CompTIA Network+: Ports & Protocols

Introduction

Ports and protocols are essential parts of computer networking. A protocol defines how devices communicate. A port identifies the network service or application receiving the communication.

For CompTIA Network+, you need to recognise common protocols, their purpose, transport protocol, and default port number.

For example, when you visit a website using HTTPS, your computer communicates with a web server using HTTPS over TCP port 443.

1. Ports and Protocols

A port is a logical communication endpoint used by network services.

Port numbers range from 0 to 65,535.

The main port ranges are:

• 0 to 1,023: Well-known ports
• 1,024 to 49,151: Registered ports
• 49,152 to 65,535: Dynamic or ephemeral ports

TCP and UDP use port numbers.

TCP provides reliable, connection-oriented communication. It establishes a connection before transferring data and uses acknowledgements and retransmissions.

UDP provides connectionless communication. It has lower overhead but does not guarantee delivery.

2. FTP and SFTP

FTP stands for File Transfer Protocol. FTP transfers files between a client and server.

FTP normally uses:

• TCP 21: Control connection
• TCP 20: Data connection in active mode

FTP does not encrypt usernames, passwords, or file contents.

SFTP stands for SSH File Transfer Protocol. SFTP transfers files securely through an SSH connection.

SFTP uses:

• TCP 22

SFTP encrypts the communication between the client and server.

Remember:

FTP = TCP 20/21
SFTP = TCP 22

3. SSH

SSH stands for Secure Shell.

SSH provides secure remote access to computers and network devices. Administrators use SSH to manage Linux servers, routers, switches, and other systems.

SSH uses:

• TCP 22

SSH encrypts the session, including authentication credentials and commands.

Example:

An administrator connects to a Linux server remotely using:

ssh user@server

The connection uses TCP port 22.

4. Telnet

Telnet provides remote command-line access to a device.

Telnet uses:

• TCP 23

Telnet does not encrypt communication. Usernames, passwords, and commands travel in plaintext.

For this reason, SSH is preferred for secure remote administration.

Remember:

SSH = secure remote administration = TCP 22
Telnet = insecure remote administration = TCP 23

5. SMTP

SMTP stands for Simple Mail Transfer Protocol.

SMTP is used to send email between mail clients and mail servers, and between mail servers.

Common SMTP ports include:

• TCP 25: Server-to-server SMTP
• TCP 587: Message submission
• TCP 465: SMTP over implicit TLS

Port 25 is commonly used for mail server communication. Port 587 is commonly used when an email client submits outgoing mail to a mail server.

Example:

When an application sends an email through an SMTP service, the application connects to the SMTP server using the configured SMTP port.

6. DNS

DNS stands for Domain Name System.

DNS translates domain names into IP addresses.

For example:

www.example.com → 93.184.216.34

DNS normally uses:

• UDP 53: Standard DNS queries
• TCP 53: DNS transfers and situations requiring TCP

UDP is normally preferred because DNS queries are small and fast.

DNS is essential because users remember domain names more easily than IP addresses.

7. DHCP

DHCP stands for Dynamic Host Configuration Protocol.

DHCP automatically provides network configuration to devices.

A DHCP server typically provides:

• IP address
• Subnet mask
• Default gateway
• DNS server address
• Lease information

DHCP uses:

• UDP 67: DHCP server
• UDP 68: DHCP client

A common DHCP process is known as DORA:

1. Discover
2. Offer
3. Request
4. Acknowledge

A new device broadcasts a DHCP Discover message. A DHCP server responds with an Offer. The client sends a Request, and the server sends an Acknowledgement.

Remember:

DHCP server = UDP 67
DHCP client = UDP 68

8. TFTP

TFTP stands for Trivial File Transfer Protocol.

TFTP provides simple file transfers without the features and security of FTP.

TFTP uses:

• UDP 69

TFTP does not provide authentication or encryption.

Network administrators sometimes use TFTP for tasks such as transferring configuration files or firmware in controlled network environments.

Remember:

TFTP = UDP 69

9. HTTP

HTTP stands for Hypertext Transfer Protocol.

HTTP is used to transfer web content between clients and web servers.

HTTP uses:

• TCP 80

When you access an HTTP website, your browser communicates with the web server using TCP port 80.

HTTP does not encrypt the traffic.

10. HTTPS

HTTPS stands for Hypertext Transfer Protocol Secure.

HTTPS provides secure web communication by using TLS encryption.

HTTPS uses:

• TCP 443

HTTPS protects data exchanged between the browser and web server.

Examples include:

• Online banking
• Online shopping
• Login pages
• Payment systems
• Web applications

Remember:

HTTP = TCP 80
HTTPS = TCP 443

11. NTP

NTP stands for Network Time Protocol.

NTP synchronises clocks between computers and network devices.

NTP uses:

• UDP 123

Accurate time is important for:

• Log analysis
• Authentication
• Security monitoring
• Event correlation
• Certificates
• Network troubleshooting

For example, if servers have incorrect times, security logs from different systems become harder to compare.

Remember:

NTP = UDP 123

12. SNMP

SNMP stands for Simple Network Management Protocol.

SNMP allows administrators to monitor and manage network devices.

SNMP is commonly used to monitor:

• Routers
• Switches
• Servers
• Printers
• Firewalls
• Network interfaces

Common SNMP ports are:

• UDP 161: Queries and management
• UDP 162: Traps and notifications

An SNMP manager might query a router to check CPU usage, memory usage, interface status, or network traffic.

Remember:

SNMP = UDP 161
SNMP traps = UDP 162

13. LDAP

LDAP stands for Lightweight Directory Access Protocol.

LDAP provides access to directory services.

Organisations use directory services to manage information such as:

• Users
• Groups
• Computers
• Authentication information
• Organisational structures

LDAP uses:

• TCP/UDP 389

LDAPS provides LDAP communication over TLS and commonly uses:

• TCP 636

Remember:

LDAP = 389
LDAPS = 636

14. SMB

SMB stands for Server Message Block.

SMB allows systems to share files, folders, printers, and other network resources.

SMB commonly uses:

• TCP 445

SMB is widely used in Windows environments.

Example:

A company might have a shared folder on a file server. Employees access the folder through SMB.

Remember:

SMB = TCP 445

15. Syslog

Syslog provides a standard method for sending and storing system log messages.

Network devices and servers can send logs to a central logging server.

Syslog commonly uses:

• UDP 514

Secure implementations also exist using other transport methods and ports.

Centralised logging helps administrators investigate:

• Failed login attempts
• Network errors
• Firewall events
• Service failures
• Security incidents

Remember:

Syslog = UDP 514

16. SQL

SQL stands for Structured Query Language.

SQL is used to interact with relational databases.

SQL itself is a language rather than a single network protocol, so the port depends on the database system.

Common database ports include:

• MySQL = TCP 3306
• Microsoft SQL Server = TCP 1433
• PostgreSQL = TCP 5432
• Oracle Database = TCP 1521

For Network+ questions, pay attention to the database product named in the question.

17. RDP

RDP stands for Remote Desktop Protocol.

RDP allows users to remotely access graphical desktops, especially Windows systems.

RDP commonly uses:

• TCP 3389
• UDP 3389

RDP is useful for remote administration and accessing Windows desktops.

Because exposed RDP services are frequently targeted by attackers, administrators should protect RDP with strong authentication, network restrictions, VPNs, and appropriate security controls.

Remember:

RDP = TCP/UDP 3389

18. SIP

SIP stands for Session Initiation Protocol.

SIP is used to establish, modify, and terminate communication sessions.

SIP is commonly associated with:

• VoIP
• Video calls
• Internet-based communication

Common SIP ports include:

• UDP 5060
• TCP 5060
• TCP 5061 for SIP over TLS

SIP handles signalling. The actual voice or video media normally uses other protocols, such as RTP.

Remember:

SIP = 5060
Secure SIP = 5061

19. IP Protocol Types

IP operates at the network layer and provides addressing and routing between networks.

Two major versions are:

IPv4

IPv4 uses 32-bit addresses.

Example:

192.168.1.10

IPv6

IPv6 uses 128-bit addresses.

Example:

2001:db8::1

IPv6 provides a much larger address space than IPv4.

Important IPv4 concepts include:

• Unicast: One sender to one receiver
• Broadcast: One sender to all devices on the local broadcast domain
• Multicast: One sender to multiple subscribed receivers

IPv6 does not use traditional broadcast. IPv6 uses multicast and anycast mechanisms instead.

20. Traffic Types

Network traffic describes how data moves between devices.

Unicast

One device communicates with another device.

Example:

Your computer sends a request to a web server.

One sender → One receiver

Broadcast

One device sends traffic to all devices within the relevant broadcast domain.

Example:

DHCP Discover traffic uses broadcast during the initial DHCP process when the client does not yet have an IP address.

One sender → All relevant devices

Multicast

One sender sends traffic to multiple subscribed devices.

Multicast is useful when the same information needs to reach a selected group of receivers.

One sender → Multiple subscribed receivers

Anycast

Anycast uses an address shared by multiple possible destinations. Network routing directs traffic toward a suitable destination, often the nearest or best available one.

Anycast is widely used in distributed services such as DNS.

21. Essential CompTIA Network+ Port Table

Protocol	Port	Transport	Purpose
FTP	20/21	TCP	File transfer
SFTP	22	TCP	Secure file transfer
SSH	22	TCP	Secure remote access
Telnet	23	TCP	Remote access
SMTP	25	TCP	Email transfer
DNS	53	UDP/TCP	Name resolution
DHCP Server	67	UDP	IP configuration
DHCP Client	68	UDP	IP configuration
TFTP	69	UDP	Simple file transfer
HTTP	80	TCP	Web traffic
HTTPS	443	TCP	Secure web traffic
NTP	123	UDP	Time synchronisation
SNMP	161	UDP	Network management
SNMP Trap	162	UDP	Network notifications
LDAP	389	TCP/UDP	Directory services
SMB	445	TCP	File and printer sharing
Syslog	514	UDP	Log messages
LDAPS	636	TCP	Secure directory services
RDP	3389	TCP/UDP	Remote desktop
MySQL	3306	TCP	Database
PostgreSQL	5432	TCP	Database
SIP	5060	TCP/UDP	VoIP signalling
SIP over TLS	5061	TCP	Secure VoIP signalling

22. Ports You Should Memorise First

For the CompTIA Network+ exam, start with these:

22 = SSH/SFTP

23 = Telnet

25 = SMTP

53 = DNS

67/68 = DHCP

69 = TFTP

80 = HTTP

123 = NTP

161/162 = SNMP

389 = LDAP

443 = HTTPS

445 = SMB

514 = Syslog

636 = LDAPS

3389 = RDP

3306 = MySQL

5432 = PostgreSQL

5060/5061 = SIP

23. TCP vs UDP

Knowing the port number is only part of the question. You should also recognise whether the service normally uses TCP or UDP.

TCP provides:

• Connection establishment
• Reliable delivery
• Sequencing
• Error detection
• Retransmission
• Flow control

UDP provides:

• Connectionless communication
• Lower overhead
• Faster transmission
• No guaranteed delivery
• No built-in sequencing or retransmission

Examples of TCP-based services include:

• SSH
• FTP
• HTTP
• HTTPS
• SMB
• RDP

Examples of UDP-based services include:

• DHCP
• DNS queries
• NTP
• SNMP
• TFTP
• Syslog

Some services support both TCP and UDP depending on the implementation or function.

24. How to Approach Network+ Exam Questions

When you see a port question, identify three things:

1. What service is being described?
2. What port does the service use?
3. Does the service use TCP, UDP, or both?

For example:

A question says:

“An administrator needs secure remote command-line access to a Linux server. Which protocol and port should be used?”

Think:

Secure remote command-line access = SSH

SSH = TCP 22

Answer: SSH over TCP port 22.

Another example:

“A workstation needs to automatically obtain an IP address from a DHCP server.”

Think:

Automatic IP configuration = DHCP

DHCP server = UDP 67

DHCP client = UDP 68

25. Quick Memory Guide

Use these associations:

22 = Secure Shell

23 = Telnet

25 = Email

53 = DNS

67/68 = DHCP

69 = TFTP

80 = Web

123 = Time

161/162 = Network management

389 = Directory services

443 = Secure web

445 = Windows file sharing

514 = Logs

636 = Secure LDAP

3306 = MySQL

3389 = Remote desktop

5432 = PostgreSQL

5060/5061 = VoIP signalling

Final Revision Summary

Ports identify network services. Protocols define how those services communicate.

The most important Network+ knowledge is the relationship between the service, port, transport protocol, and purpose.

Focus heavily on:

• SSH, TCP 22
• Telnet, TCP 23
• SMTP, TCP 25
• DNS, UDP/TCP 53
• DHCP, UDP 67/68
• TFTP, UDP 69
• HTTP, TCP 80
• HTTPS, TCP 443
• NTP, UDP 123
• SNMP, UDP 161/162
• LDAP, TCP/UDP 389
• SMB, TCP 445
• Syslog, UDP 514
• LDAPS, TCP 636
• RDP, TCP/UDP 3389
• MySQL, TCP 3306
• PostgreSQL, TCP 5432
• SIP, 5060/5061

If you know what each protocol does, its default port, and whether it uses TCP or UDP, you will have a strong foundation for the Ports & Protocols section of CompTIA Network+.