Common ports cheat sheet
Port numbers are free points on Security+, Network+, and CCNA, and they are pure memorization. This is the set that shows up again and again, with the one fact about each port that exam questions are really testing. Use the search box to drill the ones you keep missing.
| Port | Protocol | Service | What to remember |
|---|---|---|---|
| 20/21 | TCP | FTP | Data rides on 20, commands on 21. Sends passwords in cleartext, which is why exams keep asking what replaces it: FTPS or SFTP. |
| 22 | TCP | SSH | Encrypted remote login and administration. SFTP and SCP also ride on this port. |
| 23 | TCP | Telnet | Cleartext remote login. On an exam, the answer is always to replace it with SSH. |
| 25 | TCP | SMTP | Server to server mail relay. Clients usually submit mail on 587 instead. |
| 49 | TCP/UDP | TACACS+ | Cisco's AAA protocol for device administration. Encrypts the whole payload, unlike RADIUS. |
| 53 | UDP/TCP | DNS | UDP for normal lookups, TCP for zone transfers and oversized answers. |
| 67/68 | UDP | DHCP | The server listens on 67, the client on 68. Remember the DORA exchange: Discover, Offer, Request, Acknowledge. |
| 69 | UDP | TFTP | No authentication at all. Used for firmware and config files, and risky for exactly that reason. |
| 80 | TCP | HTTP | Unencrypted web traffic. Best practice is to redirect everything here to 443. |
| 88 | TCP/UDP | Kerberos | The authentication backbone of Active Directory. |
| 110 | TCP | POP3 | Downloads mail and usually deletes it from the server. Mostly legacy now. |
| 123 | UDP | NTP | Time synchronization. Broken clocks break Kerberos logins and ruin log timelines. |
| 139 | TCP | NetBIOS Session | Legacy Windows file sharing. Modern SMB runs directly on 445, so block this. |
| 143 | TCP | IMAP | Mail stays on the server and syncs across devices. |
| 161/162 | UDP | SNMP | 161 is for polling devices, 162 is for traps they send back. Only version 3 encrypts. |
| 389 | TCP/UDP | LDAP | Directory lookups against services like Active Directory. Cleartext unless StartTLS or LDAPS protects it. |
| 443 | TCP | HTTPS | Web traffic wrapped in TLS. QUIC also uses this port, over UDP. |
| 445 | TCP | SMB | Windows file and printer sharing. EternalBlue and WannaCry spread through this port, and exams have not forgotten it. |
| 465/587 | TCP | SMTP submission | How mail clients send. 587 with STARTTLS is the modern standard; 465 is the legacy implicit TLS port that came back. |
| 514 | UDP | Syslog | The default path for shipping logs to a collector or a SIEM. |
| 636 | TCP | LDAPS | LDAP wrapped in TLS from the start. Exam questions love contrasting it with plain 389. |
| 993 | TCP | IMAPS | IMAP over TLS. |
| 995 | TCP | POP3S | POP3 over TLS. |
| 1194 | UDP/TCP | OpenVPN | Default OpenVPN port. UDP is the usual choice for speed. |
| 1433 | TCP/UDP | Microsoft SQL Server | A classic scan target. It should never be reachable from the internet. |
| 1723 | TCP | PPTP | Legacy VPN protocol with broken encryption. Know it so you can spot it and replace it. |
| 1812/1813 | UDP | RADIUS | 1812 handles authentication, 1813 handles accounting. Only the password is encrypted. |
| 2049 | TCP/UDP | NFS | Network file sharing for Unix and Linux systems. |
| 3306 | TCP | MySQL | Default port for MySQL and MariaDB databases. |
| 3389 | TCP/UDP | RDP | The top brute force target on the internet. Put it behind a VPN or a gateway, never wide open. |
| 5060/5061 | TCP/UDP | SIP | 5060 sets up VoIP calls, 5061 adds TLS. Signaling only; the voice itself usually rides RTP. |
| 5432 | TCP | PostgreSQL | Default Postgres port, and a favorite finding in scan reports. |
| 5900 | TCP | VNC | Remote screen sharing with historically weak security. Tunnel it through SSH or a VPN. |
| 8080 | TCP | Alternate HTTP | Common for proxies, admin consoles, and app servers in development. |
| No ports match that search. Try a number, a service name, or a word like "mail". | |||
A pattern worth learning: whenever an exam shows you a cleartext protocol, the secure replacement is the point. Telnet gives way to SSH, HTTP to HTTPS, LDAP to LDAPS, FTP to SFTP or FTPS, and SNMPv2 to SNMPv3.
More cheat sheets
Acronyms glossary
97 security acronyms across all 11 certs, each with a one line plain English meaning.
The OSI model
All seven layers, the mnemonic, the TCP/IP mapping, and the facts exams love to test.
Which cert should you take?
Five questions, one recommendation. Match the cert to your experience and your goal.
Ports show up in the practice questions constantly. Premium unlocks all 2,200 of them.
Go Premium: $12/year