Ports and Protocols

Ports and Protocols

Computers communicate across networks using agreed rules called
protocols. Applications and services use
network ports to identify the logical communication endpoint
associated with a particular service.

Understanding ports and protocols is fundamental to cybersecurity because security professionals
frequently need to determine which services are communicating, which ports are exposed,
what protocols are being used and whether that communication is expected.

1. What Is a Network Protocol?

A network protocol is a defined set of rules that allows devices or applications
to communicate.

Protocols establish things such as:

• How information is formatted.
• How messages are transmitted.
• How devices identify each other.
• How errors are handled.
• How connections are established and terminated.
• How authentication or encryption may be performed.

Examples include:

• HTTP
• HTTPS
• DNS
• DHCP
• SSH
• FTP
• SMTP
• IMAP
• TCP
• UDP

2. What Is a Network Port?

A network port is a logical number used by networking software to identify
a particular communication endpoint.

TCP and UDP each provide a port-number space from:

0 - 65535

A port number works together with an IP address and transport protocol.
For example:

192.168.1.25:443

This can be understood as:

• 192.168.1.25 — IP address
• 443 — port number
• TCP — transport protocol, where applicable

The combination helps identify a network communication endpoint.

3. Port Numbers and Transport Protocols

TCP and UDP have separate port spaces.
Therefore, TCP port 53 and UDP port 53 are not automatically the same service.

For example:

TCP 443
UDP 443

The number is the same, but the transport protocol is different.
The application behavior depends on the protocol and service using it.

4. Port Number Ranges

Port numbers are commonly grouped into three ranges.

These ranges are useful for understanding network traffic, although modern applications
may not always follow assumptions based only on traditional port assignments.

5. Common Network Ports

Port assignments are conventions rather than proof of what is actually running.
A service can sometimes be configured to listen on a non-standard port.
Therefore, security professionals should verify service behavior rather than relying only
on the port number.

6. TCP

Transmission Control Protocol (TCP) is a connection-oriented transport protocol.
It is designed to provide reliable, ordered delivery of data between endpoints.

TCP uses a connection establishment process commonly called the
three-way handshake.

Client                  Server
  |                       |
  | ---- SYN -----------> |
  | <--- SYN-ACK -------- |
  | ---- ACK -----------> |
  |                       |
  |    Connection ready   |

TCP also provides mechanisms for sequencing, acknowledgements,
retransmission and flow control.

7. UDP

User Datagram Protocol (UDP) is a connectionless transport protocol.
It does not provide the same built-in reliability mechanisms as TCP.

UDP has relatively low protocol overhead and is useful for applications where speed,
timeliness or application-controlled reliability is important.

Examples of technologies that can use UDP include:

• DNS queries.
• DHCP.
• Real-time communication.
• Streaming-related applications.
• Online gaming traffic.

The use of UDP does not automatically mean that communication is insecure.
Security depends on the application protocol and the protections implemented around it.

8. TCP vs UDP

9. HTTP and HTTPS

HTTP is the protocol historically associated with web communication.
Traditional HTTP commonly uses TCP port 80.

HTTPS is HTTP protected using TLS.
Traditional HTTPS commonly uses TCP port 443.

The important security difference is that HTTPS provides cryptographic protection
for the connection through TLS, helping protect confidentiality and integrity
between the communicating endpoints.

Modern web technologies can also use newer transport mechanisms such as
HTTP/3 over QUIC, which uses UDP underneath.
Therefore, cybersecurity students should understand the protocol stack rather than
memorizing port numbers alone.

10. SSH

Secure Shell (SSH) is commonly associated with TCP port 22.
It provides secure remote administration and other secure communication capabilities.

SSH is widely used by system administrators and security professionals to manage
authorized Linux and Unix systems.

A properly secured SSH deployment may use strong authentication,
key-based authentication, access controls and monitoring.

11. Telnet

Telnet is a legacy remote-access protocol traditionally associated
with TCP port 23.

Traditional Telnet does not provide the same encryption protections as SSH.
Credentials and data can therefore be exposed when Telnet is used over an
untrusted network.

For secure remote administration, encrypted alternatives such as SSH are generally used.

12. DNS and Port 53

The Domain Name System (DNS) translates domain names into information
such as IP addresses.

DNS commonly uses port 53 over UDP for ordinary queries, while TCP is also used
for specific DNS operations and situations such as larger responses or zone transfers.

Example:

example.com
     |
     v
DNS Resolver
     |
     v
IP Address

Modern encrypted DNS technologies can use additional protocols and ports,
so port 53 alone does not describe every form of DNS communication.

13. DHCP

Dynamic Host Configuration Protocol (DHCP) automatically provides
network configuration information to clients.

Traditional IPv4 DHCP uses UDP ports:

Server: UDP 67
Client: UDP 68

DHCP can provide information such as:

• IP address.
• Subnet mask.
• Default gateway.
• DNS server information.
• Lease duration.

14. Listening Ports

A service that is waiting for incoming connections is often described as
listening on a port.

For example:

0.0.0.0:80
0.0.0.0:443
127.0.0.1:3306

These examples describe different listening bindings.

A service bound to 127.0.0.1 is normally accessible only from the local system,
while a service bound to all interfaces may be reachable through multiple network interfaces,
subject to firewall and routing controls.

15. Why Open Ports Matter in Cybersecurity

An open or listening port is not automatically a vulnerability.
However, every exposed service represents a potential communication path that should
be understood and appropriately secured.

Security teams may ask:

• What service is listening?
• Is the service required?
• Who should be able to reach it?
• Is authentication enabled?
• Is the protocol encrypted?
• Is the software patched?
• Is the port exposed to the internet unnecessarily?
• Are firewall rules restricting access?
• Are connection attempts being monitored?

16. Ports and Firewalls

Firewalls can use information such as IP addresses, protocols and ports
when applying traffic-control rules.

For example, a simplified policy might conceptually state:

Allow HTTPS to web server
Allow SSH only from administration network
Block unnecessary inbound services

Real firewall policies can be much more sophisticated and may include application identity,
connection state, user identity, geographic information, threat intelligence and other controls.

17. Network Connections on Windows

On Windows, the following command can display active network connections and listening ports:

netstat -ano

The output can include:

• Local address.
• Local port.
• Remote address.
• Remote port.
• Connection state.
• Process ID (PID).

The PID can then be correlated with a process to understand which application
is responsible for the connection.

18. Network Connections on Linux

Modern Linux systems commonly provide the ss utility.
For example:

ss -tuln

This can display TCP and UDP listening sockets without resolving service names.

Another useful command is:

ss -tunap

Depending on privileges and system configuration, this can provide additional process information.

19. Port States

When examining TCP connections, common states include:

Network states provide useful context when troubleshooting or investigating unusual activity.

20. Port Scanning — Defensive Understanding

A port scan is a technique used to determine which network ports
appear accessible on a target system.

Security professionals may use port scanning during authorized vulnerability assessments
and network inventory exercises.

For example, an organization may scan its own servers to identify unnecessary exposed services.

Port scanning should only be performed against systems and networks where the tester
has explicit authorization.

21. Why Port Numbers Alone Are Not Enough

A common beginner mistake is to assume:

Port 80 = HTTP
Port 443 = HTTPS
Port 22 = SSH

These are useful conventions, but a port number does not guarantee what service is actually running.
Administrators can configure services to use non-standard ports, and different software can use
the same port number in different environments.

Security analysis should therefore consider:

• Port number.
• Transport protocol.
• Service behavior.
• Process or application.
• Destination and source.
• Encryption.
• Authentication.
• Firewall policy.
• Expected network architecture.

22. Secure vs Insecure Protocols

The appropriate replacement depends on the environment and requirements.
Security professionals should evaluate the actual protocol implementation rather than
relying solely on the name of a service.

23. Security Investigation Example

Suppose an organization’s server unexpectedly begins accepting connections on TCP port 23.
A security analyst should investigate rather than immediately declaring that the server has been compromised.

Possible investigation steps include:

1. Confirm that the port is actually listening.
2. Identify the process responsible for the port.
3. Determine whether the service is authorized.
4. Check configuration changes.
5. Review authentication logs.
6. Check firewall rules.
7. Review recent software installations or updates.
8. Determine whether external systems can reach the port.
9. Remove or restrict the service if it is unnecessary and authorized administrators approve the change.

This illustrates the importance of combining technical evidence with organizational context.

24. Practical Lab

Use only a computer or network that you own or have explicit permission to inspect.

Windows

netstat -ano

Identify:

• At least one listening TCP port.
• The local IP address.
• The process ID.
• The associated application if available.

Linux

ss -tuln

Identify:

• At least two listening sockets if available.
• The protocol.
• The local address.
• The port number.

Then answer:

1. Which services are listening?
2. Are those services required?
3. Should they be reachable from every network interface?
4. What firewall rules could limit unnecessary access?

25. PHP Example: Basic Port Validation

PHP can be used to validate whether a port number falls within the valid TCP/UDP port range.
This does not test whether a port is open.

<?php

$port = 443;

if ( is_int( $port ) && $port >= 0 && $port <= 65535 ) {
    echo 'Valid network port number.';
} else {
    echo 'Invalid network port number.';
}

This example demonstrates input validation only.
A valid port number does not mean that a service is listening on that port.

26. Cybersecurity Application

Ports and protocols are important in several cybersecurity activities, including:

• Network monitoring.
• Firewall configuration.
• Incident response.
• Asset discovery.
• Vulnerability management.
• Security auditing.
• Network troubleshooting.
• Intrusion detection.
• Server hardening.
• Security architecture.

For example, an intrusion-detection system may alert when an internal workstation
attempts to communicate with an unusual external service.
The port and protocol can provide important context for the investigation.

27. Key Takeaways

• Protocols define rules for network communication.
• Ports identify logical communication endpoints.
• TCP and UDP use separate port-number spaces.
• Port numbers range from 0 through 65535.
• Common ports include 22 for SSH, 53 for DNS, 80 for HTTP and 443 for HTTPS.
• A port number alone does not prove which service is running.
• TCP provides connection-oriented and reliable transport mechanisms.
• UDP provides a simpler connectionless transport mechanism.
• Listening services should be identified and secured appropriately.
• Firewalls can restrict access to network services.
• Port scanning is legitimate when performed with proper authorization.
• Security professionals should correlate ports with processes, services, IP addresses and logs.

28. Final Review Questions

1. What is a network protocol?
2. What is a network port?
3. What is the valid range of TCP and UDP port numbers?
4. What is the difference between TCP and UDP?
5. What service is commonly associated with TCP port 22?
6. What service is commonly associated with port 53?
7. What is commonly associated with TCP port 443?
8. Why can a port number not always be used to identify a service with certainty?
9. What does it mean when a service is listening on a port?
10. Why are unnecessary exposed services a security concern?
11. What command can be used to inspect connections on Windows?
12. What command can be used to inspect listening sockets on Linux?
13. What is port scanning?
14. Why must port scanning be authorized?

Lesson conclusion:
Understanding ports and protocols allows cybersecurity professionals to interpret network
traffic, identify exposed services, troubleshoot communication problems and investigate
potentially unusual activity. The most important skill is not simply memorizing port numbers,
but understanding how IP addresses, transport protocols, ports, services, applications and
security controls work together.