Common Ports & Protocols
A+ Exam · Google IT Cert · Networking fundamentals
File Transfer & Remote Access
| Port | Protocol | Service | Memory Hook |
|---|---|---|---|
| 20 | TCP | FTP — Data transfer | 20 moves the data — "2 computers passing files" |
| 21 | TCP | FTP — Control / commands | 21 is the boss — commands and control; 20 does the work |
| 22 | TCP | SSH / SFTP / SCP | "22 = two locks" — Secure Shell, everything encrypted |
| 23 | TCP | Telnet | 23 = old, plaintext, insecure — replaced by SSH (22) |
| 3389 | TCP/UDP | RDP — Remote Desktop Protocol | "33-89 = Remote Desktop" — Windows remote GUI access |
| Port | Protocol | Service | Memory Hook |
|---|---|---|---|
| 25 | TCP | SMTP — Sending mail (server-to-server) | "Send Mail To People" — 25 letters in the alphabet (minus 1) |
| 110 | TCP | POP3 — Retrieve & delete from server | POP3 = 110; "Point Of Pickup" — grabs mail and removes it from server |
| 143 | TCP | IMAP — Sync mail, stays on server | "I MAP 143" — syncs across devices, mail lives on server |
| 465 / 587 | TCP | SMTPS / SMTP+STARTTLS (secure sending) | 587 = "Submit" — modern secure outbound; 465 = legacy SMTPS |
| 993 | TCP | IMAPS — IMAP over SSL/TLS | 993 = secure IMAP — same sync behavior as 143, but encrypted |
| 995 | TCP | POP3S — POP3 over SSL/TLS | 995 = secure POP3 — same grab-and-go as 110, but encrypted |
Web & Proxy
| Port | Protocol | Service | Memory Hook |
|---|---|---|---|
| 80 | TCP | HTTP — Unencrypted web | "80 = HTTP" — standard web, no padlock |
| 443 | TCP/UDP | HTTPS — Encrypted web (TLS) | "443 = padlock" — HTTPS, the secure web; UDP for HTTP/3 (QUIC) |
| 8080 | TCP | HTTP Alternate / Web proxy | 8080 = 80 doubled — common for dev servers and HTTP proxies |
Network Services
| Port | Protocol | Service | Memory Hook |
|---|---|---|---|
| 53 | TCP/UDP | DNS — Domain name resolution | "53 = DNS" — UDP for queries, TCP for zone transfers |
| 67 | UDP | DHCP — Server (assigns IPs) | 67 = server listens; "6 + 7 = 13 = unlucky without an IP" |
| 68 | UDP | DHCP — Client (requests IPs) | 68 = client; 67 server, 68 client — one apart, always together |
| 123 | UDP | NTP — Network Time Protocol | "123 = time" — counts up like a clock: 1, 2, 3! |
| 161 | UDP | SNMP — Polling (manager queries device) | "161 = SNMP" — Simple Network Management Protocol queries |
| 162 | UDP | SNMP Trap — Device alerts manager | 162 = trap; device pushes alert to manager — 161 + 1 = triggered |
File Sharing & Directory Services
| Port | Protocol | Service | Memory Hook |
|---|---|---|---|
| 389 | TCP/UDP | LDAP — Directory lookup (Active Directory) | "389 = LDAP" — Lightweight Directory Access Protocol; 3-8-9 = find the user |
| 445 | TCP | SMB / CIFS — Windows file & printer shares | "445 = Samba" — Windows networking; think 4 + 4 + 5 = shared drives |
| 636 | TCP/UDP | LDAPS — LDAP over SSL/TLS | 636 = secure LDAP — same directory lookup as 389, encrypted |