Protocols and Ports Cheat Sheet

A practical reference to the network protocols and port numbers you will meet most often, grouped by the layer they work at, with a note on which ones are encrypted.

~19 min Beginner

Why learn this list

You do not need to memorise a hundred protocols. About a dozen of them show up again and again: in firewall rules, in logs, in troubleshooting and in job interviews. If you recognise them at a glance, you will find any network easier to read.

Do not try to learn the list in one sitting. Read it once, then come back whenever you meet a number you do not know.

Application layer: the services you use

HTTP (port 80): web pages
HTTPS (port 443): web pages, encrypted
DNS (port 53): names to addresses
DHCP (UDP 67 and 68): automatic address assignment
SSH (port 22): secure remote command line
FTP (ports 20 and 21): file transfer, not encrypted
SFTP (port 22): file transfer over SSH, encrypted
SMTP (port 25, and 587 for sending from a mail client): sending email
POP3 (port 110) and IMAP (port 143): reading email from a server
Telnet (port 23): old remote login, not encrypted
RDP (port 3389): Windows remote desktop
SMB (port 445): Windows file sharing

Transport layer

TCP: reliable and connection-based. It is used by web, email, SSH and file transfer.
UDP: fast and connectionless. It is used by DNS queries, video calls, games and DHCP.

Network layer

IP: addressing and routing between networks.
ICMP: error messages and diagnostics. This is what ping and traceroute use.

Data link layer

Ethernet: wired local networks.
ARP: finds the MAC address that belongs to an IP address.
802.11: WiFi.

Port number ranges

0 to 1023: well-known ports. Standard services such as 22, 53, 80 and 443 use them.
1024 to 49151: registered ports. Applications such as databases use them, for example MySQL on 3306 and PostgreSQL on 5432.
49152 to 65535: dynamic ports. Your computer picks one for its own end of each connection.

When you see a database port in a firewall rule, it tells you what kind of server you are dealing with.

Encrypted or not

This is the part that matters for security. Some protocols send everything as plain text, and anyone on the path can read it.

Plain text (avoid for anything private): HTTP, FTP, Telnet, POP3, plain IMAP, plain SMTP
Encrypted (prefer): HTTPS, SSH, SFTP, IMAPS (port 993), SMTPS (port 465)

If a service handles passwords or private data, use its encrypted version.

The encrypted replacement often has a similar name. Telnet was replaced by SSH, FTP by SFTP and HTTP by HTTPS.

How to use this in real life

Reading a firewall rule such as "allow tcp/443"? That is HTTPS.
Port 3389 open to the internet? That is RDP, and attackers scan for it constantly. Question why it is open.
Port 23 open? That is Telnet. It should almost always be replaced by SSH.
Troubleshooting email? Check 587 for sending and 993 for secure IMAP.

Reading a real list of listening ports

$ ss -tuln
Netid State   Local Address:Port
tcp   LISTEN  0.0.0.0:22         SSH, reachable from anywhere
tcp   LISTEN  127.0.0.1:3306     MySQL, this computer only
udp   UNCONN  0.0.0.0:68         DHCP client

0.0.0.0 means the service listens on every address, so other computers can connect. 127.0.0.1 means it listens on this computer only, so nothing from the network can reach it. A database that listens on 127.0.0.1 is therefore much safer than one that listens on 0.0.0.0.

A way to remember them

Group ports by purpose instead of learning each one alone:

Web: 80, 443
Names: 53
Remote access: 22, 23, 3389
Email: 25, 110, 143
File sharing: 21, 22, 445

That covers nearly everything a beginner needs.

Sign up to track your progress Mark lessons as read and pick up where you left off Sign up free to unlock this practice Your first practice lesson is free to try. Create an account to unlock the rest and save your progress

Previous Cloud Networking Basics Next What to Learn Next