# Format: TCP/<port number>=<protocol description> - Do not delete, use # to start comments
IP/2=igrp-igmp
ICMP/8=echo
UDP/9=msn messenger
IP/47=gre-vpn
GRE/47=vpn
TCP/21=ftp
TCP/20=ftp-data
TCP/22=ssh
TCP/23=telnet
TCP/25=smtp
TCP/42=ms wins
UDP/42=ms wins
TCP/43=whois
TCP/53=dns
UDP/53=dns
TCP/68=dhcp
TCP/69=tftp
TCP/80=http
TCP/81=http
TCP/88=kerberos
TCP/110=pop3
TCP/111=sun rpc
TCP/113=ident
TCP/119=news
TCP/123=ntp
UDP/123=ntp
TCP/135=ms rpc
UDP/135=ms rpc
TCP/137=netbios
UDP/137=netbios
TCP/138=netbios
UDP/138=netbios
TCP/139=netbios
UDP/139=netbios
TCP/143=imap
UDP/161=snmp
UDP/162=snmp-trap
UDP/370=nai-antivirus-securecast
TCP/389=ldap
UDP/389=ldap
TCP/417=firewall management
TCP/443=ssl-https
TCP/445=netbios
TCP/500=ipsec
UDP/514=syslog
TCP/554=realtime
TCP/873=rsync
TCP/901=trojan
# UDP/1024+ means UDP ports 1024 or higher
UDP/1024+=dns
TCP/1025=agobot-worm
TCP/1026=trojan
UDP/1026=blaster-worm
TCP/1027=icq
UDP/1027=blaster-worm
TCP/1080=socks proxy
TCP/1214=kazaa
TCP/1270=ms mom
TCP/1433=ms sql
TCP/1434=ms sql monitor
UDP/1434=ms sql monitor
TCP/1494=citrix ica
TCP/1512=wins
TCP/1521=oracle
TCP/1723=pptp
UDP/1718=h323-multicast
TCP/1748=oracle
TCP/1755=ms video stream
TCP/1863=msn messenger
UDP/1900=univ. plug-and-play
TCP/1984=big brother
TCP/2049=nfs
TCP/2320=siebel
UDP/2320=siebel
TCP/2745=bagle-trojan
UDP/2967=symantec-av
TCP/3127=agobot-worm
TCP/3128=squid-http
TCP/3306=mysql
TCP/3389=ms rdp
TCP/3410=backdoor-trojan
TCP/3531=peerenabler
UDP/3531=peerenabler
TCP/4692=mcafee management
TCP/4899=radmin
TCP/5000=kibuv-worm
TCP/5050=yahoo messenger
TCP/5190=icq
TCP/5554=sasser-worm
TCP/5800=vnc
TCP/5900=vnc
TCP/6129=agobot-worm
TCP/6346=gnutella-file sharing
TCP/6348=gnutella-file sharing
UDP/7001=msn messenger
TCP/7070=real audio
TCP/8080=http proxy
TCP/9100=hp jetdirect
TCP/12345=netbus-trojan
TCP/13782=netbackup
TCP/27374=subseven-trojan