TCP and UDP Ports
Ports are the virtual endpoints that allow multiple services to run on a single IP address. Understanding TCP and UDP ports is fundamental to networking, security, and penetration testing. Every service you interact with—web browsers, email clients, gaming consoles, remote desktop—uses specific ports. For cybersecurity professionals, knowing common ports, how they're used, and how to scan them is essential for reconnaissance, exploitation, and defense.
What You'll Learn
- What TCP and UDP ports are
- Difference between TCP and UDP
- Port number ranges and categories
- Common ports and their services (comprehensive list)
- Port states (open, closed, filtered)
- Port scanning techniques
- Service identification and banner grabbing
- Port security and defense
What Are Ports?
Ports are 16-bit numbers (0-65535) that identify specific processes or services on a computer.
The Analogy:
IP Address = Street Address
Port = Apartment Number
192.168.1.100:80
│ │
│ └─ Port 80 (Web server apartment)
└─────────────── IP Address (Building address)
Why Ports?
Without ports:
One IP = One service
Need separate IP for each service ❌
With ports:
One IP = Multiple services ✅
192.168.1.100:80 → Web server
192.168.1.100:22 → SSH server
192.168.1.100:25 → Mail server
192.168.1.100:3306 → Database
TCP vs UDP
TCP (Transmission Control Protocol)
Characteristics:
- Connection-oriented: Three-way handshake
- Reliable: Guarantees delivery
- Ordered: Packets arrive in sequence
- Error-checked: Retransmits lost packets
- Slower: Overhead from reliability features
Use cases:
- Web (HTTP/HTTPS)
- Email (SMTP, POP3, IMAP)
- File transfer (FTP, SFTP)
- Remote access (SSH, RDP)
When to use: When data integrity matters more than speed
UDP (User Datagram Protocol)
Characteristics:
- Connectionless: No handshake
- Unreliable: No delivery guarantee
- Unordered: Packets may arrive out of order
- No error correction: Doesn't retransmit
- Faster: Low overhead
Use cases:
- DNS queries
- Video streaming
- Voice over IP (VoIP)
- Online gaming
- DHCP
When to use: When speed matters more than reliability
Comparison:
Feature TCP UDP
────────────────────────────────────────
Connection Yes (handshake) No
Reliability Guaranteed Best effort
Ordering In sequence Any order
Speed Slower Faster
Overhead Higher Lower
Use case Web, email Streaming, gaming
Port Number Ranges
Well-Known Ports (0-1023)
Reserved for common services. Require root/admin privileges to bind (Unix/Linux).
Examples:
20/21 - FTP
22 - SSH
23 - Telnet
25 - SMTP
53 - DNS
80 - HTTP
443 - HTTPS
Registered Ports (1024-49151)
Assigned to specific applications by IANA. Don't require special privileges.
Examples:
1433 - MS SQL Server
3306 - MySQL
3389 - RDP
5432 - PostgreSQL
8080 - HTTP Alternate
Dynamic/Private Ports (49152-65535)
Used for ephemeral (temporary) client connections. OS assigns randomly.
When you browse a website:
Your browser: 192.168.1.100:54321 (random port)
→
Web server: 93.184.216.34:80 (known port)
Common TCP Ports (Essential List)
Web Services:
20/21 - FTP (File Transfer Protocol)
Data (20) and Control (21)
⚠️ Unencrypted - credentials in plaintext
22 - SSH (Secure Shell)
Secure remote access
Also used for SFTP
✅ Encrypted
23 - Telnet
Remote access
❌ NEVER USE - completely unencrypted
25 - SMTP (Simple Mail Transfer Protocol)
Sending email
⚠️ Often unencrypted
80 - HTTP (HyperText Transfer Protocol)
Web traffic
⚠️ Unencrypted
443 - HTTPS (HTTP Secure)
Secure web traffic
✅ Encrypted with TLS/SSL
8080 - HTTP Alternate
Development servers, proxies
Often used to bypass port 80 restrictions
8443 - HTTPS Alternate
Secure web on non-standard port
Email:
25 - SMTP (Sending)
Unencrypted email sending
110 - POP3 (Post Office Protocol v3)
Email retrieval (download and delete)
⚠️ Unencrypted
143 - IMAP (Internet Message Access Protocol)
Email access (sync with server)
⚠️ Unencrypted
465 - SMTPS (SMTP Secure)
Encrypted email sending
✅ SSL/TLS
587 - SMTP Submission
Email submission port
Often uses STARTTLS
993 - IMAPS (IMAP Secure)
Encrypted email access
✅ SSL/TLS
995 - POP3S (POP3 Secure)
Encrypted email retrieval
✅ SSL/TLS
Remote Access:
22 - SSH (Secure Shell)
Secure command-line access
Linux/Unix standard
23 - Telnet
Insecure remote access
❌ Avoid
3389 - RDP (Remote Desktop Protocol)
Windows remote desktop
⚠️ Often attacked, use VPN
5900 - VNC (Virtual Network Computing)
Cross-platform remote desktop
⚠️ Weak authentication by default
5985 - WinRM HTTP
Windows Remote Management
5986 - WinRM HTTPS
Secure Windows Remote Management
File Sharing:
20/21 - FTP (File Transfer Protocol)
⚠️ Unencrypted
22 - SFTP (SSH File Transfer)
✅ Secure file transfer over SSH
69 - TFTP (Trivial FTP)
UDP, no authentication
❌ Very insecure
445 - SMB (Server Message Block)
Windows file/printer sharing
⚠️ EternalBlue vulnerability (SMBv1)
2049 - NFS (Network File System)
Unix/Linux file sharing
Databases:
1433 - Microsoft SQL Server
1521 - Oracle Database
3306 - MySQL / MariaDB
5432 - PostgreSQL
6379 - Redis
27017 - MongoDB
Other Common Services:
53 - DNS (Domain Name System)
UDP (usually), TCP (zone transfers)
67/68 - DHCP (Dynamic Host Configuration)
Server (67), Client (68)
UDP only
88 - Kerberos
Authentication
123 - NTP (Network Time Protocol)
Time synchronization
UDP
161/162 - SNMP (Simple Network Management)
Query (161), Trap (162)
UDP
⚠️ SNMPv1/v2 unencrypted
389 - LDAP (Lightweight Directory Access)
Directory services
⚠️ Unencrypted
636 - LDAPS (LDAP Secure)
✅ Encrypted LDAP
514 - Syslog
System logging
UDP
Common UDP Ports
53 - DNS (Domain Name System)
Primary protocol for DNS queries
67/68 - DHCP (Dynamic Host Configuration)
Server (67), Client (68)
69 - TFTP (Trivial File Transfer Protocol)
Simple file transfer, no authentication
123 - NTP (Network Time Protocol)
Time synchronization
161 - SNMP (Simple Network Management Protocol)
Network device management
162 - SNMP Trap
SNMP notifications
500 - IKE (Internet Key Exchange)
IPsec VPN key negotiation
514 - Syslog
System logging
1194 - OpenVPN
VPN connections
1701 - L2TP (Layer 2 Tunneling Protocol)
VPN tunneling
4500 - IPsec NAT-T
IPsec NAT traversal
Port States
When scanning ports, you'll encounter these states:
Open
Service is listening and accepting connections
Example: nmap shows "open"
What it means:
- Server is running
- Port is accessible
- Service is active
In pentesting: Target for exploitation
Closed
No service listening, but port is reachable
Responds with RST (reset) packet
Example: nmap shows "closed"
What it means:
- Port is reachable
- No service running
- Firewall allows traffic
In pentesting: Less interesting, but confirms host is up
Filtered
Cannot determine if port is open or closed
Usually due to firewall dropping packets
Example: nmap shows "filtered"
What it means:
- Firewall/IDS blocking probes
- Packets dropped (no response)
- Port may be open behind firewall
In pentesting: Might hide valuable services
Open|Filtered
Cannot distinguish between open and filtered
Common with UDP scans
What it means:
- No response received
- Port might be open but not responding
- Or firewall dropping packets
Closed|Filtered
Cannot distinguish between closed and filtered
Rare state
Port Scanning Techniques
1. TCP Connect Scan (-sT)
nmap -sT 192.168.1.5
# How it works:
# - Completes full three-way handshake
# - Most reliable
# - Easily detected (logged by firewalls)
# - Doesn't require root privileges
# When to use:
# - No root access
# - Need accurate results
# - Don't mind being detected
2. SYN Scan (-sS) [Stealth Scan]
nmap -sS 192.168.1.5
# How it works:
# - Sends SYN
# - Receives SYN-ACK (open) or RST (closed)
# - Sends RST (doesn't complete handshake)
# - Less likely to be logged
# - Requires root/admin
# When to use:
# - Need stealth
# - Default nmap scan with root
# - Faster than connect scan
3. UDP Scan (-sU)
nmap -sU 192.168.1.5
# How it works:
# - Sends UDP packet
# - No response = open|filtered
# - ICMP port unreachable = closed
# - Very slow (rate limited)
# Important UDP ports to scan:
nmap -sU -p 53,67,123,161 192.168.1.5
# When to use:
# - Looking for DNS, DHCP, SNMP
# - Comprehensive assessment
4. ACK Scan (-sA)
nmap -sA 192.168.1.5
# How it works:
# - Sends ACK packet
# - Determines firewall rules
# - Doesn't determine open/closed
# - RST response = unfiltered
# - No response = filtered
# When to use:
# - Map firewall rules
# - Determine if stateful firewall
5. FIN Scan (-sF)
nmap -sF 192.168.1.5
# How it works:
# - Sends FIN packet
# - No response = open|filtered
# - RST response = closed
# - Bypasses some firewalls
# When to use:
# - Evade simple firewalls
# - Stealth scanning
6. NULL Scan (-sN)
nmap -sN 192.168.1.5
# How it works:
# - Sends packet with no flags
# - No response = open|filtered
# - RST response = closed
# When to use:
# - Evade firewall detection
# - Alternative stealth method
7. XMAS Scan (-sX)
nmap -sX 192.168.1.5
# How it works:
# - Sends FIN, PSH, URG flags
# - "Lit up like Christmas tree"
# - No response = open|filtered
# - RST response = closed
# When to use:
# - Evade specific firewall rules
# - Test IDS detection
Comprehensive Port Scanning
Scan Common Ports:
# Top 100 ports
nmap --top-ports 100 192.168.1.5
# Top 1000 ports (nmap default with -F)
nmap -F 192.168.1.5
Scan All Ports:
# All 65535 ports (slow!)
nmap -p- 192.168.1.5
# Faster with timing
nmap -p- -T4 192.168.1.5
Scan Specific Ports:
# Single port
nmap -p 80 192.168.1.5
# Multiple ports
nmap -p 22,80,443 192.168.1.5
# Port range
nmap -p 1-1000 192.168.1.5
# All ports (alternative syntax)
nmap -p 1-65535 192.168.1.5
Service Version Detection:
# Detect service versions
nmap -sV 192.168.1.5
# Example output:
# 22/tcp open ssh OpenSSH 7.9p1
# 80/tcp open http Apache httpd 2.4.41
# 3306/tcp open mysql MySQL 5.7.28
# Aggressive version detection
nmap -sV --version-intensity 9 192.168.1.5
OS Detection:
# Detect operating system
nmap -O 192.168.1.5
# OS + version detection
nmap -A 192.168.1.5
Fast Scan:
# Quick scan (100 common ports)
nmap -F 192.168.1.5
# Faster timing
nmap -T4 192.168.1.5
# Paranoid (slowest, most stealth)
nmap -T0 192.168.1.5
# Aggressive (fastest, loud)
nmap -T5 192.168.1.5
Banner Grabbing
Banner grabbing identifies services by their welcome messages.
Using Netcat:
# HTTP
nc 192.168.1.5 80
GET / HTTP/1.1
Host: example.com
[Press Enter twice]
# SSH
nc 192.168.1.5 22
# Output: SSH-2.0-OpenSSH_7.9p1 Debian-10+deb10u2
# FTP
nc 192.168.1.5 21
# Output: 220 ProFTPD Server (Debian) [192.168.1.5]
# SMTP
nc 192.168.1.5 25
# Output: 220 mail.example.com ESMTP Postfix
Using Telnet:
# Similar to netcat
telnet 192.168.1.5 80
GET / HTTP/1.1
Host: example.com
[Press Enter twice]
Using Nmap:
# Banner grabbing with version detection
nmap -sV --version-intensity 9 -p 22,80,443 192.168.1.5
Using Curl (HTTP):
# Grab HTTP headers
curl -I http://192.168.1.5
# Output includes:
# Server: Apache/2.4.41 (Ubuntu)
# X-Powered-By: PHP/7.4.3
Service Identification by Port
Web Services:
# Port 80/443 - Check web server
curl -I http://192.168.1.5
nikto -h http://192.168.1.5
gobuster dir -u http://192.168.1.5 -w wordlist.txt
SSH (Port 22):
# Try to connect
ssh [email protected]
# Enumerate SSH
nmap --script ssh-hostkey,ssh-auth-methods -p 22 192.168.1.5
# Brute force (LAB ONLY)
hydra -l root -P passwords.txt ssh://192.168.1.5
FTP (Port 21):
# Check for anonymous access
ftp 192.168.1.5
# Username: anonymous
# Password: [anything]
# Enumerate with nmap
nmap --script ftp-anon,ftp-bounce -p 21 192.168.1.5
SMB (Port 445):
# List shares
smbclient -L //192.168.1.5
# Enumerate
enum4linux -a 192.168.1.5
# Nmap scripts
nmap --script smb-enum-shares,smb-enum-users -p 445 192.168.1.5
MySQL (Port 3306):
# Try to connect
mysql -h 192.168.1.5 -u root -p
# Enumerate
nmap --script mysql-enum -p 3306 192.168.1.5
RDP (Port 3389):
# Connect from Linux
xfreerdp /u:Administrator /v:192.168.1.5
# Brute force (LAB ONLY)
hydra -l administrator -P passwords.txt rdp://192.168.1.5
DNS (Port 53):
# Query DNS
dig @192.168.1.5 example.com
# Try zone transfer
dig @192.168.1.5 example.com AXFR
# Enumerate
dnsrecon -d example.com -n 192.168.1.5
Port Security Best Practices
1. Close Unnecessary Ports
# Check what's listening
netstat -tuln # Linux
netstat -an # Windows
# Stop unnecessary services
systemctl stop servicename # Linux
net stop servicename # Windows
2. Use Firewall
# Linux (iptables)
# Allow only SSH and HTTP
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -j DROP
# Linux (ufw)
ufw allow 22/tcp
ufw allow 80/tcp
ufw enable
# Windows
New-NetFirewallRule -DisplayName "Allow SSH" -Direction Inbound -LocalPort 22 -Protocol TCP -Action Allow
3. Change Default Ports
# SSH on non-standard port
# /etc/ssh/sshd_config
Port 2222
# Restart SSH
systemctl restart sshd
Note: Security by obscurity, not real security, but reduces automated scans.
4. Use Port Knocking
# Require "knocking" on specific ports before opening service
# Example: Knock on 7000, 8000, 9000 to open SSH
# Install knockd
apt install knockd
# Configure /etc/knockd.conf
[openSSH]
sequence = 7000,8000,9000
seq_timeout = 5
command = /sbin/iptables -I INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
5. Monitor Port Activity
# Watch connections
watch -n 1 'netstat -an | grep ESTABLISHED'
# Log suspicious port scans
# Install fail2ban, configure port-scan filter
Try It Yourself
Exercise 1: Identify Your Open Ports
# What's listening on your machine?
# Linux:
netstat -tuln
ss -tuln
# Windows:
netstat -an | findstr LISTENING
# Identify each service
# Should you have all these ports open?
Exercise 2: Scan Your Router
# Find router IP
ip route show | grep default # Linux
ipconfig | findstr Gateway # Windows
# Scan router (common gateway: 192.168.1.1)
nmap -sV 192.168.1.1
# What services does your router expose?
# - Port 80/443: Web interface
# - Port 53: DNS
# - Anything else concerning?
Exercise 3: Service Version Detection
# Scan a target (use your own devices only!)
nmap -sV -p 22,80,443 [target]
# Can you identify:
# - Operating system?
# - Service versions?
# - Potential vulnerabilities?
# Search ExploitDB for vulnerabilities
searchsploit [service name version]
Exercise 4: Banner Grabbing
# Try different services
nc google.com 80
GET / HTTP/1.1
Host: google.com
[Press Enter twice]
# SSH banner
nc google.com 22
# What information did you learn?
Port Quick Reference
# View open ports
netstat -tuln # Linux
netstat -an # Windows
ss -tuln # Linux (modern)
# Scan ports
nmap -sV target # TCP with version detection
nmap -sU target # UDP
nmap -p- target # All ports
# Banner grab
nc target port # Netcat
telnet target port # Telnet
curl -I http://target # HTTP headers
# Firewall rules
iptables -L # Linux
netsh advfirewall firewall show rule name=all # Windows
# Service status
systemctl status servicename # Linux
net start # Windows
Common Port Combinations
Web Server:
- 80, 443 (HTTP, HTTPS)
- 8080, 8443 (alternates)
Mail Server:
- 25 (SMTP)
- 110, 995 (POP3, POP3S)
- 143, 993 (IMAP, IMAPS)
Database Server:
- 3306 (MySQL)
- 5432 (PostgreSQL)
- 1433 (MS SQL)
File Server:
- 21 (FTP)
- 22 (SFTP)
- 445 (SMB)
Domain Controller:
- 88 (Kerberos)
- 389 (LDAP)
- 445 (SMB)
- 53 (DNS)
Resources
Tools:
- nmap: Port scanner - nmap.org
- netcat: Network Swiss Army knife
- masscan: Fastest port scanner
- unicornscan: Advanced port scanner
References:
Practice:
- Hack The Box: Practice port scanning
- TryHackMe: Nmap rooms
Next Steps
- Master nmap - Practice different scan types
- Learn NSE scripts - Nmap Scripting Engine
- Understand firewalls - How they filter ports
- Practice service enumeration - Version detection and exploitation
- Study port forwarding - Tunneling and pivoting
Ports are the entry points to services—knowing how to find them, identify them, and exploit them is fundamental to penetration testing!
"Ports: 65,536 doors, some open, some closed, all potentially interesting."