What are “remapped” ports?
A common technique is to remap ports to some other address. For example, whereas the default port for HTTP is 80, many people remap it to another port, such as 8080 (hence, this document could reside at http://www.robertgraham.com:8080/pubs/firewall-seen.html if I were to remap the port). Remapping is done under the theory that making the port harder to find will make it more difficult for a hacker to exploit. Instead of simply exploiting a well-known service at a well-known port, the hacker will have to port scan the machine. Most port remapping is done at some variation of the original port. Therefore, most HTTP ports are based upon a variation of the theme “80”: 81, 88, 8000, 8080, 8888, and so forth. POP, which is originally at port 110 can often be found at port 1100. There are other statistically significant chosen numbers, like 12345, 23456, 34567, etc. Many people also choose numbers that are well known for other reasons; 42, 69, 666, 31337, and so on. The recent proliferation
