GO KALI FREE
BeginnerNetworking

Ports and Protocols: Understanding Network Communication

Learn about network ports, their numbering system, common protocols at each layer, how services use ports, and security implications.

#ports#protocols#TCP#UDP#networking#service enumeration

Mapping Services with Network Ports

Every open port on a target is a potential entry point. Port scanning is one of the first things you will do in any security assessment, and understanding the port numbering system, common service mappings, and how firewalls filter ports is fundamental. This guide gives you a practical reference for working with ports in security contexts.

Prerequisites

Basic understanding of IP addressing and TCP/IP. Familiarity with the OSI model is helpful.

Port Number Ranges

Well-Known Ports (0-1023)

Reserved for system services. Require root/admin privileges. Assigned by IANA to core internet services.

Registered Ports (1024-49151)

Can be registered with IANA for specific applications. Used by enterprise and proprietary software.

Dynamic/Private Ports (49152-65535)

Ephemeral ports dynamically assigned to client applications for temporary communication. Your browser uses a random ephemeral port when connecting to a web server.

Common Protocols and Ports

Web

| Port | Protocol | Transport | Description |

|------|----------|-----------|-------------|

| 80 | HTTP | TCP | Unencrypted web |

| 443 | HTTPS | TCP | Encrypted web (TLS) |

| 8080 | HTTP Alt | TCP | Alternate HTTP (proxies) |

| 8443 | HTTPS Alt | TCP | Alternate HTTPS |

Remote Access

| Port | Protocol | Transport | Description |

|------|----------|-----------|-------------|

| 22 | SSH | TCP | Secure remote administration |

| 23 | Telnet | TCP | Unencrypted remote terminal (obsolete) |

| 3389 | RDP | TCP | Windows Remote Desktop |

| 5900 | VNC | TCP | Remote desktop (cross-platform) |

Email

| Port | Protocol | Transport | Description |

|------|----------|-----------|-------------|

| 25 | SMTP | TCP | Outgoing mail |

| 587 | SMTP Sub | TCP | SMTP with authentication |

| 110 | POP3 | TCP | Incoming mail |

| 143 | IMAP | TCP | Incoming mail (with folders) |

| 993 | IMAPS | TCP | IMAP over SSL |

File Transfer

| Port | Protocol | Transport | Description |

|------|----------|-----------|-------------|

| 21 | FTP | TCP | File Transfer Protocol (control) |

| 20 | FTP | TCP | FTP data channel |

| 445 | SMB | TCP | Windows file sharing |

| 2049 | NFS | TCP/UDP | Network File System |

Databases

| Port | Protocol | Transport | Description |

|------|----------|-----------|-------------|

| 3306 | MySQL | TCP | MySQL database |

| 5432 | PostgreSQL | TCP | PostgreSQL |

| 1433 | MSSQL | TCP | Microsoft SQL Server |

| 27017 | MongoDB | TCP | MongoDB |

| 6379 | Redis | TCP | Redis key-value store |

Infrastructure

| Port | Protocol | Transport | Description |

|------|----------|-----------|-------------|

| 53 | DNS | TCP/UDP | Domain Name System |

| 67/68 | DHCP | UDP | IP address assignment |

| 161 | SNMP | UDP | Network monitoring |

| 123 | NTP | UDP | Time synchronization |

How Ports Work in Practice

Client-Server Communication

When browsing a website: browser picks ephemeral port (e.g., 54321), connects to server's port 443, server responds to ephemeral port. Connection uniquely identified by: (source IP, source port, dest IP, dest port).

Service Binding

ss -tulpn    # Shows listening services and their ports
# tcp   LISTEN  0.0.0.0:22     # SSH
# tcp   LISTEN  0.0.0.0:80     # HTTP (nginx)
# tcp   LISTEN  0.0.0.0:443    # HTTPS (nginx)

Port Scanning

nmap -sS 192.168.1.1                    # Default scan
nmap -p 22,80,443,3306 192.168.1.1      # Specific ports
nmap -p- 192.168.1.1                    # All 65535 ports
nmap -sV 192.168.1.1                    # Service version detection
nmap --top-ports 1000 192.168.1.1       # Most common ports

Port Security

Every open port is a potential entry point. Each port has a service that may have vulnerabilities.

Firewall best practice: Allow only necessary ports.

sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT   # SSH only
sudo iptables -A INPUT -j DROP                        # Default deny

Port Knocking: Hide services by requiring connection attempts to a sequence of closed ports before opening the real port.

Service-Specific Security: SSH (disable root, use keys). MySQL (bind to localhost). HTTP (redirect to HTTPS). RDP (use VPN + NLA).

Real-World Examples

Suspicious Ports: Unexpected ports like 4444 (Metasploit), 31337 (Back Orifice), or 6667 (IRC/botnet C2) may indicate compromise.

Port Forwarding: ssh -L 8080:internal:80 user@gateway forwards local port 8080 to internal web server through SSH.

Common Mistakes

Using well-known ports for custom services. Assuming a port guarantees a specific service — always verify with version detection. Forgetting UDP ports (DNS, SNMP, DHCP).

Best Practices

Default deny firewall policy. Use version detection to confirm services. Monitor for unexpected open ports. Segment networks. Regular infrastructure port scanning.

Related Tools

nmap — Port scanner. netcat — Manual port testing. ss/netstat — Local listening ports. lsof — Processes using ports. masscan — High-speed scanning.

Related Articles

  • networking-basics
  • osi-model-explained
  • firewall-fundamentals
  • nmap-beginner-tutorial
  • network-scanning-nmap-beginners

    • Summary

    Ports (0-65535) direct traffic to services on a host. Well-known (0-1023) for core services, registered (1024-49151) for applications, dynamic (49152-65535) for ephemeral client connections. Every open port is a potential attack vector. Understanding ports is essential for network admin, firewall config, and security assessment.

    Knowledge Check

  • What are the three port number ranges?
  • What port does HTTPS use?
  • What is the difference between well-known and ephemeral ports?
  • How do you check listening ports on Linux?
  • Why is port 22 important for security?

    • Frequently Asked Questions

    What are network ports and how do they work?

    Network ports are virtual endpoints (numbers 0-65535) that direct incoming traffic to the correct application on a server. When combined with an IP address, a port identifies a specific service — for example, port 443 on 192.168.1.10 points to the web server running there. See our [Networking Basics](/articles/networking-basics) guide for deeper context.

    What is the difference between TCP and UDP ports?

    TCP ports use connection-oriented communication with guaranteed delivery, while UDP ports are connectionless and best-effort. Web servers (port 80/443) use TCP for reliable data transfer, whereas DNS (port 53) and DHCP (port 67/68) often use UDP for speed. The [Networking Basics](/articles/networking-basics) article explains this distinction in detail.

    What are well-known ports vs ephemeral ports?

    Well-known ports (0-1023) are reserved for system services like HTTP (80) and SSH (22) and require root privileges. Ephemeral ports (49152-65535) are dynamically assigned to client applications for temporary connections — your browser uses one when connecting to a web server. Registered ports (1024-49151) sit in between for application-specific services.

    How do I check which ports are open on my Linux system?

    Use `ss -tulpn` to list all listening TCP and UDP ports with the programs attached. Alternatively, `netstat -tulpn` works on older systems. For scanning a remote host, Nmap with `nmap -sV target.com` provides service version detection on open ports.

    What port does HTTPS use and why?

    HTTPS uses port 443 by default. This is the encrypted counterpart to HTTP on port 80, using TLS to protect data in transit. All modern browsers default to port 443 for secure connections, and firewalls should allow this port for web traffic.

    How does port scanning work and is it legal?

    Port scanning sends probes to target ports to determine which are open, closed, or filtered. Tools like Nmap perform this systematically. Scanning your own systems or systems with explicit written permission is legal and essential for security assessment — unauthorized scanning is illegal under the CFAA.

    What is port 4444 used for and why is it suspicious?

    Port 4444 is the default listening port for Metasploit's reverse shells. Finding it open on a system you did not configure is a strong indicator of compromise. Other suspicious ports include 31337 (Back Orifice) and 6667 (IRC, often used for botnet C2).

    How do I secure open ports on my server?

    Apply a default-deny firewall policy using `iptables` or `ufw`, allowing only necessary ports. For SSH (port 22), disable root login and use key-based authentication. Bind database ports like MySQL (3306) to localhost. Consider [port knocking](https://en.wikipedia.org/wiki/Port_knocking) to hide services entirely.

    What is the difference between port 21 and port 20 in FTP?

    Port 21 is the FTP control channel used for authentication and command transfer, while port 20 is the data channel used for actual file transfers. Because both transmit data in plaintext, FTP is inherently insecure — SFTP (using port 22) is the recommended alternative for secure file transfer.

    How do I scan for UDP ports?

    UDP scanning is slower because open ports rarely respond. Use `nmap -sU target.com` for UDP scans, or `nmap -sU --top-ports 100` to scan the most common 100 UDP ports. Services like DNS (53), SNMP (161), and DHCP (67/68) operate over UDP and should not be overlooked.

    What is port knocking and when should I use it?

    Port knocking requires clients to send connection attempts to a specific sequence of closed ports before the real service port is opened. This hides services from port scanners. It is useful for securing SSH or admin interfaces on internet-facing servers, but adds operational complexity.

    How do firewall rules relate to port security?

    Firewalls enforce which ports are accessible from the network. A well-configured firewall blocks all unnecessary ports, reducing the attack surface. For example, `sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT` allows only SSH, while a default DROP rule blocks everything else.