N10-009 objective 1.4
CompTIA Network+ ports and protocols
Network+ lists 20 ports and protocols to know: the number, whether it runs over TCP or UDP, and what it does. They're in one table below, grouped by job. The cleartext ones are marked, and there's a quiz at the end.
The same ports drill is free in the course, with all of Domain 1.
Every port on the N10-009 list
| Port | Protocol | TCP or UDP | What it's for |
|---|---|---|---|
| Web | |||
| 80 | HTTPHypertext Transfer ProtocolCleartext | TCP | Unencrypted web traffic. Anyone on the path can read it, which is why sites redirect to HTTPS. |
| 443 | HTTPSHypertext Transfer Protocol SecureEncrypted | TCP | HTTP encrypted with TLS. The default for web traffic, and the port most firewalls leave open outbound. |
| 25 | SMTPSimple Mail Transfer ProtocolCleartext | TCP | Relays mail between mail servers. Without TLS on top, messages cross the network in clear text. |
| 587 | SMTPSSimple Mail Transfer Protocol SecureEncrypted | TCP | Mail submission from a client to its own server, authenticated and encrypted with STARTTLS. |
| File transfer | |||
| 20/21 | FTPFile Transfer ProtocolCleartext | TCP | 21 carries commands and 20 carries data in active mode. Credentials cross in clear text. |
| 22 | SFTPSecure File Transfer ProtocolEncrypted | TCP | File transfer that runs inside an SSH session, which is why it shares port 22 with SSH. |
| 69 | TFTPTrivial File Transfer ProtocolCleartext | UDP | No logins and no directory listing. Used to push configs and firmware to network devices and to boot over PXE. |
| File and print sharing | |||
| 445 | SMBServer Message Block | TCP | Windows file and printer sharing and mapped drives, straight over TCP. Never expose it to the internet. |
| Remote access | |||
| 22 | SSHSecure ShellEncrypted | TCP | Encrypted command-line access to a server or a switch. Replaces Telnet for device management. |
| 23 | TelnetTelnetCleartext | TCP | Remote command line with everything, passwords included, in clear text. Use SSH instead. |
| 3389 | RDPRemote Desktop ProtocolEncrypted | TCP | The graphical Windows remote desktop. Encrypted, but a common attack target when exposed directly. |
| Name and address services | |||
| 53 | DNSDomain Name System | TCP/UDP | Resolves names to IP addresses. Queries use UDP; zone transfers and large replies use TCP. |
| 67/68 | DHCPDynamic Host Configuration Protocol | UDP | The server listens on 67 and clients on 68. A relay (IP helper) forwards requests across routers. |
| Directory services | |||
| 389 | LDAPLightweight Directory Access ProtocolCleartext | TCP | Queries and updates a directory such as Active Directory. Binds travel in clear text unless secured. |
| 636 | LDAPSLightweight Directory Access Protocol over SSLEncrypted | TCP | LDAP inside a TLS session, so directory lookups and binds are encrypted. |
| Network management | |||
| 161/162 | SNMPSimple Network Management Protocol | UDP | The manager polls devices on 161 and devices send traps to it on 162. Only SNMPv3 adds authentication and encryption. |
| 514 | SyslogSyslog | UDP | Ships log messages from devices to a central collector or SIEM. Classic syslog is UDP and unencrypted. |
| 123 | NTPNetwork Time Protocol | UDP | Keeps clocks in step. Log correlation, certificates and Kerberos all break when clocks drift. |
| Database | |||
| 1433 | SQL ServerMicrosoft SQL Server | TCP | The default port for Microsoft SQL Server connections. Keep it reachable only from the servers that need it. |
| Voice and video | |||
| 5060/5061 | SIPSession Initiation Protocol | TCP/UDP | Sets up and tears down VoIP calls. 5060 is unencrypted signaling; 5061 is SIP over TLS. |
Cleartext protocols and their secure replacements
When a scenario asks for an encrypted connection, the answer is usually the secure half of one of these pairs.
| Cleartext | Secure replacement | What changes |
|---|---|---|
| HTTP 80 | HTTPS 443 | Encrypt web traffic with TLS. |
| Telnet 23 | SSH 22 | Replace clear-text remote shells with SSH. |
| FTP 20/21 | SFTP 22 | Move files over SSH instead of clear-text FTP. |
| LDAP 389 | LDAPS 636 | Wrap directory queries and binds in TLS. |
| SMTP 25 | SMTPS 587 | Submit mail over an authenticated, encrypted session. |
Ports that are easy to mix up
- SNMP uses two ports: agents listen on UDP 161 for the manager, and the manager listens on UDP 162 for traps.
- SSH and SFTP both use 22, because SFTP runs inside an SSH session. FTP uses 21 for commands and 20 for data in active mode.
- TFTP (UDP 69) has no login and no encryption. Switches and IP phones use it to pull firmware and config files; anything that needs a login uses FTP or SFTP.
- LDAP is 389 and LDAPS is 636. SMTP relays mail between servers on 25, and SMTPS submits it over an encrypted session on 587.
- Syslog (UDP 514) carries log messages to a collector, and NTP (UDP 123) keeps the clocks those logs depend on in step.
- SIP sets up calls on 5060, or 5061 with TLS. The voice itself travels separately, so a SIP problem and a choppy call are different faults.
Port number ranges
Well-known ports run from 0 to 1023, registered ports from 1024 to 49151, and dynamic (private) ports from 49152 to 65535. A client opens its side of a connection on a random dynamic port, so a firewall rule for a service is written against the destination port. On this list, SQL Server (1433), RDP (3389) and SIP (5060 and 5061) sit in the registered range.
Quiz yourself on the Network+ ports
Ten quick questions on the 20 ports above, or a run through all of them in random order. They ask both ways: the port a protocol uses, and the protocol behind a port.
Questions about the Network+ ports
How many ports do I need to know for Network+ N10-009?
20, all under objective 1.4. SSH and SFTP share port 22, so that comes to 19 distinct port numbers or ranges.Which Network+ ports use UDP?
TFTP on 69, DHCP on 67/68, SNMP on 161/162, Syslog on 514 and NTP on 123 run over UDP. DNS on 53 and SIP on 5060/5061 use both: DNS answers ordinary lookups over UDP and moves zone transfers and large replies over TCP. Everything else on the list is TCP.What are the secure versions of the cleartext Network+ protocols?
HTTPS (443) for HTTP (80), SSH (22) for Telnet (23), SFTP (22) for FTP (20/21), LDAPS (636) for LDAP (389) and SMTPS (587) for SMTP (25). If a question asks for an encrypted replacement, it is usually one of those pairs.What is the difference between SNMP ports 161 and 162?
The agent on each managed device listens on UDP 161 for the manager's requests. The manager listens on UDP 162 for traps, the alerts devices send on their own when something happens.What's the best way to memorize the Network+ ports?
Learn them in groups by job, such as email, remote access or network management, so related numbers stick together. Then practice both directions: the port for a protocol, and the protocol for a port. The quiz on this page asks both ways, and NetPlus Mastery has the same drill.
Learn the rest of Domain 1 free
Ports are objective 1.4 of Networking Concepts, and the whole domain is free in NetPlus Mastery: a lesson, a quiz and practice questions for each objective, plus this drill.
Keep studying: the free practice test, subnetting practice, PBQ practice, and the full course.