Every Computer Has 65,535 Ports. Here Is Why Three of Them Cause Most of the Security Problems.
Every device connected to the internet has 65,535 TCP ports and 65,535 UDP ports. Most are closed most of the time. The security implications of which ones are open are significant enough that automated scanners probe the entire internet looking for open ports continuously, around the clock, at industrial scale. They are looking for specific ports, and they find them constantly.
A port is a logical endpoint that allows a computer to run multiple network services simultaneously and route incoming traffic to the correct one. Port 80 handles HTTP traffic. Port 443 handles HTTPS. Port 22 handles SSH. Port 25 handles outgoing email. Port 3389 handles Remote Desktop Protocol. Each service listens on a designated port so that a connection to a server reaches the right service rather than an unintended one.
The number 65,535 is not arbitrary. It comes from the TCP and UDP header format, which allocates 16 bits for the port number field. Two to the power of 16 is 65,536 possible values, and ports are numbered starting from 0, giving the range 0 through 65,535. Below 1,024 are the well-known ports, reserved by convention for standard services and requiring elevated privileges to bind on Unix systems. Ports 1,024 through 49,151 are registered ports assigned by the Internet Assigned Numbers Authority. Ports 49,152 and above are ephemeral ports, used temporarily by operating systems for outbound connections.
Where Port Numbers Come From
The idea of numbered endpoints for network services dates to the early ARPANET era. RFC 322, published in 1972, discussed the need for well-known socket numbers so that programs could establish connections to standard services without negotiating which endpoint to use. The current framework, formalized in RFC 1340 in 1992 and maintained by IANA since, assigns port numbers to services through a registration process.
The famous well-known port assignments reflect the history of the internet more than its current usage. Port 23, Telnet, was the dominant remote login protocol before SSH existed. Port 21, FTP, was the standard file transfer mechanism before HTTPS made web-based transfers feasible. Port 25, SMTP, has been the email transfer port since 1982 and remains so, though ISPs routinely block inbound port 25 on residential connections to prevent home computers from being used as spam relays.
The permanent versus registered distinction matters operationally. A service running on a well-known port below 1,024 on a Linux or Unix system requires root or administrator access to start. A service on a port above 1,024 does not. This is why development web servers commonly listen on port 8080 or 3000 rather than port 80: any user account can bind those ports, making them convenient for testing without elevated permissions.
The RDP Problem: 3.5 Million Exposed Systems
Remote Desktop Protocol allows a user to control a Windows computer remotely. Microsoft introduced RDP with Windows NT 4.0 Terminal Server Edition in 1998. It operates on port 3389 by default and provides a full graphical interface to the remote system.
RDP was designed for use within trusted local networks, behind firewalls, with additional authentication layers. Internet-facing RDP is a direct interface to the Windows login prompt, accessible from anywhere in the world. When remote work expanded rapidly beginning in 2020, the number of internet-exposed RDP servers increased substantially. Security firm Shodan, which continuously indexes internet-connected devices, tracked over 3.5 million systems worldwide with RDP port 3389 accessible from the public internet.
The attack pattern against exposed RDP is straightforward and highly automated. Scanners find open port 3389. Credential-stuffing tools run against the login using lists of commonly used passwords and credentials from previous data breaches. If authentication succeeds, the attacker has full desktop control. Multiple cybersecurity incident response firms, including Coveware and Unit 42, have identified internet-facing RDP as the single most common initial access vector for ransomware attacks on businesses, accounting for roughly 50 percent of ransomware entry points in some reporting periods.
Mitigation is not technically complex: close port 3389 at the perimeter firewall, require VPN access before RDP is reachable, enable Network Level Authentication, and enforce account lockout after failed login attempts. The problem is that each of these controls requires deliberate configuration. The default is an open port and no lockout, which is what attackers find.
SSH on Port 22: Secure Protocol, Insecure Defaults
SSH, the Secure Shell protocol, was created by Tatu Ylonen in 1995 after a password-sniffing attack on his university network. It replaced Telnet and rlogin by encrypting the session, making eavesdropping ineffective. SSH is cryptographically sound. Its exposure as an attack surface comes from configuration choices, not from flaws in the protocol.
More than 20 million systems worldwide expose port 22 to the internet, according to recurring Shodan surveys. When SSH is configured with password authentication enabled and no rate limiting on login attempts, automated tools can attempt thousands of credential combinations per hour. Common usernames such as "admin," "root," "ubuntu," and "pi" combined with common passwords give attackers enough of an attack surface to succeed regularly against poorly configured systems.
Key-based authentication eliminates the credential-guessing problem entirely by replacing the password with a cryptographic key pair. A private key that never leaves the user's control cannot be guessed. Disabling root login forces attackers to know a valid username before attempting authentication. Moving SSH to a non-default port, such as 2222 or 2200, does not improve security in any fundamental sense since port scanners find it regardless, but it dramatically reduces the volume of automated login attempts because most scanners only probe port 22 by default.
The Filtered Port: What Firewalls Do
When a port scanner attempts to connect to a port, it receives one of three responses. An open port has a service listening and returns a SYN-ACK to the TCP handshake. A closed port has no service but still responds with a RST, a reset, telling the scanner that the port exists but nothing is listening. A filtered port returns nothing, typically because a firewall is silently dropping the packets.
The distinction between closed and filtered matters for security assessment. A closed port is informative: it tells scanners which ports exist on the host, and it reveals the host is responding. A filtered port reveals much less. Stateful firewalls that drop packets without responding are harder to fingerprint than those that return RSTs. Tools like Nmap, the network mapper created by Gordon Lyon and released in 1997, use the pattern of open, closed, and filtered responses to map service availability and infer operating system versions from the TCP/IP stack behavior.
For defensive purposes, filtering is generally preferable to simply having a closed port. A firewall rule that drops packets to port 3389 is stronger than having no RDP service running but leaving the port unfiltered, because the filtered response gives attackers less information about the host's configuration.
Practical Uses of Port Checking
A port checker tests the current status of a specific port on a specific host from an external perspective, showing what the public internet can reach. This differs meaningfully from checking from inside the same network, where local firewall rules that do not apply to external traffic may make a port appear open or closed differently than it actually is to external connections.
Conclusion
Before deploying a new server, checking which ports respond confirms that only intended services are reachable and that firewall rules took effect. After a configuration change that was supposed to close a port, checking from outside verifies the change worked as expected. When troubleshooting a service that clients cannot reach, checking whether the port is open, closed, or filtered from the client's perspective identifies whether the problem is the service itself, the firewall, or the network path between them.
For database servers, mail servers, and internal APIs, the expected result is that every port other than those explicitly required is filtered. A database server returning an open status on port 3306, MySQL's default, or port 5432, PostgreSQL's default, from the public internet is a significant misconfiguration in almost all circumstances. These services are designed to be accessed by applications on the same network or through encrypted tunnels, not from the open internet.
Frequently Asked Questions
What does it mean when a port is open?
An open port means a service is actively listening for connections on that port. Anything on the internet can attempt to connect to it. Whether this is a security risk depends on whether the service is intended to be publicly accessible.
Which ports should be closed on a home router?
RDP (3389), Telnet (23), and FTP (21) should generally not be open to the internet. If you do not need remote desktop or file transfer access from outside your network, these ports should be blocked in your router's firewall settings.
What is the difference between open, closed, and filtered ports?
An open port has a service listening and actively accepts connections. A closed port has no service listening but responds to connection attempts. A filtered port does not respond at all, often because a firewall is blocking the connection.
Can I use a port checker to test my own server?
Yes. A port checker tests from an external perspective, showing what the internet can see, which is more relevant for security than testing from inside your own network. It bypasses local firewall rules that would not apply to external traffic.