Network+ Ports and Protocols Cheat Sheet
Think of a port number as an apartment number. The IP address gets traffic to the right building; the port gets it to the right door inside. Objective 1.4 asks you to know those door numbers — and the security and troubleshooting questions later in the exam quietly assume you already do. Here is the whole list, plus the handful of tricks that catch people out.
Learn them in groups, not one by one
Twenty-five random numbers are hard to hold onto. The same numbers are much easier when you group them by the job they do. Every port on this page belongs to one of six families:
- Moving files around — FTP (20/21), SFTP over SSH (22), TFTP (69), SMB (445)
- Email — SMTP (25), POP3 (110), IMAP (143), plus their encrypted versions (587, 995, 993)
- Web pages — HTTP (80), HTTPS (443)
- Looking things up — DNS (53), DHCP (67/68), LDAP (389/636)
- Keeping the network running — NTP (123), SNMP (161/162), Syslog (514)
- Remote access and databases — Telnet (23), RDP (3389), SQL (1433/1521/3306), SIP (5060/5061)
Learn the family first, then the number. It helps because the exam almost never asks “what is port 445?” straight out. Instead you get a story: users suddenly can't reach the shared drive. You work back from the symptom to the service to the port. Knowing the family is what makes that jump quick.
The full N10-009 port list
Start typing to search. You can look up a number, a protocol name, or a phrase like “mail” if you only half-remember what you're after.
| Port | Protocol | Transport | Use |
|---|---|---|---|
| 20/21 | FTP | TCP | File transfer — 20 carries data, 21 carries commands. Unencrypted. |
| 22 | SSH / SFTP / SCP | TCP | Encrypted remote shell and file transfer. The secure replacement for both Telnet and FTP. |
| 23 | Telnet | TCP | Remote access in cleartext, password included. Legacy — expect it to be the wrong answer. |
| 25 | SMTP | TCP | Sending and relaying mail between servers. Unencrypted. |
| 53 | DNS | TCP/UDP | Name resolution. UDP for ordinary lookups, TCP for zone transfers and large responses. |
| 67/68 | DHCP | UDP | Automatic addressing — 67 server, 68 client. Broadcast-based, so it needs a relay to cross a router. |
| 69 | TFTP | UDP | Trivial file transfer. No authentication; used for firmware and config loads. |
| 80 | HTTP | TCP | Unencrypted web traffic. |
| 110 | POP3 | TCP | Retrieving mail. Traditionally downloads then deletes from the server. |
| 123 | NTP | UDP | Time sync. Skewed clocks break Kerberos, certificate validation and log correlation. |
| 143 | IMAP | TCP | Retrieving mail while leaving it on the server, synced across devices. |
| 161/162 | SNMP | UDP | Device monitoring — 161 polling, 162 traps. Use v3 for authentication and encryption. |
| 389 | LDAP | TCP/UDP | Directory lookups for users, groups and computers. Unencrypted. |
| 443 | HTTPS | TCP | Encrypted web traffic via TLS. Also the usual carrier for clientless SSL VPNs. |
| 445 | SMB | TCP | Windows file and printer sharing. Commonly blocked at the perimeter. |
| 514 | Syslog | UDP | Forwarding log messages to a central collector. |
| 587 | SMTP submission (TLS) | TCP | Mail submitted by a client, secured with STARTTLS. The modern replacement for using 25 from clients. |
| 636 | LDAPS | TCP | Encrypted directory services. |
| 993 | IMAPS | TCP | Encrypted IMAP. |
| 995 | POP3S | TCP | Encrypted POP3. |
| 1433 | Microsoft SQL Server | TCP | Database traffic. |
| 1521 | Oracle SQLnet | TCP | Database traffic. |
| 3306 | MySQL | TCP | Database traffic. |
| 3389 | RDP | TCP | Remote desktop to a Windows host. |
| 5060/5061 | SIP | TCP/UDP | VoIP call setup and teardown — 5060 plain, 5061 encrypted. SIP signals the call; the audio rides RTP. |
No ports match that filter.
Secure and insecure pairs
If you only memorize one table on this page, make it this one. A very common question shows you an old protocol sending passwords in the clear and asks what you should switch to. Every insecure protocol below has a secure twin, and the exam loves the swap.
| Insecure | Secure | What changes |
|---|---|---|
| Telnet 23 | SSH 22 | Shell session encrypted instead of cleartext |
| FTP 20/21 | SFTP 22 | File transfer tunnelled over SSH |
| HTTP 80 | HTTPS 443 | TLS wraps the web session |
| SMTP 25 | SMTP 587 | Client submission with STARTTLS |
| POP3 110 | POP3S 995 | Mail retrieval over TLS |
| IMAP 143 | IMAPS 993 | Mail sync over TLS |
| LDAP 389 | LDAPS 636 | Directory queries over TLS |
| SNMP v1/v2c 161 | SNMP v3 161 | Same port — the version is what adds auth and encryption |
Watch that last row, because it breaks the pattern. SNMPv3 stays on port 161 — the security comes from the version, not from moving to a different door. So if you ever see an answer like “switch SNMP to port 162 to secure it,” it's wrong twice: 162 is for traps, and changing ports wouldn't have helped anyway.
How to tell TCP from UDP
Good news — you can usually work this out instead of memorizing it. Here's the difference in one line:
TCP is a phone call. You dial, the other person answers, and you both confirm you heard each other. Slower, but nothing gets lost. UDP is a postcard. You drop it in the mailbox and hope it arrives. Faster, with no guarantees.
So ask yourself: would this traffic rather be correct, or fast?
| If the traffic… | Transport | Examples |
|---|---|---|
| Has to arrive complete and in order | TCP | Web, email, file transfer, databases, RDP |
| Is small, repeated, or needs to be fast | UDP | DNS lookups, DHCP, NTP, SNMP, Syslog, TFTP, voice and video |
| Could be either, depending on the job | TCP/UDP | DNS (zone transfers use TCP), LDAP, SIP |
One exception worth remembering: TFTP uses UDP, even though it moves files. The T stands for Trivial — it's a stripped-down protocol for simple jobs like loading firmware onto a switch, so it skips all the checking. Regular FTP and SFTP both use TCP, as you'd expect.
Protocols that don't use a port at all
Ports live at Layer 4. Some protocols work below that level, so they simply don't have one. That's why “which port does ICMP use?” is a trick question — the answer is none. If ping isn't working, blocking a port was never the cause.
| Protocol | Layer | Use |
|---|---|---|
| ICMP | Network (L3) | The messenger behind ping and traceroute, plus “host unreachable” errors |
| ARP | Link (L2) | Asks “who has this IP?” to find a device's MAC address on the local network |
| TCP | Transport (L4) | The reliable, connection-based delivery itself (IP protocol 6) |
| UDP | Transport (L4) | The fast, no-guarantees delivery itself (IP protocol 17) |
| GRE | Network (L3) | Wraps traffic in a tunnel, but doesn't encrypt it (IP protocol 47) |
| IPSec — AH / ESP | Network (L3) | Adds authentication (51) and encryption (50). Its key exchange, IKE, does use UDP 500. |
Who the traffic is addressed to
Objective 1.4 also covers traffic types. The easiest way in is to picture how you'd send a message to people in a building:
| Type | Who gets it | Where you see it |
|---|---|---|
| Unicast | One specific person | Almost everything you do online |
| Multicast | Everyone who signed up for it | Streaming video, routing updates (OSPF, EIGRP) |
| Anycast | Whoever is nearest | Public DNS servers, content delivery networks |
| Broadcast | Everyone on this floor, shouted out loud | ARP and DHCP. It stops at the router — that's what a broadcast domain means. |
Now test yourself
Spotting a port in a table is much easier than remembering it with nothing in front of you — which is the situation you'll be in on exam day. These cards go both ways: sometimes you get the number and name the service, sometimes the other way round. Be honest with your scoring; the point is finding the gaps, not a good score.
Ports are just one of twenty-five objectives
Once these feel solid, the useful question becomes: what else is shaky? A full timed practice exam gives you a score for every domain, so you can stop guessing where your time should go. It's free and you don't need an account.
Take a free Network+ practice exam