Ports are how one machine knows which service you're actually talking to. An IP address gets you to the host; the port gets you to the right door on it. Knowing the common ones cold saves you constantly — reading a firewall rule, spotting something odd in ss -tulpn, or answering the question every IT interview asks. Here are the ones that come up in real work.
The essentials — you should know these cold
| Port | Protocol | Service & note |
|---|---|---|
22 | TCP | SSH — encrypted remote login. Lock it down first. |
80 | TCP | HTTP — unencrypted web traffic |
443 | TCP | HTTPS — encrypted web (TLS). Almost everything today. |
53 | TCP/UDP | DNS — name resolution. UDP for lookups, TCP for zone transfers. |
25 | TCP | SMTP — sending mail between servers |
587 | TCP | SMTP submission — mail clients sending outbound (with auth) |
67 / 68 | UDP | DHCP — automatic IP assignment (server / client) |
Remote access and file transfer
| Port | Protocol | Service & note |
|---|---|---|
3389 | TCP | RDP — Windows Remote Desktop. Never expose to the open internet. |
21 | TCP | FTP — legacy file transfer, unencrypted. Prefer SFTP. |
22 | TCP | SFTP / SCP — file transfer over SSH |
23 | TCP | Telnet — plaintext, obsolete. If you see it open, ask why. |
445 | TCP | SMB — Windows file sharing. A classic ransomware vector. |
Mail, directory, and databases
| Port | Protocol | Service & note |
|---|---|---|
110 / 995 | TCP | POP3 / POP3S — retrieve mail (plain / TLS) |
143 / 993 | TCP | IMAP / IMAPS — sync mail (plain / TLS) |
389 / 636 | TCP | LDAP / LDAPS — directory services (plain / TLS) |
3306 | TCP | MySQL / MariaDB |
5432 | TCP | PostgreSQL |
6379 | TCP | Redis — bind to localhost unless you mean it |
27017 | TCP | MongoDB |
80→443, 143→993, 389→636. When both exist, use the secure one and firewall the other.Ops, monitoring, and the well-known range
| Port | Protocol | Service & note |
|---|---|---|
123 | UDP | NTP — time synchronization |
161 / 162 | UDP | SNMP — device monitoring (poll / trap) |
514 | UDP | Syslog — centralized logging |
8080 | TCP | HTTP alternate — proxies, dev servers, app backends |
3000 / 5000 | TCP | Common local dev server ports |
One number worth memorizing: ports 0–1023 are "well-known," reserved for core services and usually requiring elevated privileges to bind. 1024–49151 are "registered," and 49152–65535 are "ephemeral" — the short-lived ports your own outbound connections borrow.
Keep the full reference card on your desk
The Common Ports & Protocols Reference Card is the print-ready version of this page — every port above plus the ones that only show up when something's broken, laid out for fast scanning during an incident or an interview. Instant download.
Get the reference card →Why this shows up in every interview
Ports are a quick proxy for whether you've actually run infrastructure. An interviewer asking "what port does SSH use?" isn't testing trivia — they're checking that you've locked a box down before. If you can also say why 3389 should never face the internet, or what 445 has to do with ransomware, you've moved from memorized to understood. That's the level the full card is built to get you to.