Common Ports You Must Know

22/TCP is SSH. In logs it is brute-force background radiation on any 0.0.0.0 listener facing a network. In firewalls it is the hole you punch for admin — and the hole ransomware operators pray you punched from 0.0.0.0/0. A 22 that binds only 127.0.0.1 is a local jump, not a WAN door. Same number, opposite tickets. 53 is DNS, usually UDP for small queries, TCP when answers grow or when zone transfers happen in environments that still allow them. Blocking 53 outbound without offering a resolver makes every app look dead while ping-by-IP still works. Allowing 53 to the world on a workstation is rarely the intent; a LISTEN on 0.0.0.0:53 might be a local recursive, malware, or a container — worth identifying, not ignoring because "DNS is normal." 80/TCP is HTTP, the postcard. 443/TCP is HTTPS, the envelope. Firewalls that "allow web" mean 80 and 443; attackers who "look like web" also love 443 because it blends in. A forgotten 80 vhost can still set cookies in cleartext. 443 on a phishing name still has a padlock. The port tells you the channel class, not the operator's morals.

25/TCP is SMTP relay between mail systems. Unexpected 25 listeners on a laptop are a finding (spam zombie or a forgotten MTA). Many ISPs block outbound 25; that is anti-spam, not a broken internet. 587/TCP is submission: a client authenticates and hands mail to its provider, usually with STARTTLS. If you allow 587 off a subnet, you are allowing people to send mail through whatever they authenticated as — a different policy than "allow 25 to the world" (open relay territory). 993/TCP is IMAPS, encrypted mailbox access. 143 would be the cleartext cousin; you are not required to memorize every vintage mail port, but 993 in a firewall rule means "email clients may sync." It does not mean the messages are non-phishing. Encryption of the IMAP channel ≠ authenticity of the sender.

3389/TCP is RDP. In incident response it is one of the loudest initial-access ports on Windows estates: exposed RDP plus stolen passwords is a cliché because it still works. A home lab VM with 3389 on 0.0.0.0 attached to a bridged NIC is a different risk than 3389 on 127.0.0.1 behind your own SSH tunnel. 3306/TCP is MySQL/MariaDB. 5432/TCP is PostgreSQL. Databases almost never need to listen on all interfaces of a laptop. 0.0.0.0:3306 on a café Wi-Fi is how class projects become other people's data. 127.0.0.1:5432 is "only local processes, including your app on the same box." 8080/TCP is the unofficial "I started a Java/dev server and forgot." It is not a magic protocol; it is HTTP (or something HTTP-like) on a high port so it does not need root for 80. Treat unexpected 8080 like unexpected 80, then check the bind address.

You are not collecting a museum of numbers. You are practicing triage sentences: "This is 443/TCP on 127.0.0.1 — local HTTPS only." "This is 22/TCP on 0.0.0.0 — SSH on every IPv4 NIC; firewall may still filter, but the process accepted the bind." Three lines. Your machine. Then stop.

ss -tuln

# Cheat-sheet (do not nmap these on other people)
# 22/tcp   SSH
# 53/udp   DNS (sometimes 53/tcp)
# 80/tcp   HTTP
# 443/tcp  HTTPS
# 25/tcp   SMTP relay
# 587/tcp  mail submission
# 993/tcp  IMAPS
# 3389/tcp RDP
# 3306/tcp MySQL
# 5432/tcp PostgreSQL
# 8080/tcp leftover HTTP-ish dev server

mkdir -p "$HOME/cyberlium-lab"
{
  echo 'Three LISTEN lines (copy from ss):'
  echo '1) port / proto / bind / likely service / who can connect'
  echo '2)'
  echo '3)'
  echo
  ss -tuln
} > "$HOME/cyberlium-lab/common-ports-ss.txt"
chmod 600 "$HOME/cyberlium-lab/common-ports-ss.txt"

# NEVER: nmap school/work/neighbors for "the list"
# NEVER: bind a database to 0.0.0.0 to make the screenshot prettier
# NEVER: confuse "I memorized 3389" with "I checked 127.0.0.1 vs 0.0.0.0"

You now treat a short port list as triage language: SSH, DNS, HTTP/HTTPS, mail relay vs submission vs IMAPS, RDP, two databases, and leftover 8080 — always plus bind address. You refused the 100-port dump. Next — Lab — Port & Connection Check — you will use ss and a localhost-only python HTTP server (and nc to 127.0.0.1) to prove a door opens, then shut it. Never nmap the LAN.