Common Ports and Protocols

More Than a Memorization Exercise

Ports are the addressing mechanism that allows a single IP address to host multiple services. Each port is a 16-bit number (0-65535), and certain ports are assigned to specific protocols by convention (IANA). Knowing these assignments is not trivia — it is the foundation for firewall configuration, intrusion detection, and incident response.

When you see traffic on port 443, you know it is likely HTTPS. When you see traffic on port 23, you know it is Telnet — and you should be alarmed because Telnet transmits credentials in plaintext. When you see traffic on a high port (e.g., 4444) that you did not expect, you should investigate because attackers often use high ports for command-and-control.

The Well-Known Ports (0-1023)

These ports require root/administrator privileges to bind to on most operating systems. They are the standard ports for common services:

Web and Proxy:

• 80/tcp — HTTP (plaintext web traffic). Should be redirected to 443 in any secure environment.
• 443/tcp — HTTPS (TLS-encrypted web traffic). The standard for secure web communication.
• 8080/tcp — HTTP alternate (often used for proxy servers or web management interfaces).
• 8443/tcp — HTTPS alternate (often used for web management interfaces).

Remote Access:

• 22/tcp — SSH (Secure Shell). Encrypted remote administration. The replacement for Telnet and rlogin.
• 23/tcp — Telnet. Plaintext remote administration. Credentials and all data are transmitted unencrypted. Should never be used.
• 3389/tcp — RDP (Remote Desktop Protocol). Windows remote desktop. Frequently targeted by brute-force attacks.
• 5900/tcp — VNC (Virtual Network Computing). Remote desktop for Linux/Unix. Often configured without encryption.

File Transfer:

• 20/tcp, 21/tcp — FTP (File Transfer Protocol). Port 20 is data, port 21 is control. Plaintext — credentials are transmitted unencrypted. Replaced by SFTP and FTPS.
• 22/tcp — SFTP (SSH File Transfer Protocol). Runs over SSH, so it is encrypted. Note: SFTP is not FTP over SSH — it is a completely different protocol.
• 989/tcp, 990/tcp — FTPS (FTP over TLS). Encrypted FTP.
• 445/tcp — SMB (Server Message Block). Windows file sharing. Also used by WannaCry and other ransomware for lateral movement.

Email:

• 25/tcp — SMTP (Simple Mail Transfer Protocol). Used for server-to-server mail relay. Often blocked on residential IPs to prevent spam.
• 587/tcp — SMTP submission. Used for client-to-server mail submission with authentication.
• 110/tcp — POP3 (Post Office Protocol v3). Plaintext email retrieval.
• 143/tcp — IMAP (Internet Message Access Protocol). Plaintext email retrieval.
• 993/tcp — IMAPS (IMAP over TLS). Encrypted IMAP.
• 995/tcp — POP3S (POP3 over TLS). Encrypted POP3.

Directory and Authentication:

• 389/tcp — LDAP (Lightweight Directory Access Protocol). Plaintext directory queries. Used by Active Directory.
• 636/tcp — LDAPS (LDAP over TLS). Encrypted LDAP.
• 88/tcp — Kerberos. Windows authentication protocol.
• 464/tcp — Kerberos password change.

Database:

• 1433/tcp — Microsoft SQL Server.
• 1521/tcp — Oracle Database.
• 3306/tcp — MySQL.
• 5432/tcp — PostgreSQL.
• 27017/tcp — MongoDB.
• 6379/tcp — Redis. No authentication by default — frequently exposed to the internet.

DNS and Network Services:

• 53/tcp, 53/udp — DNS (Domain Name System). Both TCP and UDP are used; UDP for queries, TCP for zone transfers and large responses.
• 67/udp, 68/udp — DHCP (Dynamic Host Configuration Protocol).
• 69/udp — TFTP (Trivial File Transfer Protocol). No authentication — used for network boot.
• 123/udp — NTP (Network Time Protocol). Can be abused for amplification attacks.
• 161/udp, 162/udp — SNMP (Simple Network Management Protocol). Community strings are plaintext — SNMPv1 and v2c should not be used.

Remote Management and Infrastructure:

• 161/udp — SNMP. Community strings act as plaintext passwords.
• 514/udp — Syslog. Plaintext log transmission.
• 514/tcp — Syslog over TCP (more reliable, still plaintext).
• 2375/tcp, 2376/tcp — Docker API. 2375 is unencrypted, 2376 is TLS.
• 6443/tcp — Kubernetes API server.
• 10250/tcp — Kubernetes kubelet API.

Encrypted vs. Plaintext: The Security Distinction

The most important security distinction between protocols is whether they transmit data in plaintext or encrypted:

The rule: any protocol that transmits credentials or sensitive data in plaintext is a security risk. Replace Telnet with SSH, FTP with SFTP, HTTP with HTTPS, LDAP with LDAPS, and SNMPv2c with SNMPv3.

Using Port Knowledge Defensively

Knowing ports is not just about memorization — it is about using that knowledge to design defenses and detect anomalies.

Default-Deny Firewall Design

The fundamental principle of firewall configuration is default deny: block all traffic by default, then allow only what is explicitly required. This is the opposite of the legacy approach (allow all, block known bad) which is ineffective because you cannot enumerate all bad traffic.

A well-designed firewall rule set for a web server:

# iptables example: default-deny inbound, allow only required ports
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Allow established connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow loopback
iptables -A INPUT -i lo -j ACCEPT

# Allow SSH from management network only
iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/24 -j ACCEPT

# Allow HTTP and HTTPS from anywhere
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Log and drop everything else
iptables -A INPUT -j LOG --log-prefix "DROP: "
iptables -A INPUT -j DROP

Notice what is NOT allowed: Telnet (23), FTP (21), MySQL (3306), Redis (6379). The web server does not need these services, so they are blocked. If an attacker compromises the web server and tries to pivot to the database on port 3306, the firewall blocks the connection.

Non-Standard Ports as an Indicator of Compromise

Attackers often run services on non-standard ports to evade detection. If you see SSH running on port 2222 instead of 22, or a web server on port 8080 instead of 80, it may be:

1. Legitimate: A system administrator moved the service to a non-standard port for security through obscurity (weak but sometimes used).
2. Malicious: An attacker installed a backdoor on a non-standard port to avoid detection by security tools that only monitor standard ports.

# Find all listening ports and the processes that own them
netstat -tlnp
# On Linux, look for services on unexpected ports
ss -tlnp | grep -v -E ':(22|80|443|53) '

The key is to know what SHOULD be running on each port and investigate deviations. A service on port 4444 (default for Metasploit's Meterpreter) or port 1337 (common backdoor port) is almost certainly malicious.

Port Scanning: How Attackers Use Port Knowledge

Attackers use port scanning to discover what services are running on a target. The most common scan types:

# SYN scan (half-open, stealthy — does not complete the TCP handshake)
nmap -sS target.example.com

# Connect scan (completes the handshake, more detectable but more reliable)
nmap -sT target.example.com

# Service version detection (probes each open port for version info)
nmap -sV target.example.com

# Scan all 65535 ports (attackers do this — you should too)
nmap -p- target.example.com

The output tells the attacker exactly which services are running and often which versions. If the attacker sees Apache 2.4.49, they know to try CVE-2021-41773 (path traversal). This is why patching and version detection are critical — the attacker will find and exploit known vulnerabilities.

Detecting Unauthorized Services

To detect services that should not be running:

1. Baseline: Document which ports should be open on each host. This is your known-good state.

2. Scan regularly: Use nmap or a vulnerability scanner to compare actual open ports against the baseline.

3. Monitor network flow: Use NetFlow, sFlow, or a network detection and response (NDR) tool to detect traffic on unexpected ports.

4. Alert on deviations: If a port that was closed last week is now open, investigate immediately.

# Quick check: what is listening on this host?
netstat -tlnp

# Check for services on high ports (potential backdoors)
netstat -tlnp | awk '$4 ~ /:([0-9]{4,5})$/'

Common Port-Based Attack Patterns

• Port 23 (Telnet): Brute-force attacks against IoT devices and routers with default credentials.
• Port 445 (SMB): EternalBlue exploit (WannaCry, NotPetya), pass-the-hash attacks.
• Port 3389 (RDP): Brute-force attacks, BlueKeep exploit (CVE-2019-0708).
• Port 6379 (Redis): Unauthenticated access, write SSH keys to gain remote access.
• Port 27017 (MongoDB): Unauthenticated access, ransomware that deletes databases and demands payment.
• Port 9200 (Elasticsearch): Unauthenticated access, data exfiltration.
• Port 2375 (Docker API): Unauthenticated container escape, cryptomining.

The pattern: services that are exposed to the internet without authentication or with default credentials. The fix is never to expose management interfaces to the internet — use a VPN or bastion host for remote access.