The ports and protocols you have to know cold

Why this matters

This is the one lesson with a genuine memorisation requirement. CompTIA lists the protocols and port numbers explicitly, which means they can be asked directly — "which port does LDAPS use" has one answer and no reasoning will recover it.

It also pays off far beyond recall. Firewall rules are written in ports. Troubleshooting is often "the name resolves but port 443 is refused", which tells you the problem is the service, not DNS. Half of domain 4 and a good part of domain 5 assume you know this table.

Learn it in groups that share a logic, not as twenty unrelated numbers.

The lesson

How ports work

A port is a 16-bit number identifying a service on a host, carried in the TCP or UDP header at layer 4. An IP address gets a packet to the machine; the port gets it to the right program on that machine.

The ranges:

• 0–1023, well-known ports. Assigned to standard services. On Unix-like systems binding one requires privilege, which is a small security property.
• 1024–49151, registered ports. Assigned to specific applications on request — SQL Server's 1433 and RDP's 3389 live here.
• 49152–65535, dynamic or ephemeral ports. What a client picks at random for its own end of a connection.

That last range explains something people find confusing. When your browser connects to a web server, the destination is port 443 but the source is some ephemeral port like 51234. The reply comes back to 51234. It is the combination of source IP, source port, destination IP and destination port — the socket pair — that identifies a connection, which is how one machine holds hundreds of simultaneous connections to the same server.

The table

Learn them in groups

The secure/insecure pairs. This is the highest-value pattern on the exam, because questions frequently ask you to replace an insecure protocol.

• Telnet 23 → SSH 22
• FTP 20/21 → SFTP 22 (over SSH) or FTPS (over TLS)
• HTTP 80 → HTTPS 443
• LDAP 389 → LDAPS 636
• SMTP 25 → SMTPS 587

Notice that SFTP and SSH share port 22, because SFTP is a subsystem of SSH. That is not a coincidence to memorise separately — it is the same service.

The low cluster, 20 to 80. FTP 20/21, SSH and SFTP 22, Telnet 23, SMTP 25, DNS 53, DHCP 67/68, TFTP 69, HTTP 80. Early internet services, mostly designed before encryption was assumed.

The management group. SNMP 161/162 and Syslog 514 are how devices report on themselves. Both are UDP, both are covered properly in the monitoring lesson.

The 400s. HTTPS 443 and SMB 445 sit next to each other and are easy to transpose. SMB is the Windows file sharing protocol, and it is the one to remember for exposure questions — SMB reachable from the internet is how a great deal of ransomware has spread.

The high registered ones. SQL Server 1433, RDP 3389, SIP 5060/5061. All worth knowing because all three are commonly and dangerously exposed.

UDP or TCP, and why

Mostly TCP, because most services want reliability. The UDP ones have reasons:

• DNS uses UDP for queries — one small request, one small answer, and retrying is cheaper than a handshake. It switches to TCP for responses too large for a datagram and for zone transfers.
• DHCP uses UDP because the client has no address yet, so it cannot establish a connection. It broadcasts.
• TFTP uses UDP because it is deliberately trivial, which is also why it has no authentication and belongs only on a trusted management network.
• NTP uses UDP because a timestamp that arrives late is worse than one that does not arrive; retransmission would defeat the purpose.
• Syslog uses UDP for fire-and-forget logging, which has the honest downside that log messages can be lost silently.

The pattern: UDP where the exchange is small, where latency matters more than delivery, or where the client cannot yet hold a connection.

Ports in practice

Some habits that make this knowledge operational:

• netstat -an or ss -tuln shows what is listening locally.
• nmap scans what is reachable remotely — with authorisation only.
• "Connection refused" means something answered and rejected you: the host is reachable and nothing is listening on that port. "Connection timed out" usually means a firewall dropped it silently. That distinction is a genuine domain 5 shortcut.
• A service can run on a non-standard port. Moving SSH off 22 reduces background noise from scanners; it is not a security control on its own, because a scan finds it anyway.