Common Ports and Protocols: The Cheat Sheet That Actually Comes Up

A quick reference guide to essential networking ports and protocols for real-world use, including those commonly encountered in certification exams and everyday network administration.

What is a Port?

In simple terms, a port is like an apartment number at an IP address. When data packets arrive at an IP address, the port number directs them to the appropriate program or service running on that machine.

Essential Ports to Memorize

22 - SSH (Secure Shell)

• Function: Remote terminal access and SFTP file transfer.
• Security Note: Always use secure protocols like SSH for remote access.

53 - DNS (Domain Name System)

• Function: Converts human-readable domain names into IP addresses. Primarily uses UDP, but can use TCP for larger responses.
• Protocol Details: DNS queries are typically sent over UDP port 53, while DNS responses can use either UDP or TCP on the same port.

80 - HTTP (Hypertext Transfer Protocol)

• Function: The standard protocol for web browsing. Unencrypted data transmission.
• Alternative: 443 - HTTPS (HTTP Secure), used for secure web browsing with TLS encryption.

25 - SMTP (Simple Mail Transfer Protocol)

• Function: Server-to-server email transfer.
• Alternatives:
  • 587 Submission Port: Used by clients to send emails directly to the mail server.
  • 993 IMAPS (Internet Message Access Protocol over SSL): Secure version of IMAP, used for retrieving emails from a remote server.
  • 995 POP3S (Post Office Protocol version 3 over SSL): Secure version of POP3, used for retrieving emails.

67/68 - DHCP (Dynamic Host Configuration Protocol)

• Function: Assigns IP addresses and other network configuration parameters to devices on a network.
• Notes: Typically handled by routers or dedicated DHCP servers.

123 - NTP (Network Time Protocol)

• Function: Synchronizes the clocks of computers over a network.
• Protocol Details: Uses UDP port 123 for time synchronization.

3389 - RDP (Remote Desktop Protocol)

• Function: Allows remote access to Windows desktops and applications.
• Security Note: Highly sensitive, avoid exposing it directly on the internet. Use strong authentication methods.

445 - SMB (Server Message Block)

• Function: File sharing protocol used in Microsoft environments. Often exploited by ransomware; avoid exposing it on the public internet.
• Security Warning: Never expose this port to the internet without proper security measures.

21 - FTP (File Transfer Protocol)

• Function: Historically used for file transfer but now considered insecure due to its lack of encryption.
• Status: Primarily included for exam purposes; not recommended for use in modern networks.

161/162 - SNMP (Simple Network Management Protocol)

• Function: Monitors and manages network devices. Used by network administrators to gather information about the state of a device.
• Protocol Details: Uses UDP port 161 for read-only operations and UDP port 162 for traps.

389 - LDAP (Lightweight Directory Access Protocol)

• Function: Provides directory services, such as user authentication and authorization.
• Secure Alternative: LDAPS uses port 636 for secure communication over SSL/TLS.

1812/1813 - RADIUS (Remote Authentication Dial-In User Service)

• Function: Authenticates users on remote access servers. Used in enterprise environments to manage network access.
• Protocol Details: Uses UDP port 1812 for authentication and accounting, and TCP port 1813 for the same.

Game Server Examples

• Minecraft Java Edition: Port 25565
• Valheim: Ports 2456 to 2458 (used by different clients)

Understanding Port Ranges

• Well-known Ports (0-1023): These are reserved for system services and require administrative privileges to bind.
• Registered Ports (1024-49151): Available for general use but still may require some level of administration.
• Ephemeral Ports (49152-65535): Randomly assigned by the operating system for client-side connections.

Protocol vs. Port

Ports are not strictly bound to specific protocols; they are more like conventions. For example, while SSH typically uses port 22, it is possible to run it on any other port as well. Similarly, attackers and administrators often use non-standard ports to avoid detection or to take advantage of misconfigurations.

Practical Commands

• Linux: ss -tlnp (shows listening sockets with process information)
• Windows: netstat -ano (displays active TCP connections and their associated processes)
• Scanning Your Network: Use nmap to scan your own network for open ports.

"Address Already in Use" Error

This error occurs when two programs attempt to bind to the same port. It is a common issue that can be resolved by stopping one of the conflicting services or by binding each service to a different port.

By understanding these essential networking protocols and their corresponding ports, you will be better equipped to manage and troubleshoot your network effectively.