Database port numbers: the quick reference数据库端口号快速参考
Common database port numbers include SQL Server 1433/TCP, MySQL and MariaDB 3306/TCP, PostgreSQL 5432/TCP, Oracle Net Listener 1521/TCP, MongoDB 27017/TCP and Redis 6379/TCP. These are conventional defaults, not discovery results. A named instance, managed service, proxy, pooler, container mapping or security policy can use another endpoint.常用数据库端口号包括 SQL Server 1433/TCP、MySQL 与 MariaDB 3306/TCP、PostgreSQL 5432/TCP、Oracle Net Listener 1521/TCP、MongoDB 27017/TCP 和 Redis 6379/TCP。这些只是约定默认值，不是环境探测结果；命名实例、托管服务、代理、连接池代理、容器映射或安全策略都可能使用其他端点。
Use the table to interpret documentation or fill a draft configuration, then confirm the actual listener from the service control plane, server configuration or approved connection details. Do not assume a default and open it broadly at a firewall.可使用表格理解文档或填写配置草案，但随后必须从服务控制台、服务器配置或获准连接信息确认实际监听器。不要仅凭默认值就在防火墙上进行宽泛放行。
Common database port numbers and what they represent常用数据库端口号及其含义
| Database or service数据库或服务 | Conventional port常见端口 | Protocol and caution协议与注意事项 |
|---|---|---|
| Microsoft SQL Server | 1433 | TCP for a common default instance listener; named instances can use dynamic or custom ports.常见默认实例使用 TCP；命名实例可能使用动态或自定义端口。 |
| SQL Server Browser | 1434 | UDP discovery service, not the SQL query session itself.UDP 发现服务，不承载 SQL 查询会话本身。 |
| MySQL / MariaDB | 3306 | TCP for the classic client/server protocol; MySQL X Protocol commonly uses 33060.经典客户端/服务器协议使用 TCP；MySQL X Protocol 通常使用 33060。 |
| PostgreSQL | 5432 | TCP default; a PgBouncer or managed proxy may occupy the client-facing endpoint.默认使用 TCP；客户端端点也可能由 PgBouncer 或托管代理监听。 |
| Oracle Net Listener | 1521 | Conventional TCP listener port; the requested service name must also be registered.常见 TCP 监听端口；所请求的服务名还必须完成注册。 |
| MongoDB | 27017 | TCP default for mongod and mongos unless configuration or managed routing differs.mongod 与 mongos 的默认 TCP 端口，配置或托管路由可能不同。 |
| Redis | 6379 | Conventional TCP port; hosted services and TLS endpoints can publish another port.常见 TCP 端口；托管服务与 TLS 端点可能发布其他端口。 |
| SQLite | None无 | An embedded database file, so it has no server listener unless another application exposes one.属于嵌入式数据库文件，除非其他应用对外提供服务，否则没有服务器监听端口。 |
Do not treat a port number as a product fingerprint. Any process can listen on an available port, and a proxy can front a different backend. Verify protocol and service identity after transport.不要把端口号当作产品指纹。任何进程都可以监听可用端口，代理也可能连接不同后端。传输成功后仍需验证协议与服务身份。
How to verify the database port number your environment uses如何确认环境实际使用的数据库端口号
Treat the application configuration and service control plane as the primary sources, then reconcile them with the database listener or proxy configuration. A wiki, firewall rule or copied deployment template can be stale. Record both the client-facing endpoint and the backend listener when a proxy, pooler or managed gateway sits between them.应以应用配置与服务控制台为主要来源，再与数据库监听器或代理配置核对。Wiki、防火墙规则或复制的部署模板都可能过期。若中间存在代理、连接池代理或托管网关，应同时记录客户端端点与后端监听器。
| Evidence source证据来源 | What to record需要记录 | Common limitation常见局限 |
|---|---|---|
| Application configuration应用配置 | Effective host, port, instance or service实际主机、端口、实例或服务 | Environment variables or secret references may override files环境变量或密钥引用可能覆盖文件 |
| Managed-service console托管服务控制台 | Published endpoint, port, TLS requirement and endpoint role发布端点、端口、TLS 要求与端点角色 | Read replicas and proxies can publish different values只读副本与代理可能发布不同值 |
| Database listener configuration数据库监听配置 | Bound addresses, protocols and service mappings绑定地址、协议与服务映射 | May describe backend rather than client-facing routing可能只描述后端而非客户端路由 |
| Proxy or pooler configuration代理或连接池代理配置 | Front-end listener and backend destination set前端监听与后端目标集合 | Health-based routing can change the selected backend基于健康状态的路由会改变后端选择 |
Document where each value came from and when it was verified. That provenance is more useful than treating the conventional number as authoritative.应记录每个值的来源与核验时间。与把约定端口视为绝对值相比，这种来源信息更有价值。
Verify a listed database port without turning the reference into a scan验证数据库端口号，而不是把参考表变成扫描清单
- Confirm configuration确认配置 Read the approved endpoint and port from the application, service console or database configuration. 从应用、服务控制台或数据库配置中读取获准端点与端口。
- Test one authorized endpoint测试一个获准端点 Run a TCP check from the same network as the workload and preserve the exact result. 从工作负载所在网络执行 TCP 检查并保留准确结果。
- Verify the database protocol验证数据库协议 Use the approved vendor client or application driver with TLS and authentication settings that match production. 使用获准厂商客户端或应用驱动，并采用与生产一致的 TLS 和认证设置。
For PowerShell syntax and interpretation, use the Test-NetConnection guide. This page remains a port-number reference and does not recommend scanning unrelated systems.若需要 PowerShell 语法与结果解读，请查看 Test-NetConnection 指南。本页只提供端口号参考，不建议扫描无关系统。
Check whether the engine, driver and published port belong together检查数据库、驱动与发布端口是否属于同一连接方案
Use the InfiniSynapse DB Compatibility Checker with a sanitized engine version, driver, endpoint type, published port and TLS mode. The purpose is to surface mismatched protocol or driver assumptions—for example, using a classic-protocol port with a client configured for another protocol—not to probe the endpoint.可把脱敏后的数据库版本、驱动、端点类型、发布端口与 TLS 模式提交给 InfiniSynapse DB Compatibility Checker。目的在于发现协议或驱动假设不匹配，例如客户端配置了另一种协议却使用经典协议端口，而不是探测端点。
Review the endpoint compatibility context检查端点兼容性上下文 Confirm the published value in the actual service configuration before deployment.部署前仍需在实际服务配置中确认发布值。Why a correct default database port number can still be wrong为什么正确的默认数据库端口号仍可能不适用
The service selects a configured or dynamic listener instead of the conventional default.服务使用已配置或动态监听端口，而不是约定默认值。
A platform can publish a proxy, gateway or cluster endpoint that hides backend listeners.平台可能发布代理、网关或集群端点，并隐藏后端监听器。
The host-facing port can differ from the port used inside the container or private network.主机侧端口可能与容器或私有网络内部端口不同。
The application connects to an intermediary whose port and protocol policy differ from the database backend.应用连接到中间层，其端口与协议策略可能不同于数据库后端。
When a documented number and deployed endpoint disagree, update the endpoint register only after the service owner confirms which layer clients are expected to use. Do not “correct” a working proxy configuration to match a default table.若文档端口与部署端点不一致，只有在服务负责人确认客户端应使用哪一层后，才能更新端点登记。不要为了匹配默认表而“纠正”正常工作的代理配置。
Use a database port numbers list as inventory, not a firewall template把数据库端口号清单用于资产登记，而不是防火墙模板
A reference list describes conventions; it does not establish business need, source identity, destination scope or acceptable exposure. Firewall and security-group rules should name the approved workload path and exact published endpoint, preferably over private connectivity, with an owner and expiry for temporary access.参考表描述的是约定，不能证明业务需要、来源身份、目标范围或可接受暴露面。防火墙与安全组规则应明确获准工作负载路径和准确发布端点，优先使用私有连接，并为临时访问设置负责人和到期时间。
- Do not open every conventional port. An unused rule still creates future exposure.不要开放全部常见端口。未使用的规则仍会形成未来暴露面。
- Do not identify a database by port alone. Verify service and TLS identity.不要只靠端口识别数据库。还需验证服务与 TLS 身份。
- Do not leave migration overlap unowned. Track old and new endpoints until traffic proves the old path is unused.不要让迁移重叠期无人负责。持续登记新旧端点，直到流量证明旧路径已停用。
Maintain an auditable database endpoint register维护可审计的数据库端点登记表
For each production-facing database path, record the service owner, environment, engine and version family, client-facing DNS name, port, protocol, endpoint role, TLS requirement, approved source class, configuration source, verification date and retirement state. Keep backend listener details separately when a managed proxy or pooler abstracts them.对于每条面向生产的数据库路径，应记录服务负责人、环境、数据库与版本系列、客户端 DNS 名称、端口、协议、端点角色、TLS 要求、获准来源类别、配置来源、核验日期与退役状态。若托管代理或连接池代理隐藏后端，应单独记录后端监听细节。
- Discover from configuration从配置发现 Import values from approved application and service sources. 从获准应用与服务来源导入值。
- Reconcile ownership核对责任归属 Have the application, database and network owners confirm the intended layer. 由应用、数据库与网络负责人确认预期连接层。
- Review changes评审变更 Compare new endpoints with consumers, monitoring, certificates and access rules. 将新端点与消费者、监控、证书和访问规则进行比较。
- Retire deliberately受控退役 Remove old entries only after traffic, jobs and connection pools have drained. 只有在流量、任务与连接池排空后才移除旧条目。
This register turns a generic port list into operational evidence without encouraging broad discovery or speculative firewall changes.该登记表把通用端口列表转化为运维证据，同时避免鼓励宽泛探测或猜测式防火墙变更。
Document a database port change as an endpoint migration把数据库端口变更作为端点迁移进行记录
Changing a port is not an isolated server edit. Every consumer that embeds or discovers the endpoint may depend on it: application configuration, secret metadata, connection pools, health checks, monitoring, backup agents, migration jobs, firewall rules, private DNS, service discovery and incident runbooks. Create a consumer inventory before publishing the new value.端口变更并不是孤立的服务器修改。所有嵌入或发现该端点的消费者都可能受到影响，包括应用配置、密钥元数据、连接池、健康检查、监控、备份代理、迁移任务、防火墙规则、私有 DNS、服务发现与事故手册。发布新值前必须建立消费者清单。
| Migration stage迁移阶段 | Required evidence所需证据 | Rollback condition回滚条件 |
|---|---|---|
| Prepare准备 | Approved new listener, protocol, TLS identity, access rules and owner获准的新监听器、协议、TLS 身份、访问规则与负责人 | New endpoint cannot pass protocol-level validation新端点无法通过协议级验证 |
| Overlap重叠 | Old and new endpoints are monitored separately and temporary rules have expiry新旧端点分别监控，临时规则设置到期时间 | Error, latency or connection-volume guardrail is exceeded错误、延迟或连接量超过阈值 |
| Canary灰度 | Named consumers prove login, database selection and representative operations指定消费者验证登录、数据库选择与代表性操作 | Any critical consumer falls back or requires undocumented behavior关键消费者回退或依赖未记录行为 |
| Retire退役 | Traffic, scheduled jobs and pooled sessions show no use of the former endpoint流量、计划任务与连接池会话均不再使用旧端点 | A remaining owner or dependency is unresolved仍有负责人或依赖尚未确认 |
Update the endpoint register with the decision record, deployment date, verification window and removal date. Keep the conventional port number only as descriptive metadata; the authoritative value is the published endpoint that approved clients are expected to use.应在端点登记表中更新决策记录、部署日期、验证窗口与移除日期。常见默认端口只作为描述性元数据；权威值应是获准客户端被要求使用的实际发布端点。
When documentation, monitoring and application configuration disagree, stop the migration and reconcile them with the service owner. A successful canary cannot compensate for an unknown scheduled consumer or an untracked disaster-recovery path.当文档、监控与应用配置不一致时，应暂停迁移并与服务负责人核对。成功的灰度不能弥补未知计划任务消费者或未登记的灾难恢复路径。
Database Port Numbers for Common Database Engines FAQ数据库端口号常见问题
What are the most common database port numbers?最常见的数据库端口号有哪些？
Common defaults include SQL Server 1433/TCP, MySQL and MariaDB 3306/TCP, PostgreSQL 5432/TCP, Oracle 1521/TCP, MongoDB 27017/TCP and Redis 6379/TCP. Confirm every value against the deployed service.常见默认值包括 SQL Server 1433/TCP、MySQL 与 MariaDB 3306/TCP、PostgreSQL 5432/TCP、Oracle 1521/TCP、MongoDB 27017/TCP 和 Redis 6379/TCP。每个值都必须与实际部署服务核对。
Why can a database use a port different from the default?为什么数据库会使用非默认端口？
Administrators can configure another listener; named instances may use dynamic ports; managed services, proxies, poolers, containers and network address translation can publish a different client-facing endpoint.管理员可以配置其他监听端口；命名实例可能使用动态端口；托管服务、代理、连接池代理、容器和网络地址转换也可能发布不同的客户端端点。
Is SQL Server port 1433 TCP or UDP?SQL Server 1433 是 TCP 还是 UDP？
Port 1433 is conventionally TCP for SQL Server database connections. UDP 1434 is associated with SQL Server Browser discovery. A named instance can use another TCP port, so read the actual instance configuration.1433 通常是 SQL Server 数据库连接使用的 TCP 端口；UDP 1434 与 SQL Server Browser 发现服务相关。命名实例可以使用其他 TCP 端口，因此应读取实际实例配置。
Do MySQL and MariaDB both use port 3306?MySQL 与 MariaDB 都使用 3306 端口吗？
Both commonly default to TCP 3306 for the classic protocol, but either can be configured differently. MySQL X Protocol commonly uses 33060, which is a separate protocol endpoint.两者的经典协议通常默认使用 TCP 3306，但都可以改为其他端口。MySQL X Protocol 通常使用 33060，它是独立的协议端点。
Does an open default port prove which database is running?默认端口开放能证明运行的是哪种数据库吗？
No. A port number is not authenticated product identity. A different service or proxy can listen there. Use an approved database client and verify protocol, TLS identity and server response.不能。端口号不是经过认证的产品身份，其他服务或代理也可以监听该端口。应使用获准数据库客户端验证协议、TLS 身份与服务器响应。
Should I open every listed database port in a firewall?是否应该在防火墙中开放所有列出的数据库端口？
No. Allow only the exact configured destination and port needed by an approved workload, preferably across private connectivity. Broad rules based on a default-port list increase exposure without proving that the application needs them.不应。只允许获准工作负载所需的准确目标和端口，并优先使用私有连接。根据默认端口表建立宽泛规则会扩大暴露面，却不能证明应用确实需要这些端口。