Common network ports and protocols

Both CompTIA Network+ (N10-009) and CompTIA Security+ (SY0-701) expect instant recall of common ports: the number, the transport, and which secure service replaces which insecure one. Drill the main table until the port number alone triggers the service name, then spend your remaining time on the secure/insecure pairs and the handful of lookalike ports the exams use as distractors. Transports shown are the ones the exams grade; several services are registered for both TCP and UDP.

Ports to know cold

Port / transport	Service	Remember for the exam
20 TCP	FTP (data)	Active-mode data channel; pairs with 21
21 TCP	FTP (control)	Logins and commands, all cleartext
22 TCP	SSH, SFTP, SCP	One port, three services; SFTP rides inside SSH
23 TCP	Telnet	Cleartext remote shell; the fix is always SSH on 22
25 TCP	SMTP	Server-to-server mail relay, not client submission
53 UDP/TCP	DNS	UDP for queries; TCP for zone transfers and large responses
67, 68 UDP	DHCP	Server listens on 67, client on 68; broadcast-based
69 UDP	TFTP	No authentication; firmware and config file pushes
80 TCP	HTTP	Cleartext web; redirect it to 443
88 TCP/UDP	Kerberos	Active Directory ticket authentication; needs accurate time
110 TCP	POP3	Download-and-delete mail; secure twin is 995
123 UDP	NTP	Time sync; clock skew breaks Kerberos and log correlation
137, 138 UDP; 139 TCP	NetBIOS (name, datagram, session)	Legacy Windows networking; 139 carries SMB sessions
143 TCP	IMAP	Mail stays on the server; secure twin is 993
161 UDP	SNMP	Manager polls agents (get/set)
162 UDP	SNMP traps	Agents push unsolicited alerts to the manager
389 TCP/UDP	LDAP	Directory lookups (Active Directory); cleartext by default
443 TCP	HTTPS	HTTP over TLS; HTTP/3 uses QUIC on UDP 443
445 TCP	SMB	Direct-hosted Windows file sharing; no NetBIOS needed
465 TCP	SMTPS	Mail submission with implicit TLS from the first byte
514 UDP	Syslog	Unencrypted, connectionless log forwarding
587 TCP	SMTP submission	Client mail submission, upgraded with STARTTLS; N10-009 objectives label it SMTPS
636 TCP	LDAPS	LDAP wrapped in TLS
993 TCP	IMAPS	IMAP over TLS
995 TCP	POP3S	POP3 over TLS
1433 TCP	Microsoft SQL Server	Database engine; never expose to the internet
1521 TCP	Oracle Database (TNS listener)	Oracle's default listener port
3306 TCP	MySQL / MariaDB	Common open-source database port
3389 TCP	RDP	Remote Desktop; classic brute-force target, gate behind a VPN
5060 TCP/UDP	SIP	VoIP call signaling, unencrypted
5061 TCP	SIP over TLS	Encrypted signaling only; the voice itself is RTP/SRTP
6514 TCP	Syslog over TLS	Secure syslog; note the switch to TCP from UDP 514

When two numbers appear together (20/21, 67/68, 161/162), expect the exam to test which side is which.

Secure vs insecure pairs

Insecure (port)	Secure replacement (port)	Exam angle
Telnet (23)	SSH (22)	Different protocol and different port
HTTP (80)	HTTPS (443)	TLS for the web; HSTS enforces it
FTP (20/21)	SFTP (22) or FTPS (990 implicit)	SFTP is SSH-based, FTPS is TLS-based; they are not the same protocol
SNMPv1/v2c (161/162)	SNMPv3 (161/162)	Same ports; security comes from the version, not the port
LDAP (389)	LDAPS (636)	Directory binds carry credentials; encrypt them
POP3 (110)	POP3S (995)	Add TLS, new port
IMAP (143)	IMAPS (993)	Add TLS, new port
SMTP cleartext (25)	Submission 587 (STARTTLS) or SMTPS 465	25 stays for server-to-server relay
Syslog (514 UDP)	Syslog over TLS (6514 TCP)	Transport changes from UDP to TCP
SIP (5060)	SIP over TLS (5061)	Signaling encrypted; pair with SRTP for the media

Easily confused

Ports	The trap	Keep them straight
69 vs 21	TFTP vs FTP	Trivial FTP = UDP 69, no logins; full FTP = TCP 21 with authentication
161 vs 162	SNMP poll vs trap	Manager asks on 161; agents volunteer alerts on 162
445 vs 139	Modern vs legacy SMB	445 is SMB direct over TCP; 139 is SMB riding a NetBIOS session
465 vs 587	Implicit TLS vs STARTTLS	465 is encrypted from the first byte; 587 starts plain and upgrades with STARTTLS
67 vs 68	DHCP server vs client	Server listens on 67, client on 68; server comes first numerically
993 vs 995	IMAPS vs POP3S	Alphabetical matches numerical: IMAP (993) before POP3 (995)

Reading a sheet is recognition; the exam tests recall. The fastest way to make this stick is answering questions that use it.

Drill ports until they stick

Common questions

Is DNS TCP or UDP?

Both, on port 53. Standard name queries use UDP, while zone transfers and responses too large for a single UDP datagram use TCP. If an exam question mentions zone transfers, the answer involves TCP 53.

What is the difference between port 465 and port 587?

Both are for client mail submission. Port 465 (SMTPS) uses implicit TLS, meaning the session is encrypted from the very first byte, while 587 starts in plaintext and upgrades to encryption with the STARTTLS command. Port 25 remains reserved for server-to-server relay.

Does SNMPv3 use a different port than SNMPv1 or v2c?

No. Every SNMP version polls on UDP 161 and sends traps on UDP 162; version 3 adds authentication and encryption inside the protocol itself. This is a favorite trick because it is the one secure upgrade on the list that does not change ports.

Is SFTP the same thing as FTPS?

No, and both exams test this. SFTP is a separate file-transfer protocol that runs inside an SSH session on TCP 22, while FTPS is classic FTP wrapped in TLS, with implicit mode commonly on port 990. SFTP has nothing to do with TLS or port 21.

More free practice tests

Back to all cert900 exams