Routing Protocol MSSQL_Resolver IP 17 #Block MSSQL Sapphire/Slammer Worms OSPF IP 89 #Open Shortest Path First RIP-Response IP 17 #RIP Routing Response SMTP_Mapped IP 6 #SMTP Port Mapping Service SSH_V2 IP 6 #SSH Version 2 TraceRoute IP 17 #Unix TraceRoute VRRP IP 112 #Virtual Router Redundancy Protocol GRE IP 47