Common Ports & Protocols

A protocol is the set of rules two systems use to talk to each other — HTTP, SSH, DNS. A port is the numbered door on the machine where that conversation happens. Most protocols have a default port (HTTP on 80), but the two are not welded together: a web server listening on 8080 is still speaking HTTP. The port tells you where to knock; the protocol tells you what language to speak once the door opens.

There are 65,536 ports in total, numbered 0 to 65535, split into three ranges. Well-known ports (0–1023) are assigned by IANA to core services and normally require administrative privileges to bind. Registered ports (1024–49151) are assigned to specific applications, such as MySQL on 3306 or RDP on 3389. Dynamic or private ports (49152–65535) are ephemeral — your machine picks one at random as the source port for an outbound connection.

TCP establishes a connection before sending data, guarantees delivery and ordering, and retransmits anything lost — which suits file transfers, web traffic and email. UDP just sends, with no handshake and no delivery guarantee, making it faster and better suited to DNS lookups, DHCP, VoIP and streaming, where a late packet is worse than a missing one. The numbering is independent: TCP 53 and UDP 53 are different doors that happen to share a number.

UDP 53 handles ordinary lookups. They are small, and retrying a lost query is cheaper than setting up a connection for it. TCP 53 takes over when a response is too large for a single UDP datagram, and for zone transfers (AXFR), where an entire zone file is copied between name servers and reliability matters. Exam questions almost always target the zone-transfer half.

Port 3389 (RDP) is the most brute-forced port online and a frequent ransomware entry point. Port 445 (SMB) is the EternalBlue and WannaCry vector. Port 23 (Telnet) sends credentials in cleartext and has no business running at all. Database listeners — 1433, 3306, 5432, 6379, 27017 — should never be directly reachable. Port 161 (SNMP) is often left on default community strings. Put all of these behind a VPN or a bastion host rather than a firewall rule you hope holds.

A+ and Network+ both publish explicit port lists in their exam objectives, and Security+ leans on the authentication and encryption ports — 88 for Kerberos, 49 for TACACS+, 1812 for RADIUS, 500 and 4500 for IPsec. Rather than memorising all 200, start with the two dozen in the most-tested ports section at the top of this page, which covers the overlap between the three exams. Objectives change between exam versions, so check the current ones for the exam you are sitting.

FTP (ports 20 and 21) is the original file transfer protocol and is entirely cleartext. FTPS is FTP wrapped in TLS — the same protocol, encrypted, typically on port 990. SFTP is not FTP at all: it is file transfer over SSH, running on port 22, sharing nothing with FTP but three letters. Study material commonly pairs FTP with SFTP as the insecure-versus-secure answer, which is practically useful, though FTPS is FTP’s direct encrypted counterpart.