> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/observer/which-ports-does-the-enginsight-observer-check-by-default.md). # Which ports does the Enginsight Observer check by default? The Observer is an Enginsight component that can be installed on systems at different locations to monitor endpoints externally. In Enginsight, endpoints are internal and external websites and domains. Monitoring also includes checking the endpoint for open ports. The following ports are checked by default by the Observer:

Port	Default protocol / service according to IANA	Transport protocol	Description
21	FTP (File Transfer Protocol)	TCP UDP	The File Transfer Protocol is used for file transfer and does not provide encryption in its standard version. If the transferred data requires protection, FTP should be replaced with the more secure variants SFTP or FTPS wherever possible.
22	SSH (Secure Shell)	TCP UDP	Secure Shell is a protocol for remote administration and data transfer. SSH version 2 is currently considered secure. For server authentication, an SSH key should be used instead of a password wherever possible.
23	Telnet	TCP	Telnet is a remote administration protocol similar to SSH. Due to its lack of security features, it should no longer be used.
25	SMTP (Simple Mail Transfer Protocol)	TCP	The Simple Mail Transfer Protocol is used for exchanging emails. When configured correctly and used with encryption, the protocol is considered secure. This port should only be used for SMTP relays, meaning communication between two mail servers. Data is transmitted in plain text.
53	DNS (Domain Name System)	TCP UDP	The Domain Name System protocol is used for resolving IP addresses to domain names. The DNS port on the server is considered secure. However, the protocol itself can be attacked, for example through DNS spoofing.
80	HTTP (Hypertext Transfer Protocol)	TCP	The Hypertext Transfer Protocol is mostly used for communication with web applications. Because it does not use encryption, switching to HTTPS should be considered.
106	3Com-TSMUX	N/A	3Com-TSMUX is an outdated network protocol that was used by the former hardware manufacturer 3Com to multiplex different data streams over a single channel. Due to its lack of security features, it should no longer be used.
110	POP3 (Post Office Protocol 3)	TCP	Post Office Protocol version 3 is used for exchanging emails. When configured correctly and used with encryption, the protocol is considered secure. This port should only be open on mail servers. Encryption on this port can be provided via STARTTLS.
111	SunRPC (Sun Remote Procedure Call)	TCP UDP	The SunRPC interface, also known as Open Network Computing Remote Procedure Call, acts as a port mapper for executing functions on a remote system. It can be used by various programs, the best known being the Network File System (NFS). Port mapper services that are openly accessible from the internet can be misused for DDoS reflection attacks against third-party IT systems. Access to this port should therefore only be possible within the internal network.
123	NTP (Network Time Protocol)	UDP	The Network Time Protocol is used to synchronize the time of hosts. Attack vectors exist for this protocol if no encryption is used. Setting up encryption in classic NTP is relatively complex, which is why an improved version, Network Time Security (NTS), was introduced.
135	EPMAP (Microsoft Endpoint Mapper)	TCP UDP	Microsoft Endpoint Mapper is a service for Microsoft Windows and is comparable to SunRPC. It is used by various Windows services. Access to this port should only be possible within the internal network.
137	NetBIOS-NS (NetBIOS Name Service)	TCP UDP	The NetBIOS Name Service is used to resolve NetBIOS names to IP addresses. It is now considered outdated and has largely been replaced by DNS. A NetBIOS name service that is reachable from the internet can be misused for DDoS reflection attacks against third-party IT systems. It also poses a risk to IT systems, as attackers may be able to exploit this weakness to gather information about the system or network in preparation for further attacks.
138	NetBIOS-DGM (NetBIOS Datagram Distribution Service)	TCP UDP	The NetBIOS Datagram Service is used for communication between endpoints via unicast or broadcast. By using forged packets, Windows operating systems can be tricked into treating an attacker as part of the local network, bypassing the security distinction between local and internet hosts. The NetBIOS Datagram Service should therefore not be reachable from the internet.
139	NetBIOS-SSN (NetBIOS Session Service)	TCP UDP	The NetBIOS Session Service allows two hosts to exchange data in a session mode. Due to security issues, NetBIOS should not be reachable from the internet.
143	IMAP (Internet Message Access Protocol)	TCP UDP	The Internet Message Access Protocol is used to access and manage email mailboxes. It allows login credentials to be transmitted in plain text and does not provide encryption by default. Encryption can be provided via IMAPS on port 993. Due to security risks, IMAP should not be used on the unencrypted port 143.
161	SNMP (Simple Network Management Protocol)	TCP UDP	The Simple Network Management Protocol is used to monitor and manage network devices. When SNMP version 1 or 2 is used, no encryption is provided. SNMP v3 should be used instead. An SNMP port that is freely accessible from the internet can be used by attackers to collect information about the target system. SNMP should therefore only be accessible within the internal network and with appropriate security measures in place.
389	LDAP (Lightweight Directory Access Protocol)	TCP UDP	The Lightweight Directory Access Protocol is a directory access protocol used to manage users, computers and addresses. It is used, among other things, by Microsoft's Active Directory service. On port 389, the connection is either unsecured or protected via STARTTLS. LDAPS is available on port 636 and uses TLS for connection security. LDAP should therefore only be used with encryption.
443	HTTPS (Hypertext Transfer Protocol Secure)	TCP	Unlike HTTP, HTTPS uses transport encryption to enable secure communication. For web servers that are reachable from the internet, HTTPS should therefore be used whenever possible.
445	Microsoft DS (Microsoft Directory Service)	TCP	The Microsoft Directory Services service is used by Windows systems for connections to Active Directory, Windows shares and SMB shares. Several known vulnerabilities exist for this port, including WannaCry (2017). It should only be open within the LAN and should not be reachable from the internet.
465	URD (URL Rendezvous Directory for SSM) SMTPS (Simple Mail Transfer Protocol Secure)	TCP	Port 465 can be used by several different programs, including URL Rendezvous Directory for SSM or Simple Mail Transfer Protocol Secure (also SMTP over TLS). Depending on the application, securing it with firewall rules and TLS can be useful.
587	Mail Submission Agent	TCP	Port 587 is the default port for transmitting emails from a client to the server and is usually referred to as the outgoing mail server. STARTTLS is supported, so this protocol should be used for encrypted transmission.
993	IMAPS (Internet Message Access Protocol Secure)	TCP	The Internet Message Access Protocol Secure, also known as IMAP over TLS, is used for secure access to and management of email mailboxes. On port 993, traffic is encrypted with SSL/TLS as soon as the connection is established.
995	POP3S (Post Office Protocol 3 Secure)	TCP	Post Office Protocol 3 Secure, also known as POP3 over TLS, provides encrypted email transmission. Encryption is enforced on port 995.
1433	MS-SQL-S (Microsoft SQL Server)	TCP	Port 1433 is used as the default port for communication with the Microsoft SQL relational database management system. It should not be reachable from the internet. Encryption via TLS is possible and should be enabled.
1512	WINS (Windows Internet Name Service)	TCP UDP	Windows Internet Naming Service is a Microsoft network service that maps NetBIOS computer names to IP addresses to simplify communication in local Windows networks. WINS is considered outdated, and using the standard DNS protocol for name mappings is recommended instead.
1723	PPTP (Point-to-Point Tunneling Protocol)	TCP UDP	The Point-to-Point Tunneling Protocol is based on the Internet Protocol and is used to establish VPN tunnels. It has been considered insecure since 2012 and should therefore no longer be used.
2222	EtherNet/IP	N/A	EtherNet/IP is an industrial network protocol used in automation technology. It transports the Common Industrial Protocol (CIP) over standard Ethernet to enable data exchange between automation devices from Operational Technology (OT) and IT. This is a soft real-time system. It should be secured with TLS.
2483	TTC (Oracle Transparent Network Computing)	TCP UDP	Oracle Transparent Network Computing is used by the Oracle Database Listener service. No TLS encryption is used. Port 2483 replaces port 1521. Access to this port from the internet should not be possible.
2484	TTC-SSL (Oracle Transparent Network Computing Secure Sockets Layer)	TCP UDP	Oracle Transparent Network Computing Secure Sockets Layer is used by the Oracle Database Listener service. Traffic is encrypted via SSL. Access to port 2484 from the internet should not be possible.
3306	MySQL	TCP UDP	Port 3306 is used for connections to a MySQL or MariaDB database. Access to this port should be restricted. This can be done, among other things, by using firewall rules that limit access to the required IP addresses. Restricting remote login for the root user should also be considered.
3389	MS-WBT-Server (Microsoft Windows-Based Terminal Server)	TCP UDP	Microsoft Windows-Based Terminal Server provides a connection to a Windows Terminal Server via the Remote Desktop Protocol (RDP). Port 3389 should not be reachable from the internet. Within the LAN, it may be useful to restrict access to specific IP addresses using firewall rules. In general, TLS encryption should be used for the RDP protocol on the terminal server.
4369	EPMD (Erlang Port Mapper Daemon)	N/A	Port 4369 is used by the Erlang Port Mapper Daemon. It manages the mapping of names to addresses.
5432	PostgreSQL	TCP UDP	Port 5432 is used for communication with the PostgreSQL relational database management system. The database should not be reachable from the internet. In addition, access should only be possible from specific IP addresses. Encryption via TLS is possible and should be enabled.
5666	NRPE (Nagios Remote Plugin Executor)	TCP	Port 5666 is used by the Nagios Remote Plugin Executor. This is an extension for the Nagios network monitoring software that executes Nagios/Icinga plugins on a Linux system. Connections to port 5666 should only be made by the Nagios server and enforced with a firewall rule.
5672	AMQP (Advanced Message Queuing Protocol)	TCP	The Advanced Message Queuing Protocol is used for asynchronous communication between sender and receiver. It uses a message broker and queues on the sender side. It is commonly used for reliable and fast transmission of large numbers of data packets. Transmission should be secured with TLS. Firewall rules can be added for further protection.
5984	CouchDB	TCP UDP	Port 5984 is used for communication with the Apache CouchDB NoSQL document database. The database should not be reachable from the internet. In addition, access should only be possible from specific IP addresses. Encryption via TLS is possible and should be enabled.
6379	Redis (REmote DIctionary Service)	TCP	Port 6379 is usually used for the Redis in-memory database. Redis is frequently used for caching other databases. If a Redis server is openly accessible from the internet without SASL authentication, an attacker may be able to read, modify or delete data. This can expose sensitive information. The server should therefore not be openly reachable from the internet. It is also useful to set firewall rules or adjust the Redis configuration to limit access to the server. TLS can be used to secure the transport path.
8080	HTTP-old, among others	TCP UDP	Port 8080 can be used by several applications, including as an alternative HTTP port (HTTP-old), for proxy servers, Apache Tomcat and Atlassian JIRA. Depending on the application, securing it with firewall rules and TLS can be useful.
8443	PCsync-HTTPS, among others	TCP UDP	Port 8443 can be used by several applications, including PCsync HTTPS, Apache Tomcat SSL or Apple iCal. Depending on the application, securing it with firewall rules and TLS can be useful.
8983	Apache Solr	TCP	Port 8983 is used for communication with the Apache Solr enterprise search platform. Access should only be possible from known, trusted IP addresses. Encrypting traffic with TLS is recommended.
27017	MongoDB	TCP	Port 27017 is used for communication with the document-oriented NoSQL database MongoDB, which is most commonly used for web applications. The MongoDB server should not be reachable from the internet. In addition, access to the server within the LAN should be secured using firewall rules.

***