Common ports cheat sheet: secure vs insecure
The pairing rule
A port number identifies a service on a host, and the exam question usually gives you a protocol and wants the number, or gives you an insecure protocol and wants the secure replacement. The decision rule: if a protocol sends credentials or data in clear text, there is an encrypted twin, and the twin is the right answer whenever the question mentions encrypted, secure or compliance. All numbers below were checked against the IANA service name and port number registry; protocol behaviour is from the RFCs named in each section.
Port ranges and TCP versus UDP
IANA divides the 16-bit space into system or well-known ports (0 to 1023), user or registered ports (1024 to 49151) and dynamic or private ports (49152 to 65535), as RFC 6335 describes. A client picks a random high source port for each connection; the well-known number belongs to the server side. That is why a firewall rule names the destination port, and why a return flow is allowed by connection tracking rather than by opening a high-numbered range.
Most services in this sheet use TCP because they need ordered, reliable delivery. The usual UDP exceptions are DHCP, TFTP, NTP, SNMP, syslog and RADIUS, plus DNS queries. When a question asks for the transport protocol and lists “TCP and UDP”, DNS is the safe pattern: UDP first, TCP when the answer is too large or for a zone transfer.
Remote access and file transfer
| Port | Protocol | Transport | Secure? |
|---|---|---|---|
| 22 | SSH (also SFTP and SCP, which run over SSH) | TCP | Yes |
| 23 | Telnet | TCP | No, replace with SSH |
| 21 | FTP control | TCP | No |
| 20 | FTP data (active mode) | TCP | No |
| 69 | TFTP | UDP | No, no authentication |
| 989 / 990 | FTPS data / control | TCP | Yes, FTP over TLS |
| 3389 | RDP | TCP | Encrypted, but never expose to the internet |
SFTP is not FTP over TLS. SFTP is a file transfer subsystem of SSH and uses port 22; FTPS is FTP wrapped in TLS and uses the 989/990 pair in implicit mode. Mixing the two up is the most common error in this group, and the clue is the word SSH: if the question says the transfer runs through an SSH session, the port is 22.
Web, name and address services
| Port | Protocol | Transport | Note |
|---|---|---|---|
| 80 | HTTP | TCP | Clear text |
| 443 | HTTPS | TCP | HTTP over TLS |
| 8080 | HTTP alternate | TCP | Often a proxy or test web server |
| 53 | DNS | UDP and TCP | UDP for queries, TCP for large answers and zone transfers |
| 853 | DNS over TLS | TCP | Encrypted DNS |
| 67 / 68 | DHCP server / client | UDP | Details in DHCP and DNS |
| 123 | NTP | UDP | Time; many exams include it |
| Port | Protocol | Note |
|---|---|---|
| 25 | SMTP | Server to server relay, clear text unless upgraded |
| 587 | SMTP submission | Client to server, normally with STARTTLS upgrade |
| 465 | SMTP submission over TLS (SMTPS) | Registered by IANA as message submission over TLS |
| 110 | POP3 | Clear text |
| 995 | POP3S | POP3 over TLS |
| 143 | IMAP | Clear text |
| 993 | IMAPS | IMAP over TLS |
RFC 8314 recommends that mail clients use “implicit TLS”, meaning TLS from the first byte, on 993 for IMAP, 995 for POP3 and 465 for submission, over the older STARTTLS-on-587 pattern. Older study material says 465 is deprecated; the IANA registry today lists it as submissions, so treat it as valid. The N10-009 objectives list 587 as “SMTPS”, because submission on 587 is normally upgraded with STARTTLS; for that exam, read SMTPS as 587, while IANA registers 465 as submissions over implicit TLS.
Directory, authentication and management
| Port | Protocol | Transport | Note |
|---|---|---|---|
| 389 | LDAP | TCP and UDP | Directory queries, clear text unless upgraded |
| 636 | LDAPS | TCP | LDAP over TLS |
| 88 | Kerberos | TCP and UDP | Ticket-based authentication |
| 1812 / 1813 | RADIUS authentication / accounting | UDP (also registered for TCP) | Wireless and VPN logins |
| 49 | TACACS+ (registered as tacacs) | TCP | Per-command administrator authorisation |
| 161 / 162 | SNMP / SNMP trap | UDP | Use SNMPv3 for encryption and authentication |
| 514 | Syslog | UDP | Clear text; 6514 is syslog over TLS |
| 445 | SMB | TCP | Windows file sharing |
| 3306 | MySQL | TCP | |
| 1433 | Microsoft SQL Server | TCP | |
| 5060 / 5061 | SIP / SIP over TLS | TCP and UDP | Voice signalling |
Worked example: reading a firewall request
A ticket asks you to open “FTP, mail and remote admin” from the internet to one server, and the security team insists on no clear-text protocols. The mapping: FTP becomes SFTP on 22, mail clients use 993 and 587 or 465, and remote admin uses SSH on 22 instead of Telnet on 23. Everything that the ticket listed in clear text has an encrypted replacement, so the rule set needs 22, 993 and 465 or 587 and no more. Choosing FTPS instead would add 990 plus a range of data ports, which is why SFTP keeps the rule set smaller. The unneeded 23, 21, 110 and 143 stay closed.
Which exams test this
| Exam | How it appears | Where on this site |
|---|---|---|
| N10-009 | Networking Concepts, objective 1.4: an explicit list of ports to know, from FTP 20/21 to SIP 5060/5061, including the secure pairs (SSH, SFTP, HTTPS, LDAPS) | Networking concepts, Cheat sheet |
| 200-901 | Network Fundamentals, objective 6.7: recognise common protocol port values such as SSH, Telnet, HTTP, HTTPS and NETCONF | Network fundamentals |
| 200-301 | The outline names protocols rather than port numbers. v1.1 (until Feb 2, 2027): device management access with Telnet, SSH, HTTP, HTTPS and TACACS+/RADIUS (2.8), TCP versus UDP (1.5), SNMP, syslog and TFTP/FTP (4.4, 4.5, 4.9). v2.0 (from Feb 3, 2027): TACACS+ and RADIUS (4.1), SFTP/SCP (4.2), SNMP and syslog (5.4, 5.6) | Network services and security |
| SY0-801 | Minor, indirect topic: the V8 outline has no port list; open ports and services appear as an attack surface (2.4), and secure communication and file transfer (3.2) and email security (4.1) favour the encrypted protocol | Security architecture |
How questions are built around it
The traps are the near neighbours: SFTP versus FTPS, 587 versus 465, 143 versus 993, and UDP versus TCP for DNS. Constraint words decide the answer: encrypted picks the TLS or SSH twin, time synchronisation picks 123, per-command authorisation picks TACACS+ and network access for wireless users picks RADIUS. Ports also appear inside scenario questions about NSG rule evaluation and access lists, where you must name the port to allow or deny, and how the transport layer carries them is covered in OSI vs TCP/IP.
Question 1. A security policy bans clear-text administration. Administrators currently manage switches with Telnet, and transfer configuration files with FTP. Which change meets the policy with the fewest protocols?
- A. Replace Telnet with TFTP on UDP 69
- B. Use SSH on TCP 22 for management and SFTP or SCP for file transfer
- C. Use FTPS on TCP 990 for both management and file transfer
- D. Move management to HTTP on TCP 80
Show answer
Answer: B
SSH on TCP 22 replaces Telnet, and SFTP and SCP run over the same SSH service, so one encrypted protocol covers both needs. TFTP has no authentication or encryption. FTPS would also be encrypted but adds a second protocol and more ports. HTTP on port 80 is clear text.
Question 2. A mail client must retrieve messages from a server so that the credentials and messages are encrypted from the first byte. Which port and protocol should the client use?
- A. IMAP on TCP 143
- B. POP3 on TCP 110
- C. SMTP on TCP 25
- D. IMAPS on TCP 993
Show answer
Answer: D
IMAPS on TCP 993 wraps IMAP in TLS from the start of the connection, which is the implicit TLS approach recommended in RFC 8314. IMAP on 143 and POP3 on 110 are clear text unless upgraded. SMTP on 25 sends mail between servers and does not retrieve messages.