2 Protocols and Ports

Ports and network endpoints

A port identifies an application or service on a device. Together, an IP address, transport protocol, and port help identify a particular network endpoint. Because ports are tied to transport protocols, TCP port 53 and UDP port 53 are distinct.

TCP and UDP

TCP establishes a connection and provides reliable, ordered delivery of a byte stream. It retransmits lost data, so it is often used when an application needs complete, correctly ordered data, such as web pages, remote logins, and email.

UDP sends independent datagrams with less transport overhead. UDP itself does not guarantee delivery, ordering, or protection against duplicates. It is often used for short queries and real-time traffic; the application handles any reliability it needs.

Interpreting port clues

A familiar port number can suggest the purpose of traffic, but it does not prove what a service is doing. Services can use nonstandard ports, and port numbers can be reassigned or misused. The IANA registry is the authoritative reference for registered port numbers.

To interpret a connection, check both the port and transport protocol, then consider which device initiated the connection and in which direction. Encryption can hide application data, and a service may be configured to use a different port. Port numbers alone do not reveal the full contents or safety of a connection.

Name resolution and network configuration

DNS resolves domain names to records such as IP addresses. It commonly uses UDP port 53 for ordinary queries, and also uses TCP port 53, including for zone transfers and when needed for larger responses. Traffic to port 53 often indicates name lookup activity.

DHCP automatically provides a host with configuration such as an IP address, default gateway, and DNS server. The DHCP server uses UDP port 67 and the client uses UDP port 68. A client that has just joined a network may broadcast DHCP messages before it has a usable address.

Web traffic

HTTP transfers web requests and responses. Traditional HTTP uses TCP port 80, so a browser fetching a page over ordinary HTTP commonly connects to that port.

HTTPS carries web traffic with encryption and server authentication. HTTP/1.1 and HTTP/2 commonly use TCP port 443. HTTP/3 runs over QUIC, which uses UDP, so UDP port 443 may indicate HTTP/3.

Remote access and sending email

SSH provides encrypted remote login and other secure network services, including command-line administration and file transfer. A connection to TCP port 22 often suggests remote system access.

SMTP sends or relays outgoing email. TCP port 25 commonly indicates server-to-server mail transfer, while TCP port 587 or port 465 commonly indicates a mail app submitting a message to its provider. Port 465 is used for submission over implicit TLS.

Accessing email

POP3 retrieves email from a mailbox, often by downloading messages to a client. It commonly uses TCP port 110; TCP port 995 is used for POP3 with implicit TLS.

IMAP lets a mail client access and manage messages and folders kept on a mail server. Its common cleartext port is TCP 143, and its common implicit-TLS port is TCP 993.

Recognizing common traffic patterns

Common patterns include DNS on port 53, DHCP on UDP ports 67 and 68, HTTP on TCP port 80, HTTPS on port 443, SSH on TCP port 22, SMTP on TCP ports 25, 587, and 465, POP3 on TCP ports 110 and 995, and IMAP on TCP ports 143 and 993. Match each number with its transport and role, and treat it as a useful clue rather than definitive proof.

For example, a laptop contacting a DNS resolver on UDP port 53 is likely making a name lookup. A new device exchanging messages on UDP ports 67 and 68 is likely requesting DHCP configuration. A browser connecting to TCP port 443 is likely using HTTPS, while UDP port 443 may indicate HTTP/3. A mail client connecting to TCP port 993 is likely accessing an email inbox with IMAP over TLS.