Common ports & protocols
Use this when: you read a firewall rule, scan or netstat output and need the service behind a port.
Text version
Everything on the sheet, as plain HTML: handy for screen readers, copy-paste and search.
Port map: 32 ports to know
Port, protocol and transport. Ports 23, 21/20, 69, 80, 110, 143, 161/162 and 514 send data in cleartext; 22, 443, 587 with TLS, 993, 995, 636, 6514 and 5061 are encrypted.
| Group | Port | Protocol | Transport |
|---|---|---|---|
| Remote and files | 20/21 | FTP | TCP |
| 22 | SSH | TCP | |
| 23 | Telnet | TCP | |
| 69 | TFTP | UDP | |
| 137 to 139 | NetBIOS | UDP/TCP | |
| 445 | SMB/CIFS | TCP | |
| 3389 | RDP | TCP/UDP | |
| 5900 | VNC | TCP | |
| Web and email | 80 | HTTP | TCP |
| 443 | HTTPS | TCP/UDP | |
| 25 | SMTP | TCP | |
| 587 | Mail submission | TCP | |
| 110 | POP3 | TCP | |
| 995 | POP3S | TCP | |
| 143 | IMAP | TCP | |
| 993 | IMAPS | TCP | |
| Network services | 53 | DNS | UDP/TCP |
| 67/68 | DHCP | UDP | |
| 123 | NTP | UDP | |
| 161/162 | SNMP | UDP | |
| 514 | Syslog | UDP | |
| 6514 | Syslog over TLS | TCP | |
| 5060 | SIP | UDP/TCP | |
| 5061 | SIP over TLS | TCP | |
| Identity and data | 88 | Kerberos | UDP/TCP |
| 389 | LDAP | TCP/UDP | |
| 636 | LDAPS | TCP | |
| 49 | TACACS+ | TCP | |
| 1812/1813 | RADIUS | UDP | |
| 1433 | MS SQL | TCP | |
| 3306 | MySQL | TCP | |
| 5432 | PostgreSQL | TCP |
Swap cleartext for secure
| Instead of | Use | How it is protected |
|---|---|---|
| Telnet 23 | SSH 22 | Encrypted |
| FTP 21, TFTP 69 | SFTP or SCP on 22 | Over SSH |
| HTTP 80 | HTTPS 443 | TLS |
| POP3 110, IMAP 143 | 995, 993 | Implicit TLS |
| LDAP 389 | LDAPS 636 | TLS, or StartTLS on 389 |
| SNMP v1/v2c | SNMPv3 | Adds authentication and encryption |
Port ranges
| Range | Name | Used for |
|---|---|---|
| 0 to 1023 | Well-known | System services |
| 1024 to 49151 | Registered | Vendor applications |
| 49152 to 65535 | Dynamic | Client source ports |
TCP is reliable and uses a handshake: web, SSH, mail, SMB. UDP is fast with no handshake: DNS, DHCP, NTP, VoIP. DNS also uses TCP 53 for zone transfers and big replies. Source: RFC 6335.
What is listening on this host?
| Command | Where | What it answers |
|---|---|---|
netstat -ano | findstr LISTENING | Windows | Listening ports and PIDs |
Get-NetTCPConnection -State Listen | PowerShell | Listening TCP ports |
ss -tulpn | Linux | Listening TCP and UDP ports |
Test-NetConnection 192.0.2.10 -Port 22 | PowerShell | Is the remote port open? |
tasklist /FI "PID eq 4321" | Windows | Who owns the PID? |
lsof -i :443 | Linux | Who uses 443? |
Caution. ss -p and lsof need sudo to see other users' processes. Exit the root shell when done.
Firewall rules of thumb
Danger. Never open these to the internet: 23 Telnet, 135 to 139, 445 SMB, 3389 RDP, 1433, 3306 and 161 SNMP.
- Default: deny all inbound, allow only what a service needs.
- Remote access: RDP or SSH through a VPN or gateway with MFA.
- Verify: a port is a hint, not proof. Check the service.
- Log: log denied traffic and review it weekly.
Remember
- FTP: 21 is control, 20 is data (active mode)
- SNMP: 161 is the manager polling, 162 is traps
- RADIUS is UDP, TACACS+ is TCP 49
- DHCP: server 67, client 68, both UDP
- Mail: 25 server to server, 587 client sends
- SSH 22 also carries SFTP and SCP
Sources
- IANA service name and port number registry
- RFC 6335, port number ranges
- RFC 8314, cleartext considered obsolete for mail
- CompTIA A+ certification objectives
- Microsoft Learn, Test-NetConnection