Networking › Module 4 › Lesson 2
Common Ports You Must Know
Essential port numbers for triage, firewalls, and exams
Opening
Ports are service door numbers
An IP address finds the host; a port finds the service. When logs show traffic to port 3389 at 3 a.m., you need instant recognition. These well-known ports appear in firewall rules, scan results, and interview questions.
1. Remote Access and Admin
22 / TCPSSH — encrypted shell and file transfer
SSH — encrypted shell and file transfer
23 / TCPTelnet — plaintext remote login (avoid)
Telnet — plaintext remote login (avoid)
3389 / TCPRDP — Windows Remote Desktop
RDP — Windows Remote Desktop
2. Web and DNS
53 / TCP+UDPDNS — name resolution
DNS — name resolution
80 / TCPHTTP — unencrypted web
HTTP — unencrypted web
443 / TCPHTTPS — TLS-encrypted web
HTTPS — TLS-encrypted web
3. Email
25 / TCPSMTP — mail relay between servers
SMTP — mail relay between servers
110 / TCPPOP3 — download mail (plain)
POP3 — download mail (plain)
143 / TCPIMAP — sync mail on server (plain)
IMAP — sync mail on server (plain)
993 / TCPIMAPS — IMAP over TLS
IMAPS — IMAP over TLS
995 / TCPPOP3S — POP3 over TLS
POP3S — POP3 over TLS
4. Files and Other Essentials
21 / TCPFTP control channel
FTP control channel
445 / TCPSMB — Windows file sharing
SMB — Windows file sharing
3306 / TCPMySQL database
MySQL database
5432 / TCPPostgreSQL database
PostgreSQL database
Memorize in groups
Learn web (80/443), remote access (22/3389), DNS (53), and mail (25/143/993) first. When triaging ss -tuln output, unexpected listeners on these ports deserve immediate attention.
Knowledge Check
Which port is standard for HTTPS?
Multiple choice
Knowledge Check
RDP (Remote Desktop) commonly listens on:
Multiple choice
Knowledge Check
DNS typically uses port:
Multiple choice