4 Protocol and Port Practice
Learn how transport protocols and port numbers identify likely network services, recognize common port assignments, and apply them to basic troubleshooting.
How ports and transports identify services
An IP address identifies a host, while a helps identify an application service on that host. A port is used with a transport protocol, so 53 and 53 are distinct endpoints.
Registered port numbers are useful clues about likely services, but they do not prove what an application is doing. A service may use an alternate port, and traffic on a registered port may not be the registered service.
and
is connection-oriented and provides reliable, in-order delivery of a byte stream. sends independent datagrams without ’s connection setup or delivery and ordering guarantees.
Applications choose a transport suited to their needs. Do not infer whether a service uses or from the alone.
Common services and port assignments
Common port assignments are useful starting points, but they are defaults rather than guarantees that every installation uses them.
: 21 for control; 20 for data in classic active mode. Passive-mode data uses a negotiated port.
: 22 for secure remote login and administration.
Telnet: 23 for remote terminal access; it sends data without ’s protection.
SMTP: 25 for mail transfer between mail servers.
: and 53 for resolving domain names.
: 67 on the server side and 68 on the client side for assigning network configuration.
HTTP: 80 for web traffic.
POP3 and IMAP: 110 and 143, respectively, for retrieving and accessing email.
: 443 for encrypted web traffic. commonly uses 443.
NTP: 123 for synchronizing clocks.
SNMP: 161 for queries and 162 for notifications; it is used to monitor and manage network devices.
RDP: and 3389 for Remote Desktop access.
The IANA registry records port assignments by transport. Protocol specifications describe details such as DHCP’s client/server port direction and ’s use of .
Exceptions that matter in troubleshooting
is not limited to : it uses both and on port 53. If small lookups work but some larger responses fail, and a firewall permits 53 but blocks 53, the administrator should check or permit over 53 as well as 53.
Web traffic is not always carried over . runs over , which uses , commonly on port 443. If a client can reach a website over 443 but 443 is blocked, may be affected; the client may try a -based version of HTTP instead.
Applying port knowledge
For a standard remote-login connection on port 22, the likely transport is . A lookup on port 53 can use both and , a client/server exchange uses , and an connection on port 443 uses through .
If a new device is not receiving an IPv4 address, check 68 on the client side and 67 on the DHCP server side. These port directions are part of the client/server exchange.