Skip to content

Beginner · Networking for security · topic 8 of 43 · 30 min

Ports and protocols

Explanation

A port is a number from 0 to 65535 that tells a computer which program should receive network data. Well-known services use fixed ports, like 443 for HTTPS and 22 for SSH. Knowing the common ports lets you spot risky open services and odd traffic in logs.

Why ports matter

One computer runs many network programs at once: a web server, an SSH server, a database. The IP address gets data to the right computer; the port number gets it to the right program. An open port is a door into the machine. Every open door that is not needed is extra risk, which is called attack surface.

Think of it like this: The IP address is the address of an apartment building. The port is the flat number. A letter for flat 443 goes to the web server; a letter for flat 22 goes to the SSH server.

Port ranges

  • 0–1023: well-known ports, for common services. On Linux only admin (root) programs can listen on them by default.
  • 1024–49151: registered ports, used by many applications and databases.
  • 49152–65535: dynamic or ephemeral ports. Your computer picks one of these as the source port each time it opens a connection.

Ports every analyst should know

PortProtocolServiceSecurity note
20, 21TCPFTP (file transfer)Sends passwords in clear text; use SFTP instead
22TCPSSH (secure remote shell), SFTPOften brute-forced; use keys and limit who can reach it
23TCPTelnetClear text; should almost never be open
25TCPSMTP (mail between servers)587 is used for sending mail from apps and clients
53UDP and TCPDNSWatch for strange volumes (tunnelling)
67, 68UDPDHCP (hands out IP addresses)A fake DHCP server can redirect traffic
80TCPHTTPNot encrypted; redirect to 443
123UDPNTP (time sync)Correct time is vital for logs
143, 993TCPIMAP, IMAP over TLSUse 993
389, 636TCPLDAP, LDAP over TLSDirectory lookups (Active Directory)
443TCP (and UDP for HTTP/3)HTTPSMost normal web traffic
445TCPSMB (Windows file sharing)Never expose to the internet; used by WannaCry in 2017
3306TCPMySQLDatabases should not face the internet
3389TCPRDP (Windows Remote Desktop)A top target for ransomware gangs; put it behind a VPN
5432TCPPostgreSQLDatabases should not face the internet

Seeing which ports are open on your own machine

bash
$ sudo ss -tulpn
Netid State  Local Address:Port  Process
udp   UNCONN 127.0.0.53%lo:53     users:(("systemd-resolve",pid=612))
tcp   LISTEN 0.0.0.0:22           users:(("sshd",pid=901))
tcp   LISTEN 127.0.0.1:3306       users:(("mysqld",pid=1144))
tcp   LISTEN 0.0.0.0:80           users:(("apache2",pid=1210))
Linux: listening ports. 0.0.0.0 means "all interfaces"; 127.0.0.1 means only this machine can connect, which is what you want for a database.
powershell
PS> Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort

LocalAddress LocalPort OwningProcess
------------ --------- -------------
0.0.0.0            135          1032
0.0.0.0            445             4
0.0.0.0           3389          1180
Windows: listening TCP ports and the process ID that owns each one.

Scanning your own lab

Nmap is a free tool that checks which ports are open on a machine. Defenders use it to find forgotten services before attackers do. Use it only on your own lab machines or with written permission.

bash
$ nmap -sV 192.168.56.101
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 9.6p1 Ubuntu
80/tcp   open  http    Apache httpd 2.4.58
3306/tcp open  mysql   MySQL 8.0.39
Scanning your own lab VM. -sV asks for service versions. A database open to the network is a finding to fix.

Common mistakes

  • Believing a port number proves the service. Anything can run on any port; malware often uses 443 or 80 to blend in.
  • Leaving RDP (3389) or SMB (445) open to the internet. Put remote access behind a VPN with MFA.
  • Forgetting UDP. Some scans and firewalls only look at TCP.
Tip: Close what you do not need. The safest open port is one that is not open.

Need help?

Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.

Try:

Watch the lesson

Ports and protocols · 1/7

IP = building Port = flat number

The IP address finds the computer. The port number finds the program on it.

Prefer a video by a teacher? Find free videos on “common network ports every security analyst should know” on YouTube ↗

In real life: The forgotten RDP port

A small logistics company in Gujarat opened Remote Desktop (port 3389) to the internet so the owner could work from home. Within days, the firewall logged thousands of password guesses from many countries. A weak admin password was eventually guessed and ransomware was installed. The fix after recovery: close 3389 to the internet, use a VPN with MFA, and set account lockout. This pattern is one of the most common ransomware entry points worldwide.

Practice (0/3 done)

Task 1 · Code · Python

Complete the PORTS dict so that service(port) returns the service name for these ports: 22 "SSH", 53 "DNS", 80 "HTTP", 443 "HTTPS", 445 "SMB", 3389 "RDP". For any other port return "unknown".

Task 2 · Code · Python

An internet-facing server should not expose risky services. Write risky_exposed(open_ports) that returns a sorted list of the ports in open_ports that are in RISKY. Also return an empty list when nothing risky is open.

Task 3 · Question

ss -tulpn shows mysqld listening on 127.0.0.1:3306. What does that mean?

Quick quiz

Question 1

1.Which port does HTTPS use by default?

Question 2

2.Port 3389 is…

Question 3

3.Why is Telnet (port 23) dangerous?

Question 4

4.Which port range does your computer usually pick its source port from?

Question 5

5.Traffic to a server on port 443 is…

Read more (free)

Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.

Which port does HTTPS use by default?

Answer: 443

HTTPS uses TCP 443 (and UDP 443 for HTTP/3).

Port 3389 is…

Answer: RDP (Remote Desktop)

3389 is Windows Remote Desktop, a common ransomware entry point when exposed.

Why is Telnet (port 23) dangerous?

Answer: It sends everything, including passwords, in clear text

Telnet has no encryption. SSH replaced it.

Which port range does your computer usually pick its source port from?

Answer: 49152–65535

Clients use dynamic (ephemeral) ports, 49152–65535 in the IANA range.

Traffic to a server on port 443 is…

Answer: Usually HTTPS, but any program can use that port

Port numbers are conventions. Malware often uses 443 to blend in with normal traffic.

An "open" port means…Related

Answer: A service is listening there

Open means a service is listening and accepting connections.

From Ports, services and what scanning does

Which port does HTTPS use by default?Related

Answer: 443

HTTP uses port 80 and HTTPS uses port 443 when no port is written in the URL.

From Clients, servers, IP addresses and URLs

-Pn tells nmap to…Related

Answer: Skip host discovery and treat the host as up

-Pn is useful when a host ignores pings but is actually up.

From nmap scan types

Which port does SSH use?Related

Answer: 22

SSH uses TCP port 22. Telnet uses 23.

From TCP, UDP and port numbers

Pass the quiz (60% or more) or mark this topic as done when you are ready.

Your progress is saved on this device only.

Next: DNS: the internet's phone book →

Next steps

  1. 2 more topics in “Networking for security” before its exam: DNS: the internet's phone book, HTTP, HTTPS and TLS.
  2. Module 2 exam: Networking for security · 12 questions · 20 min, without help. 5 topics of this module still to finish first.
  3. Then the next module, Systems and cryptography. 43 topics left in the course before the final exam.

← Previous: IP addresses, subnets and CIDR