Reference
Protocols and ports
What each protocol is for, which port and transport it uses, whether it is encrypted, and what to watch for when it is exposed. Search by name, port number or purpose.
36 entries
Showing 36 of 36 entries.
| Protocol | Port | Transport | Purpose | Encrypted | Common use | Security considerations |
|---|---|---|---|---|---|---|
| HTTP | 80 | TCP | Web request/response | No | Legacy web, redirects to HTTPS, internal tooling | Plaintext content and credentials; redirect to HTTPS and enable HSTS |
| HTTPS | 443 | TCP / UDP (QUIC) | Web traffic protected by TLS | Yes | Nearly all web and SaaS traffic, APIs, VPN over TLS | Port based policy is meaningless here; use hostname or application identification |
| DNS | 53 | UDP, TCP | Name resolution | No | Every service lookup; AD service location | Tunnelling and C2 channel; validate DNSSEC, log queries, block open recursion |
| DNS over TLS | 853 | TCP | Encrypted DNS to a resolver | Yes | Privacy preserving client resolution | Can bypass corporate DNS filtering if unmanaged |
| DHCP | 67, 68 | UDP | Automatic host configuration | No | Client addressing on every LAN and WLAN | Rogue servers; enable DHCP snooping on access ports |
| DHCPv6 | 546, 547 | UDP | IPv6 host configuration | No | Managed IPv6 addressing | Enable RA Guard; unmanaged IPv6 can bypass IPv4 controls |
| SSH | 22 | TCP | Encrypted remote administration and transfer | Yes | Linux and network device administration, SFTP, tunnelling | Disable password auth and root login; restrict to jump hosts |
| Telnet | 23 | TCP | Legacy remote terminal | No | Should be disabled; still present on old devices | Credentials in plaintext; replace with SSH |
| RDP | 3389 | TCP / UDP | Windows remote desktop | Yes | Server and desktop administration, session hosts | Never expose to the internet; use a gateway with MFA |
| SMB | 445 | TCP | Windows file and printer sharing | Optional | File shares, Group Policy delivery, application installs | Disable SMBv1, require signing, block at the perimeter |
| LDAP | 389 | TCP / UDP | Directory queries and binds | Optional | Application directory lookups and authentication | Use LDAPS or StartTLS; enforce signing and channel binding |
| LDAPS | 636 | TCP | LDAP over TLS | Yes | Secure directory integration | Certificate lifecycle must be managed on domain controllers |
| Global Catalog | 3268, 3269 | TCP | Forest wide directory search | Optional | Multi domain AD lookups | Prefer 3269 (TLS); restrict to trusted application sources |
| Kerberos | 88 | TCP / UDP | Ticket based authentication | Yes | Windows domain authentication | Clock skew breaks it; watch for Kerberoasting and ticket forging |
| Kerberos kpasswd | 464 | TCP / UDP | Password change service | Yes | Domain password changes | Required for password self service against AD |
| NTP | 123 | UDP | Time synchronisation | No | Estate wide clock accuracy | Amplification abuse if open; drift breaks Kerberos and TLS |
| SNMP | 161, 162 | UDP | Device monitoring and traps | Optional | Network and appliance monitoring | Use v3 authPriv; never leave default community strings |
| Syslog | 514 | UDP / TCP | Event log transport | Optional | Shipping device and Linux logs to a collector | Use TCP with TLS for integrity; UDP silently drops data |
| SMTP | 25 | TCP | Server to server mail transfer | Optional | Inbound mail delivery, relays | Require STARTTLS; never operate an open relay |
| SMTP Submission | 587 | TCP | Authenticated client mail submission | Yes | Applications and devices sending mail | Basic auth submission accounts bypass MFA; prefer modern auth or restricted connectors |
| IMAP / IMAPS | 143, 993 | TCP | Mailbox access | Optional | Mail clients | Legacy IMAP basic auth is a common MFA bypass; disable it |
| POP3 / POP3S | 110, 995 | TCP | Mail download | Optional | Legacy clients and devices | Disable unless a documented dependency exists |
| FTP | 21 | TCP | Legacy file transfer | No | Legacy integrations | Plaintext credentials; migrate to SFTP or FTPS |
| FTPS | 990 | TCP | FTP over TLS | Yes | Partner file exchange | Complex firewall behaviour; SFTP is usually simpler |
| SFTP | 22 | TCP | File transfer over SSH | Yes | Partner and batch file exchange | Use key based auth and chroot per partner |
| IPsec IKE | 500 | UDP | VPN security association negotiation | Yes | Site to site and remote access VPN | Disable legacy proposals such as 3DES and MODP-1024 |
| IPsec NAT T | 4500 | UDP | IPsec traversal of NAT devices | Yes | VPN through NAT | Required by most remote access designs |
| WireGuard | 51820 | UDP | Modern VPN tunnel | Yes | Site and client VPN | Key distribution and revocation must be managed deliberately |
| RADIUS | 1812, 1813 | UDP | Network authentication and accounting | Optional | 802.1X, Wi-Fi, VPN authentication | Use RadSec or IPsec; shared secrets must be strong and unique |
| Microsoft SQL Server | 1433 | TCP | Relational database access | Optional | Line of business application databases | Never expose to the internet; force encryption and disable sa |
| MySQL / MariaDB | 3306 | TCP | Relational database access | Optional | Web application databases | Require TLS; restrict host based access |
| PostgreSQL | 5432 | TCP | Relational database access | Optional | Application and analytics databases | Configure pg_hba strictly; require TLS and scram sha-256 |
| Oracle TNS | 1521 | TCP | Oracle database listener | Optional | ERP and enterprise databases | Restrict listener access and patch promptly |
| Redis | 6379 | TCP | In memory key value store | Optional | Caching, sessions, queues | Historically exposed without auth; require auth and bind privately |
| Kubernetes API | 6443 | TCP | Cluster control plane API | Yes | Cluster administration and automation | Restrict access, enforce RBAC, never expose publicly without controls |
| WinRM | 5985, 5986 | TCP | Windows remote management | Optional | PowerShell remoting and automation | Prefer HTTPS (5986); restrict to management sources |
How to use this table
- Port numbers are conventions, not guarantees. Confirm what is actually listening rather than assuming from the port.
- An unencrypted protocol on an internal network is still a credential exposure. Prefer the encrypted variant where one exists.
- Management protocols (SSH, RDP, WinRM, SNMP, database ports) should reach systems from administrative networks only, never from user VLANs or the internet.