Port Numbers (Hints)

FTP

TCP 20/21 – File Transfer Protocol. Port 21 is the control connection; Port 20 is the data connection (active mode).

SSH

TCP 22 – Secure remote login and secure file transfers (SCP/SFTP).

Telnet

TCP 23 – Unencrypted remote terminal access.

SMTP

TCP 25 – Sends email between mail servers.

DNS

TCP/UDP 53 – Resolves domain names to IP addresses. UDP is used for most queries; TCP is used for zone transfers and large responses.

DHCP Server

UDP 67 – DHCP server listens for client requests.

DHCP Client

UDP 68 – DHCP client receives IP configuration from the server.

TFTP

UDP 69 – Trivial File Transfer Protocol used for simple file transfers and network booting.

HTTP

TCP 80 – Unencrypted web traffic.

POP3

TCP 110 – Downloads email from a mail server.

NTP

UDP 123 – Synchronizes time across network devices.

IMAP

TCP 143 – Accesses email while keeping messages on the mail server.

SNMP

UDP 161 – Used to monitor and manage network devices.

SNMP Trap

UDP 162 – Sends alerts (traps) from devices to the SNMP manager.

LDAP

TCP/UDP 389 – Accesses directory services such as Active Directory.

HTTPS

TCP 443 – Encrypted web traffic using TLS.

SMB

TCP 445 – Windows file and printer sharing.

Syslog

UDP 514 – Sends log messages to a centralized Syslog server.

SMTPS

TCP 465 – Secure SMTP using TLS.

IKE

UDP 500 – Internet Key Exchange used to establish IPsec VPNs.

LDAPS

TCP 636 – Secure LDAP using TLS.

IMAPS

TCP 993 – Secure IMAP using TLS.

POP3S

TCP 995 – Secure POP3 using TLS.

Microsoft SQL Server

TCP 1433 – Microsoft SQL Server database connections.

Oracle SQLNet

TCP 1521 – Oracle database connections.

L2TP

UDP 1701 – Layer 2 Tunneling Protocol used for VPNs.

PPTP

TCP 1723 – Point-to-Point Tunneling Protocol (legacy VPN).

RDP

TCP/UDP 3389 – Remote Desktop Protocol for remote Windows access.