Port numbers are useful clues, not proof of what an application is doing. Services can be moved to nonstandard ports, several protocols negotiate additional connections, and encrypted traffic can conceal the application from a simple port-based inspection.

This reference lists common exam and operational defaults. It uses a certification-neutral address so the same page can support both Network+ and Security+ without maintaining two disconnected port lists.

Read the whole scenario. TCP 22 suggests SSH, SFTP, or SCP. The requested action tells you which one fits.

Port basics

Range IANA category What it usually means
0 Reserved Not assigned as a usable service port.
1-1023 System ports Commonly called well-known ports.
1024-49151 User ports Commonly called registered ports.
49152-65535 Dynamic or private ports Often used as temporary client-side or application-selected ports.
  • TCP establishes a connection and provides ordered, reliable delivery.
  • UDP sends independent datagrams with less transport overhead and no delivery guarantee.
  • A client normally connects from a temporary source port to the service's destination port.
  • A firewall rule should account for direction, transport, state, source, destination, and business need, not just the number.

Searchable online reference

Search the live reference at CertHappens.com/ports-protocols/.

Web and file transfer

Service Port Transport Purpose and security clue
FTP data 20 TCP Active-mode FTP data connection FTP is plaintext. Passive mode uses a negotiated high port instead of TCP 20.
FTP control 21 TCP FTP commands and session control Credentials and data are plaintext unless the session is upgraded with TLS.
SSH, SFTP, and SCP 22 TCP Encrypted remote shell and SSH-based file transfer SFTP and SCP use SSH. They do not use the FTP ports.
Telnet 23 TCP Remote terminal access Plaintext. Prefer SSH for remote administration.
TFTP 69 UDP Simple file transfer, often for boot or device configuration No built-in authentication or encryption.
HTTP 80 TCP Unencrypted web traffic Content and credentials are exposed unless another protection layer is used.
HTTPS 443 TCP / UDP HTTP protected by TLS HTTP/1.1 and HTTP/2 commonly use TCP. HTTP/3 uses QUIC over UDP.
Implicit FTPS data 989 TCP TLS-protected FTP data channel Implicit FTPS begins with TLS. Explicit FTPS normally starts on TCP 21.
Implicit FTPS control 990 TCP TLS-protected FTP control channel Do not confuse FTPS with SFTP, which uses SSH on TCP 22.

Email

Service Port Transport Purpose and security clue
SMTP relay 25 TCP Mail transfer between servers STARTTLS may protect transport, but policy and certificate validation still matter.
POP3 110 TCP Download mail to a client Plaintext unless upgraded with TLS.
IMAP 143 TCP Access and synchronize server-hosted mail Plaintext unless upgraded with TLS.
Submissions 465 TCP Mail submission using implicit TLS The TLS session begins before SMTP commands are exchanged.
Message submission 587 TCP Authenticated client-to-server mail submission Commonly protected with STARTTLS.
IMAPS 993 TCP IMAP using implicit TLS Protects mail access in transit.
POP3S 995 TCP POP3 using implicit TLS Protects mail retrieval in transit.

Name, address, and time services

Service Port Transport Purpose and security clue
DNS 53 UDP / TCP Name resolution and DNS data exchange UDP is common for queries. TCP is used for zone transfers and responses that need it.
DHCPv4 server 67 UDP Receive client requests and provide IPv4 configuration Rogue DHCP services can redirect or disrupt clients.
DHCPv4 client 68 UDP Receive IPv4 configuration from a DHCP server Client and server use different well-known ports.
NTP 123 UDP Time synchronization Accurate time supports logs, authentication, and investigations. Restrict untrusted sources.
DHCPv6 client 546 UDP Receive IPv6 configuration The client listens on UDP 546.
DHCPv6 server 547 UDP Provide IPv6 configuration and relay service The server and relay side use UDP 547.
DNS over TLS 853 TCP Encrypt DNS traffic with TLS Protects the DNS transport path. DNS over HTTPS commonly uses TCP or UDP 443.

Authentication, directory, and remote management

Service Port Transport Purpose and security clue
TACACS+ 49 TCP Centralized device administration and AAA Separates authentication, authorization, and accounting functions.
Kerberos 88 TCP / UDP Ticket-based network authentication Time synchronization and key distribution are central to Kerberos operation.
LDAP 389 TCP / UDP Directory queries and updates Use TLS protection when credentials or sensitive directory data cross the network.
LDAPS 636 TCP LDAP using implicit TLS Encrypts the directory connection in transit.
RADIUS authentication 1812 UDP Centralized network-access authentication and authorization Traditional RADIUS does not encrypt the entire packet.
RADIUS accounting 1813 UDP Record network-access session activity Accounting is separate from the authentication service.
RDP 3389 TCP / UDP Microsoft remote desktop Use Network Level Authentication, TLS, access controls, and limited exposure.
VNC 5900 TCP Remote graphical desktop Security varies by implementation. A protected tunnel may be needed.

Monitoring, logging, and network management

Service Port Transport Purpose and security clue
SNMP queries 161 UDP Read or change managed-device information Prefer SNMPv3 for authentication and privacy.
SNMP traps and informs 162 UDP Receive unsolicited management notifications The manager receives traps on UDP 162.
Syslog 514 UDP Send event and log messages Traditional UDP syslog provides no confidentiality or delivery guarantee.
NETCONF over SSH 830 TCP Structured network-device configuration and management SSH provides the protected transport.
Syslog over TLS 6514 TCP Protect syslog messages with TLS Adds confidentiality and certificate-based transport protection.

File sharing, storage, and databases

Service Port Transport Purpose and security clue
NetBIOS name service 137 UDP Legacy NetBIOS name registration and lookup Commonly associated with older Windows networking.
NetBIOS datagram service 138 UDP Legacy connectionless NetBIOS traffic Restrict legacy exposure across network boundaries.
NetBIOS session service 139 TCP Legacy session-based Windows file and printer sharing Modern SMB commonly uses TCP 445 directly.
SMB / CIFS 445 TCP Windows file, printer, and named-pipe sharing Limit exposure, use current SMB versions, and require appropriate signing or encryption.
Microsoft SQL Server 1433 TCP Default SQL Server database service Databases may use custom ports. Restrict network access and protect credentials.
Oracle Net listener 1521 TCP Common Oracle database listener The configured listener port can differ.
NFS 2049 TCP / UDP Network file system access Use strong identity controls and restrict exports. Modern deployments commonly use TCP.
iSCSI 3260 TCP Block storage over IP Segmentation, authentication, and protected management reduce storage exposure.
MySQL 3306 TCP Default MySQL database service Do not expose databases broadly. Use TLS and least-privilege accounts.
PostgreSQL 5432 TCP Default PostgreSQL database service Restrict listeners and client networks, then protect authentication and transport.

Voice, VPN, and routing

Service Port Transport Purpose and security clue
BGP 179 TCP Exchange routes between autonomous systems Peer controls and route validation help reduce route leaks and hijacking.
IKE / ISAKMP 500 UDP Negotiate IPsec security associations NAT traversal commonly moves IPsec traffic to UDP 4500.
RIP 520 UDP Exchange IPv4 distance-vector routes RIP has limited scale and should not be accepted from untrusted peers.
RIPng 521 UDP Exchange IPv6 distance-vector routes RIPng is the IPv6 counterpart to RIP.
L2TP 1701 UDP Layer 2 tunneling L2TP does not provide encryption by itself and is often paired with IPsec.
PPTP control 1723 TCP Control a PPTP tunnel PPTP also uses GRE and is considered obsolete for secure remote access.
IPsec NAT traversal 4500 UDP Carry IPsec through NAT Encapsulates IPsec ESP when NAT is present.
SIP 5060 TCP / UDP Establish and control voice or video sessions Signaling is not encrypted by default. RTP media normally uses negotiated dynamic ports.
SIPS 5061 TCP SIP signaling protected by TLS Protecting signaling does not automatically encrypt the RTP media stream.

Protocols without TCP or UDP ports

Some exam distractors turn an IP protocol number into a fake port number. ICMP, GRE, ESP, AH, and OSPF operate directly over IP. ARP operates below IP on the local link.

Protocol Identifier Purpose Exam clue
ICMP IP protocol 1 IPv4 control messages, errors, and diagnostics Ping uses ICMP echo messages, not a TCP or UDP port.
IGMP IP protocol 2 IPv4 multicast group management It operates directly over IP.
GRE IP protocol 47 Generic packet encapsulation PPTP uses TCP 1723 for control and GRE for tunneled payloads.
IPsec ESP IP protocol 50 IPsec confidentiality, integrity, and authentication services With NAT traversal, ESP is encapsulated in UDP 4500.
IPsec AH IP protocol 51 IPsec integrity and authentication without confidentiality AH is an IP protocol number, not port 51.
ICMPv6 IP protocol 58 IPv6 control, diagnostics, and neighbor discovery Blocking it indiscriminately can break essential IPv6 functions.
OSPF IP protocol 89 Link-state interior routing OSPF does not use TCP or UDP.
ARP EtherType 0x0806 Map IPv4 addresses to local-link MAC addresses ARP is a link-layer protocol and has no TCP or UDP port.

Secure and insecure pairs

Plain or legacy choice Protected alternative Difference to remember
Telnet, TCP 23 SSH, TCP 22 SSH protects remote administration with encryption and authentication.
HTTP, TCP 80 HTTPS, TCP or UDP 443 HTTPS adds TLS. HTTP/3 uses QUIC over UDP.
FTP, TCP 20 and 21 SFTP on TCP 22 or FTPS on FTP-related ports SFTP is an SSH protocol. FTPS is FTP protected with TLS.
LDAP, TCP or UDP 389 LDAPS, TCP 636, or LDAP upgraded with TLS The protected connection reduces exposure of credentials and directory data.
IMAP 143 and POP3 110 IMAPS 993 and POP3S 995 The secure variants begin with TLS.
Syslog, UDP 514 Syslog over TLS, TCP 6514 TLS adds confidentiality and server authentication to log transport.
SNMPv1 or SNMPv2c SNMPv3, usually UDP 161 and 162 The version changes the security properties, not the usual port pair.

Common exam traps

SFTP and FTPS are not the same protocol

SFTP runs through SSH on TCP 22. FTPS adds TLS to FTP and retains FTP's control and data-channel behavior.

DNS uses both UDP and TCP

UDP is common for ordinary queries. TCP is used when the exchange requires it, including traditional zone transfers and responses that do not fit the available UDP path.

A secure protocol can share a familiar port

SNMPv3 normally uses the same UDP 161 and 162 pair as earlier SNMP versions. The version and configuration provide the stronger security.

One application can use more than one connection

FTP separates control and data. SIP negotiates media that normally flows over separate RTP ports. Firewalls and troubleshooting steps must account for the full exchange.

Port numbers do not identify every network protocol

ESP is IP protocol 50, not port 50. OSPF is IP protocol 89, not port 89. GRE is IP protocol 47 even when TCP 1723 controls a PPTP tunnel.

Default does not mean mandatory

Administrators can move services, proxies can front them, and applications can tunnel one protocol inside another. Use the port as evidence, then confirm with configuration, packet details, logs, or application-aware inspection.

Official references

IANA maintains the authoritative service-name and transport-port registry. Certification objectives determine which services belong in a particular exam version, while the registry and protocol standards define the assignments and behavior.

Network+ N10-009 Study Guide Connect services and ports to addressing, implementation, operations, security, and troubleshooting context. Network+ Acronyms and Terms Expand protocol and service abbreviations, then compare their practical roles. Network+ Quick Review Guides Compare monitoring evidence, troubleshooting tools, and switching decisions. Take a randomized N10-009 practice test Apply ports, transports, and service clues in realistic networking scenarios. Security+ SY0-701 Study Guide Follow the complete Security+ roadmap and all five domain guides. Security+ Acronyms and Terms Search the abbreviations used throughout Security+ material. Take a randomized SY0-701 practice test Apply networking and security concepts in fresh scenarios.