TCP Versus UDP and the Port List
Unit 2: Networking Fundamentals. Lesson 6 of 41 in APlus Academy Core 1.
Port numbers are the most reliable points on the exam. A port identifies which service on a computer should receive a packet, and the well-known ones never change.
TCP versus UDP
- TCP (transmission control protocol) opens a connection with a three-way handshake (SYN, SYN-ACK, ACK), numbers every segment, acknowledges receipt, and resends anything lost. It is reliable and ordered, at the cost of overhead. Web pages, email, file transfers, and remote desktop use it.
- UDP (user datagram protocol) just sends. No handshake, no acknowledgments, no retransmission. It is fast and light, which suits DNS lookups, DHCP, streaming video, voice calls, SNMP, syslog, and TFTP, where a late packet is worth less than a fast one.
Well-known ports run from 0 to 1023, registered ports from 1024 to 49151, and the rest are dynamic ports a client picks for its side of a connection.
The ports to know cold
- 20 and 21 FTP (TCP): file transfer in clear text; 21 carries commands, 20 carries data.
- 22 SSH (TCP): encrypted remote shell; SFTP and SCP ride on it.
- 23 Telnet (TCP): clear-text remote terminal; replaced by SSH.
- 25 SMTP (TCP): mail moving between servers; clients submit on 587 with TLS.
- 53 DNS (UDP, with TCP for large answers and zone transfers): names to addresses.
- 67 and 68 DHCP (UDP): the server listens on 67, the client on 68.
- 80 HTTP (TCP): web, unencrypted.
- 110 POP3 (TCP): download mail to one device; 995 is the secure version.
- 137 to 139 NetBIOS (UDP 137 and 138, TCP 139): legacy Windows naming and file sharing.
- 143 IMAP (TCP): mail stays on the server and syncs to every device; 993 is the secure version.
- 161 and 162 SNMP (UDP): device monitoring; 162 receives traps.
- 389 LDAP (TCP): directory lookups; 636 is LDAPS.
- 443 HTTPS (TCP): web over TLS.
- 445 SMB (TCP): Windows file and printer sharing.
- 3389 RDP (TCP): Remote Desktop.
- Also worth knowing: 123 NTP (UDP) time, 514 syslog (UDP) logs, 5900 VNC (TCP) screen sharing.
Secure replacements
Every clear-text protocol has an encrypted partner: 23 Telnet gives way to 22 SSH, 80 HTTP to 443 HTTPS, 110 POP3 to 995, 143 IMAP to 993, 389 LDAP to 636, and 21 FTP to SFTP on 22 (or FTPS on 990). When a question asks for the secure way to do something, pick the encrypted port.
Where ports show up in real work
A firewall rule that blocks port 445 stops file sharing. A mail client that cannot send but can receive has the wrong SMTP port. A web server reachable on 80 but not 443 has a certificate or listener problem. A printer that scans to a share needs 445 open to the file server.
TCP Versus UDP and the Port List, explained slowly
Ports as doors on a building
An IP address is a building's street address; a port is the door inside it that leads to one service. Mail goes to door 25, web to door 80, file sharing to door 445. A firewall is a guard who checks which door you are asking for. Memorizing the doors is unavoidable; the trick is to memorize them in groups that tell a story.
TCP and UDP, the two delivery services
TCP UDP setup three-way handshake (SYN, SYN-ACK, ACK) none reliability acknowledged, retransmitted, ordered best effort overhead higher minimal suits web, mail, file transfer, remote desktop DNS, DHCP, VoIP, streaming, SNMP, syslog, TFTP analogy certified mail with a signature a postcard
Voice and video prefer UDP because a packet that arrives late is useless; resending it would only add delay. File transfer prefers TCP because one missing byte corrupts the file.
The port list, told as stories
group port(s) protocol story
file transfer 20, 21 FTP 21 talks, 20 carries the data
22 SSH/SFTP the secure everything: shell, file copy
445 SMB Windows shares
137 to 139 NetBIOS the ancestors of SMB
remote access 23 Telnet clear text, one less than 22, replaced by 22
3389 RDP Remote Desktop
5900 VNC cross-platform screen sharing
mail 25 SMTP mail out between servers (587 for clients with TLS)
110 POP3 mail in, download and delete (995 secure)
143 IMAP mail in, keep on server, sync everywhere (993 secure)
web 80 HTTP the web
443 HTTPS the web with TLS
plumbing 53 DNS names (UDP; TCP for big answers)
67, 68 DHCP server 67, client 68 (UDP)
123 NTP time (UDP)
161, 162 SNMP monitoring; 162 traps (UDP)
389 LDAP directory (636 LDAPS)
514 syslog logs (UDP)Worked examples
- A branch office cannot send email but receives fine. Receiving uses IMAP or POP3; sending uses SMTP. Check that the client is set to the right SMTP port (587 or 25) and that the firewall allows it.
- A new firewall rule blocks "all TCP except 80 and 443." Users can browse, but Remote Desktop to the office (3389) stops, file shares (445) stop, and mail clients (143, 993, 587) stop. DNS still works because it is UDP 53.
- A security audit says "Telnet is in use on the switches." The fix is to enable SSH (22) and disable Telnet (23), because Telnet sends passwords in clear text.
- A scanner set to "scan to folder" cannot save to the file server. That is SMB, port 445, likely blocked between the printer VLAN and the server.
Secure partners
clear text port secure version port Telnet 23 SSH 22 HTTP 80 HTTPS 443 FTP 21 SFTP (over SSH) 22 (or FTPS 990) POP3 110 POP3S 995 IMAP 143 IMAPS 993 LDAP 389 LDAPS 636 SMTP 25 SMTP with TLS 587
How the exam asks it
- "Which port does RDP use?" 3389.
- "Which protocol uses port 445?" SMB.
- "Which two ports does DHCP use?" 67 and 68.
- "A technician needs an encrypted alternative to Telnet." SSH, port 22.
- "Which transport protocol does streaming video typically use, and why?" UDP, because speed matters more than retransmission.
- "Which protocol keeps mail on the server so it appears on every device?" IMAP, port 143 (993 secure).
What to memorize
- The whole table. Say it out loud daily until 3389 and 445 come without thinking.
- TCP reliable and connection-oriented; UDP fast and connectionless. DNS, DHCP, NTP, SNMP, syslog, TFTP, voice, and video are UDP.
- Secure pairs: 22 for 23, 443 for 80, 993 for 143, 995 for 110, 636 for 389.