Rattle off the well-known ports an interviewer expects you to know, with TCP or UDP for each.
Show the answer
Say this first
FTP 20 and 21, SSH 22, Telnet 23, SMTP 25, DNS 53 on UDP and TCP, DHCP 67 and 68 UDP, TFTP 69 UDP, HTTP 80, POP3 110, NTP 123 UDP, IMAP 143, SNMP 161 and 162 UDP, BGP 179 TCP, LDAP 389, HTTPS 443 on TCP and on UDP for QUIC, SMB 445, IKE 500 UDP, syslog 514 UDP, RDP 3389, RADIUS 1812 and 1813 UDP, TACACS+ 49 TCP.
Go deeper
Network engineer's list
| Port | Proto | Service |
|---|---|---|
| 20, 21 | TCP | FTP data, FTP control |
| 22 | TCP | SSH, SCP, SFTP |
| 23 | TCP | Telnet |
| 25, 587, 465 | TCP | SMTP relay, mail submission, submission over implicit TLS |
| 49 | TCP | TACACS+ |
| 53 | UDP, TCP | DNS (853 TCP for DNS over TLS) |
| 67, 68 | UDP | DHCP server, DHCP client |
| 69 | UDP | TFTP |
| 80, 443 | TCP | HTTP, HTTPS |
| 443 | UDP | QUIC and HTTP/3 |
| 110, 995 | TCP | POP3, POP3S |
| 123 | UDP | NTP |
| 143, 993 | TCP | IMAP, IMAPS |
| 161, 162 | UDP | SNMP queries, SNMP traps and informs |
| 179 | TCP | BGP |
| 389, 636 | TCP | LDAP, LDAPS |
| 445 | TCP | SMB |
| 500, 4500 | UDP | IKE, IPsec NAT traversal |
| 514 | UDP | Syslog (6514 TCP for syslog over TLS) |
| 520 | UDP | RIP |
| 646 | TCP, UDP | LDP sessions, LDP discovery |
| 830 | TCP | NETCONF over SSH |
| 1812, 1813 | UDP | RADIUS authentication, accounting (old: 1645, 1646) |
| 1985 | UDP | HSRP |
| 3389 | TCP | RDP |
| 3784 | UDP | BFD single-hop control |
| 4789 | UDP | VXLAN |
| 5060, 5061 | UDP, TCP | SIP, SIP over TLS |
Protocols that are not ports
These ride directly on IP and are matched by protocol number: ICMP 1, TCP 6, UDP 17, GRE 47, ESP 50, AH 51, EIGRP 88, OSPF 89, VRRP 112.
They will ask next
What is the difference between active and passive FTP?
Both use TCP 21 for control. In active mode the client sends a PORT command and the server opens the data connection back to the client, from port 20. In passive mode the client asks with PASV and opens the data connection itself to a high port the server names. Passive works through client-side NAT and firewalls, which is why it is the default in most clients.
Why is OSPF not in an ACL as a port number?
OSPF is IP protocol 89, with no TCP or UDP header. You match it with
permit ospf any anyorpermit 89 any any, not with a port.
Traps
- Giving a port number for OSPF, EIGRP, GRE or ESP. They are IP protocol numbers.
- Saying SNMP traps go to 161. Agents listen on 161; managers receive traps and informs on 162.