11.2.1 Ports and Protocols

Learn what protocols are in use in computer systems and what ports they're commonly associated with.

A protocol is a set of rules that defines how data should be sent between two computer systems. Each protocol uses a specific port on a computer, so that information sent/received using that protocol doesn't get confused with other protocols.

There are $2^{16}$ unique ports on a computer, or 65,536. Most ports remain unused or blocked by the Default Gateway's firewall to prevent attacks. However, specific ports remain open for use by different protocols.

Port 20/21 - File-Transfer-Protocol [FTP]

FTP is used to transfer files between a server and a client. It's one of the few protocols that makes uses of two ports rather than just one. Port 21 transfers the control information (e.g. auth settings, list of transferred files), while Port 20 transfers the actual data.

Port 22 - Secure-Shell [SSH]

SSH allows two devices to communicate securely through encryption. While it can transfer files, SSH is usually used to remotely login to one device from another.

Port 23 - Telnet

Another protocol that allows us to remotely connect to another device on the same network, but this one doesn't use encryption.

Port 3389 - Remote-Desktop-Protocol [RDP]

First used in Microsoft-Windows, RDP allows users to again sign-in remotely to another Windows-based device on the same network. RDP allows the remote user to actually interact with the devices GUI and syncs the remote input devices to the local ones, enabling usage of the keyboard and mouse.

Port 137/139 - NetBIOS & NetBT

NetBIOS is used to share files and communicate locally. As networks became more complex over time, NetBIOS was combined with TCP to create NetBT. It uses Port 139 to establish the connection between the devices, then uses Port 137 to transfer any needed information between the two devices.

NetBIOS requires each computer to have a unique NetBIOS name for usage to prevent confusion.

Port 445 - Server-Message-Block [SMB]

SMB uses TCP to transfer data via Port 445, and Microsoft uses SMB in CIFS to share files across Windows-based networks.

Port 25 (587) - Simple-Mail-Transfer-Protocol (Secure) [SMTP]

SMTP is the protocol used to send emails.

Port 143 (993) - Internet-Message-Access-Protocol (Secure) [IMAP]

IMAP is one of the protocols used to receive emails. This mail protocol keeps emails on the email server, it doesn't require the local machine to download the email before they read it. This feature is what allows IMAP to pull emails from the same account across different devices.

Port 110 (995) - Post Office Protocol 3 (Secure) [POP3]

POP3 is the other protocol used to receive emails. This mail protocol requires the local machine to download the email from the email server before they can read it.

Port 53 -Domain Name Server [DNS]

The DNS is responsible from translating the top level domain of servers (e.g. https://youtube.com) to their respective IP addresses.

Port 67/68 - Dynamic-Host-Configuration-Protocol [DHCP]

DHCP is responsible for assigning newly connected devices an IP address to be used by the network. When a client connects, the DHCP request is sent on Port 67 to the DHCP server. The DHCP server then sends the IP configuration for the new device back on Port 68.

Port 161/162 - Simple-Network-Management-Protocol [SNMP]

Used for network management and network device monitoring:

• firewalls
• switches
• printers
• workstations
• any network connected device Using SNMP requires the installation of a SNMP manager on a server, and an SNMP agent on every network connected device. The agent gathers information about the device and sends it to the manager. When the manager needs to talk to the agent, Port 161 is used. When an agent needs to alert the manager, Port 162 is used.

Port 389 - Lightweight-Directory-Access-Protocol [LDAP]

Management protocol that stores login info (e.g. passwords) for the entire network. Usually hosted on a service like Microsoft Active Directory (doesn't have to be that, but mostly used).

Port 80 (443) -Hypertext-Transfer-Protocol (Secure) [HTTP]

oh yeah, https Most commonly used to transfer web pages across the Internet with hyperlinks. #XI

#Aplus