Class notes · Professor Messer, CompTIA A+ 220-1201 Core 1 · Objective 2.1

Quick reference: the short version of this lesson is the Common Ports cheat sheet, part of Section 2. Port fundamentals (well-known vs ephemeral) are in the Section 2 primer.

Learning objectives

By the end of these notes you should be able to:

1. Explain why knowing port numbers matters for troubleshooting and firewall configuration.
2. State the port and protocol (TCP/UDP) for each service in this lesson, and explain what each service does.
3. Distinguish encrypted protocols from their unencrypted equivalents (SSH/Telnet, HTTP/HTTPS, LDAP/LDAPS).
4. Distinguish protocols that send mail from protocols that receive it.
5. Explain DNS and DHCP’s roles, and why each commonly needs redundancy.
6. Describe SMB, NetBIOS and direct (NetBIOS-less) communication on Windows networks.
7. Explain what a directory service is, and how LDAP is used to query one.
8. Describe RDP and what it’s used for.

1. Why port numbers matter

You’ll use these port numbers in two everyday situations:

Situation

Why the port matters

Troubleshooting communication

Knowing the expected port tells you what “should” be happening, and where to look when it isn’t

Firewall configuration

Firewalls commonly use TCP/UDP port number as one of the criteria for allowing or blocking traffic

Memorising this list can feel tedious at first, but using these applications, configuring firewalls and troubleshooting networks makes them second nature. For the exam, know the port, the protocol (TCP/UDP), and why the service matters — not just the number.

2. File transfer — FTP

Port

Protocol

Service

20

TCP

FTP — active data transfer

21

TCP

FTP — control / administration

FTP (File Transfer Protocol) is a generic protocol, usable from many operating systems, for moving files between devices.

• Authentication: FTP usually asks for a username, password or other credential — but it can also be configured for anonymous login, open to anyone.
• More than transfer: FTP can also list files in a directory, and perform administrative actions — add, delete, and rename files.
• Two ports, different roles: different FTP implementations may use one or both — 20 for moving the actual data, 21 for the control connection that manages the session.

3. Remote command line — SSH and Telnet

3.1 SSH — Secure Shell

Port

Protocol

Service

22

TCP

SSH

To administer a remote device at the command line securely, the whole session must be encrypted. SSH provides this encrypted link, and is the modern standard for remote command-line administration.

3.2 Telnet

Port

Protocol

Service

23

TCP

Telnet

Telnet (telecommunications network) does the same visible job as SSH — a remote command-line login — but with no encryption at all. Everything, including your username and password, is sent in the clear.

Exam tip: Telnet and SSH look and feel identical to the user. The difference that matters is encryption. Most organisations block Telnet and require SSH — but some very old devices only support Telnet, so you may still meet it.

3.3 Worked example — choosing between them

A technician needs to reconfigure an old network switch from the command line, and the switch’s manual only mentions Telnet.

1. Try SSH first, in case the firmware supports it even if undocumented.
2. If only Telnet works, treat the session as insecure: don’t send it over an untrusted network, and change any credentials used over it as soon as a secure method is available.
3. Recommend a plan to replace or upgrade the device, since it can’t be administered securely.

4. Email

4.1 Sending mail — SMTP

Port

Protocol

Service

25

TCP

SMTP

SMTP (Simple Mail Transfer Protocol) sends email — both server to server, and sometimes from a local device to its mail server when it first submits a message. You may configure SMTP with its port number both on a mail server and on individual devices.

4.2 Receiving mail — POP3 and IMAP

Port

Protocol

Service

110

TCP

POP3

143

TCP

IMAP

POP3 (Post Office Protocol v3)

IMAP4 (Internet Message Access Protocol v4)

Function

Downloads mail to one device

Manages the inbox on the server

Multiple devices

Not designed for it

Synchronises across every client — folders, read status and moves all stay consistent

Newer / more features

No

Yes

Exam tip: SMTP sends; POP3 and IMAP receive. IMAP is the one that keeps multiple devices in sync.

5. Name resolution — DNS

Port

Protocol

Service

53

UDP

DNS

Devices communicate using IP addresses — like 162.159.246.164. But people don’t type IP addresses into a browser; they type a fully qualified domain name (FQDN), such as www.professormesser.com. DNS (Domain Name System) translates the FQDN into the IP address needed for the actual communication.

Because almost no one memorises IP addresses, DNS is one of the most important services on any network. It’s common to run multiple DNS servers for redundancy, so name resolution keeps working even if one server is unavailable.

6. Automatic addressing — DHCP

Port

Protocol

Service

67

UDP

DHCP (server)

68

UDP

DHCP (client)

Your computer’s IP address, subnet mask, default gateway and DNS servers almost certainly weren’t typed in by hand — DHCP (Dynamic Host Configuration Protocol) configures them automatically and seamlessly when the device starts up.

DHCP concept

What it means

Pool

A range of available IP addresses held by the DHCP service

Lease

A device is given an address for a set period of time

Renew

The device can ask to keep the address when the lease is due to expire

Release

The device can give the address back to the pool instead

Reservation

An administrator can configure a device (e.g. a printer or server) to always receive the same IP address

DHCP can run on a standalone server or appliance, or be built into a small office/home office (SOHO) wireless router.

7. The web — HTTP and HTTPS

Port

Protocol

Service

80

TCP

HTTP

443

TCP

HTTPS

HTTP

HTTPS

Full name

Hypertext Transfer Protocol

Hypertext Transfer Protocol Secure

Encryption

None — sent in the clear

Encrypted

Most sites you browse today use HTTPS, but plenty of services still use plain HTTP over port 80.

8. Windows file sharing — SMB, CIFS and NetBIOS

8.1 SMB / CIFS

SMB (Server Message Block) — also known as CIFS (Common Internet File System) — is Windows’s protocol for transferring data between devices: files, print queue traffic, and other information Windows systems exchange.

8.2 NetBIOS

Port

Protocol

Service

137

UDP

NetBIOS Name Service

139

TCP

NetBIOS Session Service (file transfer)

Older Windows systems used NetBIOS alongside TCP/IP:

• NetBIOS Name Service (UDP 137) resolves NetBIOS names — similar in purpose to DNS, but for the older Windows naming system.
• NetBIOS session (TCP 139) sets up the sessions used to transfer files.

8.3 Direct (NetBIOS-less) communication

Port

Protocol

Service

445

TCP

SMB direct / NetBIOS-less

Most modern Windows versions connect directly between IP addresses, without going through NetBIOS at all — called direct or NetBIOS-less communication, over TCP port 445.

8.4 Worked example — mapping a network drive

A user maps \\fileserver\share on a modern Windows 11 PC.

1. Traffic mostly uses TCP 445 — direct SMB, no NetBIOS involved.
2. If a very old device is on the network and still relies on NetBIOS name resolution, UDP 137 and TCP 139 may still appear in captures.
3. If 445 is blocked by a firewall between the PC and the server, the mapped drive fails, even though the server is reachable by other means (like a ping).

9. Directory services — LDAP

Port

Protocol

Service

389

TCP

LDAP

Most organisations keep a central database — a directory service — describing devices, users and resources on the network. LDAP (Lightweight Directory Access Protocol) — or its secure form, LDAPS — is used to query it.

How a directory is structured:

• An organisation.
• Organisational units within it — for example Production, Support and Engineering.
• Common names for individuals within those units — for example Sam or Daniel.
• Named resources, such as a database called “tech docs”.

LDAP lets you look up where these components are, and in some cases provides extra details, such as authentication information for a user. The most common real-world use of LDAP is Microsoft’s Active Directory, which is queried using the LDAP protocol.

Note (beyond this lesson): the lesson names LDAPS but doesn’t give its port. LDAPS (LDAP over TLS) uses TCP 636 — the encrypted counterpart to LDAP’s 389, matching the HTTP/HTTPS pattern in section 7.

10. Remote desktop — RDP

Port

Protocol

Service

3389

TCP

RDP

RDP (Remote Desktop Protocol) lets you view and share the desktop of a remote device, primarily Windows.

• You can control the whole computer, or just run a single application remotely.
• The RDP client isn’t limited to Windows. Clients exist for macOS, Linux/Unix, iPhone and other platforms, letting you reach a Windows machine from almost anywhere.
• This is one reason remote support works at scale: with users spread around the world, RDP means you don’t have to visit every desk in person.

11. All the ports at a glance

Port

Protocol

Service

Encrypted?

20

TCP

FTP (data)

No

21

TCP

FTP (control)

No

22

TCP

SSH

Yes

23

TCP

Telnet

No

25

TCP

SMTP

No

53

UDP

DNS

No

67

UDP

DHCP (server)

No

68

UDP

DHCP (client)

No

80

TCP

HTTP

No

110

TCP

POP3

No

137

UDP

NetBIOS Name Service

No

139

TCP

NetBIOS Session Service

No

143

TCP

IMAP

No

389

TCP

LDAP

No

443

TCP

HTTPS

Yes

445

TCP

SMB (direct)

Supports encryption (SMB 3)

3389

TCP

RDP

Yes

Note (beyond this lesson): this lesson doesn’t cover LDAPS (636), SMTP submission (587), or the secure forms of POP3 and IMAP (995, 993). These are common exam and real-world extras.

12. Security perspective

• Prefer the encrypted version whenever one exists: SSH (22) over Telnet (23); HTTPS (443) over HTTP (80); LDAPS over LDAP (389).
• Never expose RDP (3389) directly to the internet. It’s one of the most attacked services in existence. Use a VPN, a remote desktop gateway, or a broker service instead, and enforce MFA.
• Telnet’s cleartext credentials can be captured by anyone able to see the traffic. If a legacy device forces its use, isolate it on its own network segment.
• DHCP and DNS are trust points. A rogue DHCP server can hand out a malicious gateway or DNS server; managed switches defend against this with DHCP snooping. A hijacked or incorrect DNS setting can silently redirect users to fake sites.
• FTP’s anonymous login is convenient but risky if used for anything sensitive — prefer authenticated FTP, or SFTP/FTPS, for real data.
• SMB (445) shouldn’t be exposed to the internet either. It’s been the entry point for major worm outbreaks (e.g. EternalBlue/WannaCry) when left open.
• Know what’s listening. netstat -an (or Get-NetTCPConnection -State Listen) shows which of these ports are actually open on a machine — compare against what you expect.

Summary

• Ports matter for troubleshooting and firewall rules — know the number, the protocol and why the service matters.
• File transfer: FTP, TCP 20 (data) and 21 (control); can list, add, delete and rename files; supports authenticated or anonymous login.
• Remote command line: SSH (TCP 22, encrypted) is the modern standard; Telnet (TCP 23) is unencrypted and largely retired.
• Email: SMTP (TCP 25) sends; POP3 (TCP 110) downloads to one device; IMAP (TCP 143) synchronises across many devices.
• DNS (UDP 53) resolves names to IP addresses; run redundant servers.
• DHCP (UDP 67/68) automatically configures IP settings, using pools, leases, renewals and reservations.
• Web: HTTP (TCP 80, unencrypted) and HTTPS (TCP 443, encrypted).
• Windows sharing: SMB/CIFS; legacy NetBIOS (UDP 137 name service, TCP 139 sessions); modern direct/NetBIOS-less communication over TCP 445.
• LDAP (TCP 389) queries a directory service such as Active Directory, organised into organisations, organisational units and common names.
• RDP (TCP 3389) shares or controls a remote desktop, from many client operating systems.

Glossary

Term

Definition

FTP

File Transfer Protocol

Anonymous login

Logging in without a specific username or password

SSH

Secure Shell — encrypted remote command-line access

Telnet

Unencrypted remote command-line protocol

SMTP

Simple Mail Transfer Protocol — sends email

POP3

Post Office Protocol v3 — downloads mail to one device

IMAP4

Internet Message Access Protocol v4 — synchronises mail across devices

DNS

Domain Name System — resolves names to IP addresses

FQDN

Fully qualified domain name, e.g. www.example.com

Redundancy

Having more than one server so service continues if one fails

DHCP

Dynamic Host Configuration Protocol — automatic IP configuration

Pool / lease / reservation

DHCP terms for available addresses / a temporary assignment / a fixed assignment

HTTP / HTTPS

Hypertext Transfer Protocol / its encrypted, secure form

SMB

Server Message Block — Windows file and resource sharing

CIFS

Common Internet File System — another name for SMB

NetBIOS

An older Windows name resolution and session protocol

Direct / NetBIOS-less

Modern SMB communication directly over IP, without NetBIOS

Directory service

A central database of network users, devices and resources

LDAP / LDAPS

Lightweight Directory Access Protocol / its secure form

Active Directory

Microsoft’s directory service, queried using LDAP

RDP

Remote Desktop Protocol

Review questions

1. Give two reasons knowing common port numbers matters in practice.
2. What are TCP ports 20 and 21 used for, and how do their roles differ?
3. What port and protocol does SSH use? What’s its key advantage over Telnet?
4. Why do most organisations block Telnet?
5. Which protocol sends email, and which receive it?
6. What’s the key difference between POP3 and IMAP for someone using two devices?
7. Which port and protocol does DNS use, and why is DNS redundancy common?
8. List the four things DHCP typically configures automatically.
9. What’s the difference between a DHCP lease and a DHCP reservation?
10. Which ports distinguish HTTP from HTTPS, and what’s the difference between them?
11. What port does modern Windows use for direct SMB communication, without NetBIOS?
12. What are the two NetBIOS ports, and what does each do?
13. What does LDAP do, and what’s a well-known example of a directory it can query?
14. What port does RDP use, and name two operating systems, other than Windows, that can run an RDP client.

Answer key

1. Troubleshooting communication problems, and configuring firewalls, which commonly filter by port number.
2. TCP 20 is the active data transfer; TCP 21 is the control/administration connection. Different FTP implementations may use one or both.
3. TCP port 22. It’s encrypted, unlike Telnet, which sends everything in the clear.
4. Because Telnet sends all communication, including credentials, unencrypted.
5. SMTP sends; POP3 and IMAP receive.
6. IMAP synchronises the inbox (folders, read status, moves) across every device; POP3 simply downloads mail to one device.
7. UDP port 53. Redundancy ensures name resolution keeps working even if one DNS server is unavailable — and almost everything depends on DNS.
8. IP address, subnet mask, default gateway and DNS servers.
9. A lease is temporary and can be renewed or released; a reservation always assigns the same IP address to a specific device (e.g. a printer or server).
10. HTTP uses TCP 80 (unencrypted); HTTPS uses TCP 443 (encrypted).
11. TCP port 445 — direct, or NetBIOS-less, communication.
12. UDP 137 (NetBIOS Name Service) and TCP 139 (NetBIOS session service, used to set up file transfers).
13. It queries a directory service — a central database of users, devices and resources, organised into organisations, organisational units and common names. Microsoft Active Directory is a well-known example.
14. TCP port 3389. Any two of: macOS, Linux/Unix, iPhone (and other RDP client platforms).