Common Ports and Protocols for A+

In networking, a port is a 16-bit number (0-65535) used by transport layer protocols (TCP and UDP) to identify a specific process or service on a host. The IP address identifies the host; the port number identifies the application. This allows a single computer to run multiple network services simultaneously without data getting mixed up.

Ports are divided into three ranges: - Well-known ports (0-1023): Assigned by IANA for common services (e.g., HTTP on 80, HTTPS on 443). On Unix-like systems, binding to these ports typically requires root privileges. - Registered ports (1024-49151): Used by user applications that are not as common; companies can register them with IANA (e.g., Microsoft SQL Server uses 1433). - Dynamic/private ports (49152-65535): Used for temporary, client-side connections. When your browser connects to a web server, it uses a random ephemeral port from this range as its source port.

When an application wants to send data over the network, it requests a port from the operating system. The application binds to a specific port number (e.g., a web server binds to port 80). The OS then creates a socket — a combination of IP address and port number — that uniquely identifies that service.

For outgoing connections, the client application requests a port from the dynamic range. The OS assigns an available port (e.g., 52001) and uses it as the source port in the TCP or UDP header. The destination port is the well-known port of the service being contacted (e.g., 80 for HTTP).

The transport layer header contains both source and destination port fields, each 16 bits. When a packet arrives, the receiving OS reads the destination port and delivers the data to the application listening on that port. If no application is listening, the OS sends an ICMP Port Unreachable message (UDP) or a TCP RST (TCP) back to the sender.

The exam objectives list the following ports as essential knowledge. You must know the port number, the protocol (TCP or UDP), and the service name.

Some services use both: DNS uses UDP by default but switches to TCP for large responses; SIP can use UDP or TCP.

Firewalls filter traffic based on port numbers. A common security practice is to block all ports except those needed for business operations. For example, a web server firewall might allow inbound traffic on ports 80 and 443, but block everything else.

NAT (Network Address Translation) modifies port numbers to map multiple private IPs to a single public IP. This is called PAT (Port Address Translation). The NAT device keeps a table of internal IP:port to external IP:port mappings so it can forward return traffic correctly.

On Windows, you can use netstat -an to see all active connections and listening ports. On Linux, ss -tuln or netstat -tuln. To test if a port is open on a remote host, use telnet host port (TCP only) or nc -zv host port (netcat). Port scanners like Nmap can scan multiple ports.

To allow RDP (port 3389) through Windows Firewall:

netsh advfirewall firewall add rule name="Open RDP" dir=in action=allow protocol=TCP localport=3389

To verify:

netsh advfirewall firewall show rule name="Open RDP"

Port numbers are fundamental to network communication. For the 220-1101 exam, focus on memorizing the well-known ports listed in the objectives. Use mnemonics, flashcards, or practice quizzes to reinforce your memory. Understanding the difference between TCP and UDP, and knowing which services use which, will help you troubleshoot connectivity issues and configure firewalls correctly.

A company hosts a public-facing web application on a server in a DMZ. The security team must configure the firewall to allow only necessary traffic. They create an inbound rule that permits TCP ports 80 (HTTP) and 443 (HTTPS) from any source. All other inbound ports are blocked. Additionally, they allow outbound traffic on port 53 (DNS) so the server can resolve domain names, and port 123 (NTP) for time synchronization. They also allow port 22 (SSH) from a specific management subnet for administration. A common mistake is to leave port 3306 (MySQL) open to the internet, thinking it's needed for the web app. In reality, the database should be on a separate internal server, and the web server connects to it over the internal network. Misconfiguration can lead to data breaches.

An organization runs its own email server using Microsoft Exchange. The server must accept incoming email on port 25 (SMTP) from the internet. It also needs to support clients: Outlook uses port 587 (SMTP submission) for outgoing mail, port 993 (IMAPS) for encrypted incoming mail, and port 995 (POP3S) for encrypted POP3. The firewall is configured to allow these ports from internal IP ranges. Additionally, the server uses port 53 (DNS) to look up MX records. A common issue is that port 25 is blocked by the ISP for residential connections, preventing the server from sending email directly. In that case, the organization might use a smart host (relay) on port 587.

A company allows remote employees to connect to the corporate network via VPN. They use a VPN appliance that supports IPsec with IKE (UDP 500) and IPsec NAT-T (UDP 4500). The firewall at the office must allow these ports from any external IP. Additionally, once the VPN is established, employees need access to internal services like file shares (SMB on TCP 445) and RDP (TCP 3389) for remote desktop. The VPN appliance typically handles routing so that traffic to internal IPs is sent through the VPN tunnel. A common problem is that the firewall blocks UDP 500 or 4500, causing the VPN to fail to establish. Another issue is that the VPN client's home router might not support IPsec passthrough, requiring the use of NAT-T.