Ports and Protocols, Explained

What it's forThe language browsers and web servers use to request and send pages, images and data. Nothing is encrypted, so anyone on the path can read it or even change it. Today almost every site redirects HTTP to HTTPS.

What it's forHTTP wrapped in TLS encryption. Before anything is sent, the browser checks the site's certificate to confirm it's really talking to that site. After that, pages, passwords and cookies are all encrypted.

What it's forHow mail servers hand email to each other across the internet. When you send a message, your provider's server looks up the recipient's mail server in DNS and delivers the message to it over SMTP on port 25. Servers often upgrade the connection to an encrypted one with STARTTLS when both sides support it.

What it's forThe port your email app uses to hand a new message to your own mail server. You log in, the connection is encrypted with STARTTLS, and your server then delivers the message onward using SMTP. Network+ calls this SMTPS; port 465 (SMTP over TLS from the first byte) is also used.

What it's forAn older way to collect mail: your app downloads new messages from the server and usually deletes them there, so each message ends up on one device only. Handy when mailboxes were small; confusing when you own a phone and a laptop.

What it's forPOP3 inside a TLS-encrypted connection, so your password and your messages can't be read on the way.

What it's forYour mail stays on the server and every device looks at the same mailbox. Read, flagged, deleted and sorted messages stay in sync across your phone, laptop and webmail.

What it's forIMAP encrypted with TLS. This is what phone and laptop mail apps normally use to read mail today.

What it's forOne of the oldest internet protocols. It uses two separate connections: port 21 for commands such as logging in and listing files, and port 20 for the file data itself (in active mode). Usernames, passwords and files all travel unencrypted.

What it's forFile transfer that runs inside an SSH connection, so it uses SSH's port 22 and SSH's encryption. Its official name is the SSH File Transfer Protocol. Despite the name, it isn't FTP with encryption added; it's a separate protocol that does the same job.

What it's forA stripped-down file transfer with no login and no folder browsing, running over UDP. Network devices use it to load configurations and firmware, often while booting. Because anyone can use it, it should never be reachable from untrusted networks.

What it's forHow Windows computers share files and printers. Mapped network drives and paths like \\server\share use SMB. Modern SMB 3 can encrypt its traffic, and port 445 should never be open to the internet: several major worms spread through it.

What it's forLogging in to a server, router or switch and typing commands on it, as if you were sitting in front of it. Everything is encrypted, including your password, so it's safe to use across any network. SSH also carries SFTP file transfers and can tunnel other traffic.

What it's forThe original way to get a command line on a remote device. It does the same job as SSH, but sends everything as plain text: your username, your password and every command. You'll still meet it on old equipment and in lab environments.

What it's forUsing a Windows computer's full graphical desktop from somewhere else. Your keystrokes and mouse movements travel to the remote machine, and pictures of its screen travel back. The connection is encrypted, but port 3389 left open to the internet is a favourite target for attackers, so it's usually reached through a VPN.

What it's forThe internet's phone book. Your device asks a DNS server for the IP address behind a name like example.com, then connects to that address. Normal lookups use UDP; zone transfers between DNS servers and very large answers use TCP. Standard DNS isn't encrypted, which DNS over HTTPS and DNS over TLS (port 853) fix.

What it's forHands out network settings automatically when a device joins: an IP address, subnet mask, default gateway and DNS servers. The exchange has four steps, remembered as DORA: Discover, Offer, Request, Acknowledge.

What it's forKeeps clocks in sync across a network, usually to within a few milliseconds on a local network. Accurate time matters more than it sounds: log timestamps, Kerberos logins and certificate checks all depend on it.

What it's forAn older Windows system for naming computers on a local network and talking to them: 137 for names, 138 for datagrams, 139 for sessions. Modern Windows uses DNS and SMB on 445 instead, but NetBIOS still turns up on older networks.

What it's forLets a monitoring system read information from network devices, such as traffic counters, CPU load and interface status. The manager polls devices on 161; devices send urgent alerts, called traps, to the manager on 162. Versions 1 and 2c use a plain-text "community string" as a password; SNMPv3 adds real authentication and encryption.

What it's forThe standard way for devices to send log messages to a central log server, often part of a SIEM. Each message carries a severity from 0 (emergency) to 7 (debug), so the important ones stand out.

What it's forA standard way to ask a directory questions. A directory is the central database of users, groups and computers, such as Microsoft Active Directory. Apps use LDAP to check logins and to see who belongs to which group. On its own it isn't encrypted; it can be upgraded with StartTLS, or replaced by LDAPS.

What it's forLDAP inside a TLS-encrypted connection, so usernames, passwords and directory data can't be read in transit. The name says SSL for historical reasons; modern servers use TLS.

What it's forThe login system behind Windows domains. You prove who you are once to the domain controller and receive a ticket. You then show tickets to reach file servers and other services, so your password never has to travel to them.

What it's forCentral authentication, authorization and accounting (AAA) for network access. A Wi-Fi access point or VPN gateway passes your login to the RADIUS server, which says yes or no and keeps a record of the session. Only the password is encrypted.

What it's forAAA for administrators logging in to routers, switches and firewalls. It handles authentication and authorization separately, so it can control exactly which commands each admin may run, and it encrypts the entire payload of every packet, not just the password. It was developed by Cisco.

What it's forSets up, manages and ends voice and video calls; it's the "dialling" part of VoIP. The voice itself travels separately, usually over RTP. SIP uses 5060 without encryption and 5061 with TLS.

What it's forMicrosoft's database server. Apps connect on 1433 to read and write data. The database should sit behind a firewall that lets in only the app servers that need it.

What it's forA popular open-source database, used by WordPress and countless other web apps. Like any database port, 3306 should only be reachable from the servers that need it.

What it's forThe first step of an IPsec VPN: the two ends prove who they are and agree on encryption keys. After that, the actual data travels through the encrypted IPsec tunnel. If NAT is in the way, IKE switches to UDP 4500.

What it's forBuilds a VPN tunnel but provides no encryption of its own, so it's almost always paired with IPsec, written L2TP/IPsec. IPsec does the encrypting; L2TP does the tunnelling.

What it's forThe routing protocol of the internet. Internet providers, cloud companies and large organisations each run a network called an autonomous system, and use BGP to tell each other which blocks of IP addresses they can reach, so traffic can find its way across the world.