Only those ports that are commonly used are listed, refer to the IANA site for the full list. When investigating TCP traffic, be careful not to confuse the client and server ports. The client port is incremental, typically beginning at 1024 at boot time and wrapping at 4096. If the port you are investigating is in the lower part of this range, it may be a client port. Stateful firewalls identify the server port, but packet sniffers and stateless firewalls do not. For example, a packet sniffer showing a TCP packet with source port 1080 and destination port 1494 might be SOCKS or Citrix-ICA. The only way to know for sure is to examine the initial TCP handshake. With UDP, client port selection depends on the application and may be incremental, fixed to a nonsensical value, or fixed equal to the server port.