Inside Bitcoin
Opening the selected file…
Inside Bitcoin
Opening the selected file…
The code behind the network, with room to understand it.
Release published 2026-10-28 · Snapshot fetched 2026-11-01. Latest stable release at fetch time; development branches and Git history are excluded. Only the selected code window and visible folders load here.
1When Bitcoin Core automatically opens outgoing P2P connections, it chooses2a peer (address and port) from its list of potential peers. This list is3populated with unchecked data gossiped over the P2P network by other peers.5A malicious actor may gossip an address:port where no Bitcoin node is listening,6or one where a service is listening that is not related to the Bitcoin network.7As a result, this service may occasionally get connection attempts from Bitcoin8nodes.10"Bad" ports are ones used by services which are usually not open to the public11and usually require authentication. A connection attempt (by Bitcoin Core,12trying to connect because it thinks there is a Bitcoin node on that13address:port) to such service may be considered a malicious action by an14ultra-paranoid administrator. An example for such a port is 22 (ssh). On the15other hand, connection attempts to public services that usually do not require16authentication are unlikely to be considered a malicious action,17e.g. port 80 (http).19Below is a list of "bad" ports which Bitcoin Core avoids when choosing a peer to20connect to. If a node is listening on such a port, it will likely receive fewer21incoming connections.231: tcpmux247: echo259: discard2611: systat2713: daytime2815: netstat2917: qotd3019: chargen3120: ftp data3221: ftp access3322: ssh3423: telnet3525: smtp3637: time3742: name3843: nicname3953: domain4069: tftp4177: priv-rjs4279: finger4387: ttylink4495: supdup45101: hostname46102: iso-tsap47103: gppitnp48104: acr-nema49109: pop250110: pop351111: sunrpc52113: auth53115: sftp54117: uucp-path55119: nntp56123: NTP57135: loc-srv /epmap58137: netbios59139: netbios60143: imap261161: snmp62179: BGP63389: ldap64427: SLP (Also used by Apple Filing Protocol)65465: smtp+ssl66512: print / exec67513: login68514: shell69515: printer70526: tempo71530: courier72531: chat73532: netnews74540: uucp75548: AFP (Apple Filing Protocol)76554: rtsp77556: remotefs78563: nntp+ssl79587: smtp (rfc6409)80601: syslog-conn (rfc3195)81636: ldap+ssl82989: ftps-data83990: ftps84993: ldap+ssl85995: pop3+ssl861719: h323gatestat871720: h323hostcall881723: pptp892049: nfs903306: MySQL913389: RDP / Windows Remote Desktop923659: apple-sasl / PasswordServer934045: lockd945060: sip955061: sips965432: PostgreSQL975900: VNC986000: X11996566: sane-port1006665: Alternate IRC1016666: Alternate IRC1026667: Standard IRC1036668: Alternate IRC1046669: Alternate IRC1056697: IRC + TLS10610080: Amanda10727017: MongoDB109For further information see:111[pull/23306](https://github.com/bitcoin/bitcoin/pull/23306#issuecomment-947516736)113[pull/23542](https://github.com/bitcoin/bitcoin/pull/23542)115[fetch.spec.whatwg.org](https://fetch.spec.whatwg.org/#port-blocking)117[chromium.googlesource.com](https://chromium.googlesource.com/chromium/src.git/+/refs/heads/main/net/base/port_util.cc)119[hg.mozilla.org](https://hg.mozilla.org/mozilla-central/file/tip/netwerk/base/nsIOService.cpp)
Independent explanations by MyBitcoinExplorer. Not affiliated with or endorsed by Bitcoin Core. Guides are educational and do not replace the source or its tests.
Bitcoin Core source © its contributors, distributed under the MIT license. Original notices and bundled third-party licenses are retained in the source tree.