Networking Concepts · Topic 4 of 11
Common Ports and Protocols
Memorize the well known ports for FTP, SSH, Telnet, SMTP, DNS, DHCP, HTTP, HTTPS, NTP, SNMP, LDAP and RDP, and learn the secure replacements.
- 4 min
- FTP 20/21, SSH and SFTP 22, Telnet 23, SMTP 25, DNS 53, DHCP 67/68, TFTP 69.
- HTTP 80, POP3 110, NTP 123, IMAP 143, SNMP 161/162, LDAP 389, HTTPS 443.
- SMB 445, SMTP submission 587, LDAPS 636, IMAP over TLS 993, POP3 over TLS 995, Syslog 514, SQL Server 1433, Oracle SQLnet 1521, MySQL 3306, RDP 3389, SIP 5060/5061.
What it is
A port number identifies a service on a host. The Internet Protocol (IP) address finds the machine, and the port finds the application on it.
Ports run from 0 to 65535. The exam expects you to know the well known ports (0 to 1023) for common services, whether they use the Transmission Control Protocol (TCP) or the User Datagram Protocol (UDP), and which protocols are secure versions of others.
How it works
A client picks a temporary (ephemeral) source port and connects to the well known destination port of the service. A socket is the combination of an IP address and a port, and a connection is identified by the sockets at both ends.
File transfer and remote access
| Protocol | Port | Transport | Notes |
|---|---|---|---|
| File Transfer Protocol (FTP) | 20 and 21 | TCP | Port 21 is control. Port 20 is used for data in active mode. Not encrypted |
| Secure Shell (SSH) | 22 | TCP | Encrypted remote command line |
| Secure File Transfer Protocol (SFTP) | 22 | TCP | File transfer that runs over SSH |
| Telnet | 23 | TCP | Remote command line in clear text, so avoid it |
| Trivial File Transfer Protocol (TFTP) | 69 | UDP | Simple, no authentication, often used for device images |
| Remote Desktop Protocol (RDP) | 3389 | TCP | Graphical remote access to Windows |
| Protocol | Port | Notes |
|---|---|---|
| Simple Mail Transfer Protocol (SMTP) | 25 | Server to server mail delivery |
| SMTP submission, usually with Transport Layer Security (TLS) | 587 | Client sending mail to its server |
| Post Office Protocol version 3 (POP3) | 110 | Downloads mail, often removing it from the server |
| Internet Message Access Protocol (IMAP) | 143 | Keeps mail on the server and synchronizes devices |
| POP3 over TLS | 995 | Encrypted mail download |
| IMAP over TLS | 993 | Encrypted mailbox access |
Name, address and time services
| Protocol | Port | Transport |
|---|---|---|
| Domain Name System (DNS) | 53 | UDP for most queries, TCP for large replies and zone transfers |
| Dynamic Host Configuration Protocol (DHCP) | 67 (server), 68 (client) | UDP |
| Network Time Protocol (NTP) | 123 | UDP |
Web, directory and management
| Protocol | Port | Notes |
|---|---|---|
| Hypertext Transfer Protocol (HTTP) | 80 | Clear text web traffic |
| Hypertext Transfer Protocol Secure (HTTPS) | 443 | HTTP protected by TLS |
| Lightweight Directory Access Protocol (LDAP) | 389 | Directory queries, clear text by default |
| LDAP over TLS (LDAPS) | 636 | Encrypted directory queries |
| Simple Network Management Protocol (SNMP) | 161 (queries), 162 (traps) | UDP |
| Syslog | 514 | UDP, sends log messages to a collector |
| Server Message Block (SMB) | 445 | TCP, Windows file and printer sharing |
| Session Initiation Protocol (SIP) | 5060, and 5061 with TLS | Sets up voice and video calls |
Databases
| Database | Port |
|---|---|
| Microsoft SQL Server (Structured Query Language, SQL) | 1433 |
| Oracle SQLnet | 1521 |
| MySQL | 3306 |
Secure replacements
Many older protocols send everything in clear text. Their secure replacements add encryption or use a different protocol.
FTP is replaced by SFTP (over SSH) or by FTP Secure (FTPS), which adds TLS to FTP. SNMP version 3 adds authentication and encryption to the earlier versions.
What to remember for the exam
- FTP 20/21, SSH and SFTP 22, Telnet 23, SMTP 25, DNS 53, DHCP 67/68, TFTP 69.
- HTTP 80, POP3 110, NTP 123, IMAP 143, SNMP 161/162, LDAP 389, HTTPS 443.
- SMB 445, SMTP submission 587, LDAPS 636, IMAP over TLS 993, POP3 over TLS 995, Syslog 514, SQL Server 1433, Oracle SQLnet 1521, MySQL 3306, RDP 3389, SIP 5060/5061.
- DNS, DHCP, TFTP, NTP, SNMP and Syslog use UDP. FTP, SSH, Telnet, SMTP and HTTP use TCP.
- Telnet, FTP, HTTP, TFTP and plain LDAP are not encrypted.
- SSH is the secure replacement for Telnet, and HTTPS is the secure form of HTTP.
- SNMP uses 161 for polling and 162 for traps.
Pair each insecure protocol with its secure partner when you study: Telnet and SSH, HTTP and HTTPS, LDAP and LDAPS. Questions often ask which port to open after a protocol is replaced.
Common mistakes
Mixing up SSH, SFTP and FTP. SSH and SFTP both use port 22. FTP uses 20 and 21 and is not encrypted.
Reversing the DHCP ports. The server listens on 67, and the client uses 68.
Assuming SMTP only uses port 25. Port 25 is for mail between servers, while clients usually submit mail on 587.
Thinking DNS is only UDP. Large responses and zone transfers use TCP port 53.
Confusing POP3 and IMAP. POP3 downloads mail, usually removing it from the server. IMAP leaves mail on the server so several devices see the same mailbox.
A secure protocol is not always on a new port. SFTP shares port 22 with SSH, so blocking 22 breaks both.
Check yourself
Use these three questions to test your recall.
Which port and protocol replace Telnet when remote access must be encrypted?
SSH on TCP port 22.
Which ports do SNMP use, and what is each for?
UDP 161 is used for queries to the device, and UDP 162 is used for traps sent to the manager.
A client cannot get an address. Which UDP ports must DHCP traffic be allowed on?
UDP 67 for the server and UDP 68 for the client.
Topic 4 of 11 in Networking Concepts
Test yourself on Networking Concepts
The full CompTIA Network+ N10-009 question bank has 910 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.