# Common Internet-Facing Ports Explained

> Understand common public TCP and UDP ports and when exposure deserves review.

Canonical: https://sentryxmonitor.com/learn/networking/internet-facing-ports/
Last updated: 2026-08-08

Networking and protocol operations

Common internet-facing ports identify the protocol a service is expected to use, but the port number alone does not prove what software is running or whether exposure is safe.

Reviewed 2026-08-08 Read-only educational guidance

## Key points

- 80 and 443 commonly serve web traffic.

- 22, 3389, and database ports deserve strict exposure review.

- Protocol detection should confirm assumptions.

## How does it work?

Clients address services using an IP address and port. Standard assignments make interoperability easier, while applications can also run on non-standard ports.

## What can go wrong?

Unexpected administrative, database, or development ports increase attack opportunities. Closing a port without owner context can also break a legitimate service.

## How can teams detect the problem?

Compare externally reachable ports with approved architecture and use safe protocol handshakes to identify likely service types.

## How can teams fix or reduce the problem?

Minimize public exposure, restrict administrative protocols, document exceptions, and monitor the ports that must remain reachable.

## What does a technical example look like?

```
22 SSH | 25 SMTP | 53 DNS | 80 HTTP | 443 HTTPS | 3389 RDP | 5432 PostgreSQL | 6379 Redis
```

The example uses reserved documentation domains and addresses. Apply the same reasoning to systems you own or are authorized to assess.

## How does continuous monitoring help?

A point-in-time check explains the observed state now. [Continuous monitoring](https://sentryxmonitor.com/services/uptime-monitoring/) establishes an expected baseline, repeats the relevant check, and records meaningful state changes so an owner can investigate before a small configuration drift becomes a prolonged security or availability problem. See [Networking](https://sentryxmonitor.com/learn/networking/) for the surrounding technical context.

## Where does Sentryx Monitor fit?

Sentryx Monitor provides [read-only outside-in discovery](https://sentryxmonitor.com/services/external-attack-surface-monitoring/) and monitoring for public hosts, DNS, HTTPS, TLS certificates, baseline security headers, email-security records, and selected network services. It supports evidence and operational follow-up, but it does not replace authorized penetration testing, authenticated vulnerability assessment, or owner validation.

## Continue learning

- [Internet Networking for Security and Monitoring](https://sentryxmonitor.com/learn/networking/) - The parent networking guide.

- [What Is TCP Port Monitoring?](https://sentryxmonitor.com/learn/networking/tcp-port-monitoring/) - Learn how TCP port monitoring checks service reachability and where it differs from application monitoring.

- [What Does Port 443 Do?](https://sentryxmonitor.com/learn/networking/port-443/) - Understand how port 443 carries HTTPS traffic and how DNS, TCP, TLS, and HTTP participate.

- [What Does Port 80 Do?](https://sentryxmonitor.com/learn/networking/port-80/) - Understand port 80, HTTP redirects, and why public websites still monitor cleartext HTTP.

## Related
- [Home](https://sentryxmonitor.com/)