Common Port Associations

Why the common port associations matter

We've talked quite a bit about ports, some of the security that's involved in ports, how they create sockets, and how a port addresses certain services that are running on a server. It's really important for you to understand these port associations. Usually when you're on the job you can go and look things up, but it is inefficient if you have to constantly look up these different port associations. So my recommendation is to get a solid grasp of at least the common ports that are associated with certain services.

You can move away from that when you're setting up a service — and we talked about the security ramifications of that already — but for the most part you better have a good reason if you're not going to use what's already set up out there. It would be my recommendation, especially if you're going after certifications, and even for you to be successful in the job to a certain degree, to understand at least the basics of certain ports that are associated with certain services.

Port number groups

Just a reminder about port number groups. There are lots of different ones out there. There's this first range, which are the well-known ports. Those are the ports that you probably don't want to move away from, that are associated with certain services. There are some outside of this range that you probably don't want to move away from as well, but these well-known ports have a pretty big establishment between the ports and these different services.

Then you have registered ports. Registered ports are where a business wants to utilize a certain port, so they'll register that port, and that way you can commonly associate those ports with some sort of service.

And then there are the more dynamic private or ephemeral ports that your computer will assign automatically, or will utilize some of these dynamic private or ephemeral ports. They're just kind of designed to be a little more free and used readily out there.

A good example of this would be a Minecraft port, which I'm very familiar with because I've set up several Minecraft servers. It is not a registered port, but it's generally associated with 25565, at least when it comes to a world server on Minecraft. It uses this 25565 and it's associated with that service. But when I want to host multiple worlds out there, I'll actually use 25565, maybe I'll use 66, maybe I'll use 67. I'll use the sequencing depending on how many worlds I want to generate, so that way when a machine connects into it, it knows which world it's going to access, and it knows it by these port numbers and what port I set up on these different worlds.

I've also used something that's completely out of the sequence, maybe like 26415, just to come up with a random number. I'll use this sequence and it kind of puts it out of the range of the rest of it, with the idea that maybe I'll have fewer people trying to access this Minecraft server if it's off a little bit, if it's not on the same standard sequence that everybody else is using. So once again, they're not ports that are registered out there, but you can utilize some of these ports, the non-standard ports. For the most part, though, especially in this first range right here, you want to use the standard ports most of the time, unless you have a good reason not to use it.

Protocols that use more than one port

As we go through this list, another thing to understand is that there are some protocols that use multiple ports. An example would be FTP. FTP has a connection that it establishes between a client and a server. You have an FTP client and you have an FTP server. It will establish some sort of communication and set up the rules, or the discussion part of this, where it says, "Okay, this is what I need to do. This is how I want to do it," and so forth. But then when it actually gets to the data transfer, it will use a different port. You just have to know that there are some of these protocols that will set up the control, or the communicating of commands, on one port, but then the actual data transfer will happen on another port. So you could have multiple ports that are opened up just for one service.

Similarly, you could have protocols that just use one port, but some of the data that's transferred would be TCP and other data would be UDP traffic. So you could have the scenario where it's utilizing one port but it has both TCP and UDP traffic, or possibly it has two different ports and one of them is for the TCP traffic and some of it is for the UDP traffic. So you could see protocols that utilize both TCP transfer and UDP transfer, and that's probably likely the case in some of these protocols.

How this list is organized

What we're going to do is talk about ports and what ports are well-known. We'll talk about whether they're TCP or UDP, and then we'll mention the protocol that's associated with those ports. This is not supposed to be a really exhaustive list of everything. This is supposed to be just the highlights of the ones that are most important, whether you're studying for a certification exam or just in your career as you run across access control lists or you run across packets that are going across your network. This will help you quickly identify what that traffic is associated with.

One thing I will note with all of this is that I've broken this down into different components. This one is the file transfer and console protocols. Don't think that there's something magical about these categories here — these are just categories that I chose in order to present this data in this format. Don't think that you're going to go out there and find these different categories out there. This is just what I came up with to break this data down into a little bit more sizable chunks.

File transfer and console

First of all, console: to get into equipment, to remotely connect into equipment and issue commands into that equipment. Maybe you're going and configuring that equipment. So we want to get onto a piece of equipment, and there are a couple of ways of doing that.

One is Telnet. Telnet uses port 23. It's TCP, so it's reliable, and it uses Telnet to connect into a device. Essentially, everything when you console into a device using Telnet — whenever you hit a command on your keyboard, it sends it, just like a terminal would, to that device. That device processes it and then replies back with essentially what it is that you have typed, and issues a command back to that terminal or to whatever you're using to access that. So if I type an A, it sends the A, brings it back and says you typed an A, put that up on your screen. Then you continue to do that. You hit enter to execute a command and then it will display the results of that command on your console.

So Telnet is a way to do that, and it doesn't transmit things securely. Telnet is considered insecure, but it is a way to get onto equipment and manipulate it and change it and configure it and do all that fun stuff.

Similarly, if you want to — and you should be secure about it — you would use port 22, or secure shell. Secure shell is a way to securely get onto a device and be able to enter those commands without other people being able to capture that data and being able to access that data later because they're capturing the information that you're sending over to that. So when possible, use port 22 on those devices.

Then let's get into some file transfer. The first one I have on here is a very common protocol, FTP. FTP uses ports 20 and 21. Port 21 is the connection side of this and creates connections into it, versus 20, which actually then does the data transfer back and forth. So that's FTP, or file transfer protocol. Once again, it's a very common protocol, and we use these things to upload files or download files. A lot of times I've used it when I'm creating websites and I need to get the data up into the cloud, and I've used it for client data transfers back and forth.

Now, there are secure ways of doing FTP. FTP is not considered as secure as other methods of encrypting that data and transferring that data back and forth. So one example of that is SFTP. SFTP is secure file transfer protocol. This is not to be confused with FTPS. In fact, I have not seen SFTP really widely used out there — not that it's not utilized quite a bit out there, but I have not seen it. I've seen more FTPS used. The reason why SFTP is the same port as SSH is that it uses SSH to secure the transfer. SFTP uses SSH to encrypt that traffic and secure that traffic that's going back and forth. So that's why it utilizes the same port number.

Then we have trivial file transfer protocol — not considered a secure method of transferring files. But the key to this one is that it's port 69 and it uses UDP. It's called TFTP, trivial file transfer protocol. The advantage of TFTP is that it's UDP. So if you have some sort of device, maybe it's transferring some log files and it needs just a place to dump log files as it comes in, and it's not going to be devastating if it loses a couple of files along the way — it's just inputting data into the system — then that would be a case for TFTP, to get that file transferred from one location to another.

Then we have FTPS. FTPS is FTP over SSL, although with a lot of these technologies we no longer use SSL. A lot of times it's incorporated into the name of these, but we actually technically don't use SSL, we use TLS instead. But for whatever the point, we've kept it as SSL. So, FTP over SSL: the SSL part of it is what secures it. This is port 989 and 990. It uses TCP, and once again that's FTPS, or FTP over SSL.

Then we have SMB, or server message block. Server message block actually can do quite a few different things. I've chosen to put it in this file transfer area, but it can do quite a few more things than just file transfers. SMB is commonly associated with Windows, and it's server message block. It's what we use to transfer files using Windows systems. You probably have used SMB before in the past if you worked with network drives and transferred files back and forth between computers. There's a good chance that you've used this before and just not realized that you've used SMB.

So those are some examples of file transfers and consoles — different protocols that are out there and the port numbers that are associated with those protocols.

Email protocols

The first thing you need to understand, and I constantly push on this at the places that I work, is that email is not considered a secure form of transferring data. You could have a secure connection from your server to other email servers, but then once it's passed that, somewhere out there it could be insecure communication. That is because for the longest time we were using port 25, which is simple mail transfer protocol. It's an unsecure method of transferring emails and it's still used to this day.

So port 25 is a TCP port and it's associated with SMTP. It's still used quite a bit out there. Servers are encouraged to make a connection in a more secure manner, but if it's connecting to the other side and the choice is "don't send this" or "I have to send it insecurely," a lot of servers are set up to say, well, I'm still going to send this, I'm still going to get this email to its final destination even though I've got to go over this insecure connection. So that's port 25. Once again, we try not to use just simple mail transfer protocol by itself, insecure, anymore, but sometimes you just don't have a choice.

That is really to send emails — it's a protocol for sending emails. So it could be your client that's on your machine that's sending it to the server, or it could be server to server just relaying that information. So that's to send mail.

Versus POP3, which has been used for a long time also. Consider it unsecure. POP3, post office protocol version 3, is 110. It's port 110 and it uses TCP to be able to grab data and pull it down, and it's usually to the client. So it's taking it from the email server and pulling it down to the client. What I'm saying is, Outlook would be an example of this. There are different clients that are set up on your machine that will download those emails onto your machine. That's different than a lot of people who will access email through — if you're accessing Gmail then you're probably using a web browser to access it. That wouldn't be the same. That's not the type of client that we're talking about here. This is a client that is a separate program that's on your machine. It's going and connecting to your mail server and dragging it down to the local computer, a copy onto your local computer. And post office protocol version 3 is what does that.

IMAP, or internet message access protocol, is very similar, except it's a more dynamic connection between the two. POP version 3 has the ability to download those emails onto your computer, and there is a checkbox to say, hey, keep a copy still up on the server, I still want to keep a copy on there, I just want a copy on the local one. But POP3 is not really considered very dynamic, versus an IMAP connection, which gives you a lot more functionality and creates a much more dynamic conversation between what's on the server and what's on the local client. That way, when you update one, then it will update the other. It's a much more dynamic connection when you're using IMAP. But that is found on port 143, it's a TCP connection, and that's the internet message access protocol.

Then we get back to versions of SMTP. So we have 587, which is TCP. It's SMTP over TLS. Here again, I mentioned before that we no longer really use SSL like we used to, because it's not really considered secure. It's certainly not as secure as TLS is, so we've switched over to TLS. But this is just a method of using SMTP in a secure manner. And then the same thing with a secure IMAP: IMAP over SSL, and it's TCP port 993. And then finally, we've got POP3 over SSL, which is 995. It operates on both TCP and UDP. And that's POP3 over SSL.

Directory services

A directory service in its true form is things like when you're logging into your computer: it will use directory services to look up your name and your password and make sure that you are authorized to log onto a machine. So that's directory services.

Then I threw a couple of other services on top of this because they're commonly associated with each other. So as an example, if I roll out a Windows Active Directory machine, then I'm also rolling out probably a DNS server on that same machine, DHCP, and some sort of network time protocol. So these are some of the services that are associated with that. Can I roll it out on a different server, or maybe a different piece of equipment like a layer 3 switch or a router? I can absolutely do that, so you'll find these in other locations as well. But for the purposes of this, I'm just going to lump it into directory services, because often that's how I actually choose to implement it.

So first up here, we've got port 53, which operates on both TCP and UDP.