The IT Handbook
  1. 1Pick your pathSkirmish or Campaign
  2. 2Choose your classRoadmaps
  3. 3Learn your first spellsCheat sheetsYou are here
  4. 4Train at campHome lab
  5. 5Face the trialInterviews
  6. 6Join the guildThe Friday newsletter

← All cheat sheets

Network

Ports and protocols worth knowing

A port is a numbered door on a computer. The protocol says what kind of traffic uses it, and the transport says how it travels: TCP checks that everything arrives, and UDP skips the checks to stay fast. Search by number or name, or pick a category.

PortProtocolTransportWhat it is for
20, 21FTPTCPOld, unencrypted file transfer. Port 21 carries the commands and port 20 carries the data in active mode.
22SSHTCPEncrypted command-line access to servers and network gear. It also carries SCP and SFTP.
22SFTPTCPFile transfer tunnelled through SSH. It is a separate protocol from FTP and does not work with FTP servers.
25SMTPTCPDelivers mail from server to server across the internet.
49TACACS+TCPCisco-originated sign-in, permissions and logging for network devices, known as AAA.
53DNSUDP and TCPTurns names into IP addresses. Most queries use UDP, and large answers and zone transfers use TCP.
67, 68DHCPUDPHands out IP addresses and settings automatically. The server listens on 67 and the client on 68.
80HTTPTCPUnencrypted web traffic.
88KerberosTCP and UDPTicket-based sign-in that Active Directory uses.
110POP3TCPDownloads mail from a server to one device, usually removing it from the server.
123NTPUDPKeeps clocks in sync. Accurate time matters for Kerberos and for log timelines.
139NetBIOS session (SMB)TCPLegacy Windows file sharing. Modern systems use port 445, and the NetBIOS name and datagram services use UDP 137 and 138.
143IMAPTCPReads mail that stays on the server, so several devices see the same inbox. Unencrypted unless upgraded.
161, 162SNMPUDPMonitors and manages network devices. Queries use 161 and alerts called traps use 162.
389LDAPTCP and UDPLooks up and edits directory data such as Active Directory. It is mostly TCP.
443HTTPSTCPWeb traffic encrypted with TLS. HTTP/3 also uses UDP on this port.
443SSTPTCPA Microsoft VPN carried inside HTTPS, so it passes most firewalls.
445SMBTCPWindows file and printer sharing.
465SMTPS (implicit TLS)TCPMail submission encrypted from the first packet. RFC 8314 made this port official again for submission.
500IPsec (ISAKMP or IKE)UDPSets up the keys for IPsec VPNs. NAT traversal uses UDP 4500.
587SMTP submissionTCPWhere mail clients send outgoing mail. It starts plain and upgrades to TLS with STARTTLS.
636LDAPSTCPLDAP encrypted with TLS.
989, 990FTPSTCPFTP encrypted with TLS. Explicit FTPS can also run on port 21.
993IMAPSTCPIMAP encrypted with TLS.
995POP3STCPPOP3 encrypted with TLS.
1701L2TPUDPA VPN tunnel with no encryption of its own, so it is paired with IPsec.
1723PPTPTCPAn old VPN protocol that also uses GRE, the IP protocol 47. It is considered insecure, so avoid it.
1812, 1813RADIUSUDPCentral sign-in, permissions and logging for Wi-Fi, VPN and switches. Port 1812 handles sign-in and 1813 handles accounting.
3389RDPTCPWindows Remote Desktop. It also uses UDP for better performance.
3868DiameterTCPThe successor to RADIUS, common in carrier networks.
5004SRTPUDPEncrypted audio and video streaming. The actual port is often negotiated, so 5004 is only the usual default for RTP.
8006Proxmox web interfaceTCPThe management page of a Proxmox host, which is where a home lab usually starts.