¶ SAP Default Ports and Instance Numbers
SAP services mostly do not have fixed default ports. They have port patterns in which the two-digit instance number is substituted, so the same service answers on a different port on every instance of a system, and a second instance on the same host answers on a different number again.
Instance numbers run from 00 to 99. A single host can carry several instances, and each instance shifts the whole family of ports that belong to it. This is the arithmetic that makes an SAP landscape harder to inventory than a list of default ports suggests.
¶ How does the instance number change an SAP port?
The instance number is written into the pattern, not added to the end of it. Take the pattern, replace the two placeholder digits wherever they sit, and read the result as a number.
- An ABAP dispatcher pattern of 32NN gives 3200 at instance 00 and 3201 at instance 01. Here the digits are at the end, which is why this is the example everyone learns.
- An AS Java HTTP pattern of 5NN00 gives 50000 at instance 00 and 50100 at instance 01. The instance digits sit in the middle, with fixed digits on both sides.
- A SAP HANA index server SQL pattern of 3NN15 gives 30015 at instance 00 and 30215 at instance 02.
Read the rule as "the last two digits are the instance" and it fails on most of the catalogue. That is the single most common source of an SAP port written down wrongly, and the resulting mistake is silent: you knock on a port nobody uses, find nothing, and record that nothing is there.
¶ Which SAP services use which default port patterns?
These are SAP's published conventions. Any of them can be changed on a given landscape, and several are routinely changed.
A scan looks for named SAP service kinds from a shipped catalogue, which is the part a port number on its own cannot supply.
| SAP service | Default pattern | At instance 01 | Notes |
|---|---|---|---|
| ABAP dispatcher (SAP GUI, DIAG, RFC) | 32NN | 3201 | The listener a SAP GUI and most RFC clients reach |
| SAP gateway | 33NN | 3301 | Registered and started RFC server programs |
| SAP gateway, secured | 48NN | 4801 | The gateway's SNC listener |
| Message server, ABAP | 36NN | 3601 | Logon groups and instance lists |
| Message server, HTTP | 81NN | 8101 | The HTTP face of the same service |
| Internet Communication Manager, HTTP | 80NN | 8001 | The ABAP HTTP stack, including ICF services |
| Internet Communication Manager, HTTPS | 443NN | 44301 | The TLS counterpart of the same stack |
| AS Java, HTTP | 5NN00 | 50100 | Instance digits in the middle |
| AS Java, HTTPS | 5NN01 | 50101 | |
| AS Java, P4 remote object protocol | 5NN04 | 50104 | Administrative and remote-object access to the Java stack |
| AS Java, telnet administration | 5NN08 | 50108 | An administration shell |
| SAP HANA index server, SQL | 3NN15 | 30115 | The instance here is the HANA instance number |
| SAP HANA index server, secondary | 3NN17 | 30117 |
¶ Which SAP ports carry no instance number?
Infrastructure services that are the same on every SAP system. They are the exception, and the exception is exact: a fixed port never belongs to a numbered instance and a patterned port never belongs to the fixed set.
| SAP service | Port | Notes |
|---|---|---|
| SAProuter | 3299 | The same on every landscape that runs one |
| SAP Host Agent, host control | 1128, and 1129 for TLS | Reports on the host rather than on one SAP system |
| SAP Internet Graphics Service | 40080 |
The RedRays Security Platform keeps those two sets apart deliberately: a fixed-port service is looked for under the shared, unnumbered instance, and a patterned service only under numbered ones. If you are doing this by hand, that is the second list you have to keep per host.
¶ Why does a port that is already written down beat the pattern?
Because a pattern is a guess about where a service will be, and an explicit port is a fact about where it was. Where a service already carries a port, that number is used exactly as written and the pattern is never consulted.
Two practical consequences fall out of this, and both surprise people the first time:
- Renumbering an instance recomputes nothing. Every service under it keeps the port it already had, because those ports are stored numbers rather than derived ones.
- An instance with nothing under it produces a wider scan, not a narrower one. With no services recorded, there is nothing to use verbatim, so every pattern that fits the instance is resolved and tried.
¶ Limits: what a default port table is worth
A default is a default. SAP's HTTP and HTTPS ports are set in profile parameters and are frequently moved; a landscape behind a reverse proxy or a load balancer answers on whatever the proxy publishes; and an instance number that was chosen by a project years ago is a fact about that landscape, not about SAP.
So the table above tells you where to look first. It does not tell you what is there, and it never tells you whether a service that is answering should be. Establishing the first is what a port and service scan measures; the second is a decision a person makes about the network the service sits on.
One more limit worth stating: the port number does not identify the service. Several SAP service kinds share a pattern, and the reply is what tells them apart.
¶ Frequently asked questions
¶ What is the SAP instance number?
A two-digit number, 00 to 99, that identifies one SAP instance on a host. It is chosen when the instance is installed, it appears in the instance directory name and the profile name, and it is substituted into the default port patterns of every service that instance runs.
¶ Can two SAP instances on one host use the same instance number?
No. The number has to be unique on the host, precisely because it decides the ports. Two instances with the same number would collide on every listener.
¶ Which SAP ports should not be reachable from a user network?
That is a landscape decision rather than a universal rule, but the ones that attract the most attention are the gateway, the message server and the Java administration ports, because each of them accepts something more than an ordinary end user session. What an exposed gateway or a stored RFC destination means in practice is covered under RFC trust and stored credentials.
¶ Does SAP publish a full port list?
SAP documents the TCP/IP ports used by its products, and that document is the reference to check against when a landscape is unusual. The table here covers the services most often asked about in a security review rather than every port SAP ships.