Anything on any of the following ports:
- 53
- 21
- 25 (when it's not a mail server)
- 80/443/8080/8443 (when it's not a webserver)
- 3389 (when connections are neither internal, nor coming/going to a Windows machine)
- 137, 138, 139 (when they're not Windows machines)
- 23
- 69 (that's not internal)
- 109, 110, 220, 585, 993, 995
- 123 (that's not internal)
- 389 (that's not internal)
- 445 (that's not internal)
- 1521, 3306, 5432, 27017 (that's not a db server)
https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers#Well-known_ports
November 19, 2019 at 03:59PM
via reddit https://www.reddit.com/r/Splunk/comments/dybar9/what_are_some_network_traffic_appsprotocols_to/f82s55a?utm_source=ifttt