Ports & Protocols Cheat Sheet
Every TCP and UDP port and IP protocol number the CCNA 200-301, CompTIA A+, and Security+ SY0-701 exams expect you to know, in one searchable cheat sheet you can filter by exam, drill, print or export. Plaintext protocols are flagged with their encrypted replacements.
Compiled by Mani Poopal, CCIE certified, 20+ years in enterprise networking and lead CCNA and Security+ instructor at CISNET.38 ports and 13 IP protocol numbers, checked against the CCNA 200-301 v1.1, CompTIA A+ 220-1201 and 220-1202, and Security+ SY0-701 objectives in September 2026. Assignments follow the IANA Service Name and Transport Protocol Port Number Registry, trimmed to what the three exams actually test.
Common TCP and UDP port numbers
Search by number, service, nickname or secure alternative: 138 finds NetBIOS and 990 finds the FTPS row. The exam buttons write your choice into the address bar, so a filtered view is a link you can bookmark or send to a study partner.
Ports by exam
38 entries. Exports and the printed sheet contain exactly what is on screen, so filter first and take that away.
| Port | Transport | Service | Notes |
|---|---|---|---|
| 20 | TCP | FTP (data) plaintext | File Transfer Protocol data channel. Active mode uses this for the actual file transfer.Secure alternative: SFTP (22) or FTPS (990) |
| 21 | TCP | FTP (control) plaintext | FTP command channel. Credentials cross the wire in plaintext.Secure alternative: SFTP (22) or FTPS (990) |
| 22 | TCP | SSH / SCP / SFTP | Encrypted remote shell. Also carries SCP and SFTP file transfer. |
| 23 | TCP | Telnet plaintext | Unencrypted remote shell. Still on exams as the insecure counterpart to SSH.Secure alternative: SSH (22) |
| 25 | TCP | SMTP plaintext | Mail transfer between servers.Secure alternative: SMTPS (465) or STARTTLS on 587 |
| 49 | TCP | TACACS+ | Cisco AAA protocol. Encrypts the whole payload and separates authentication from authorization. |
| 53 | TCP/UDP | DNS | Name resolution. UDP for queries, TCP for zone transfers and responses over 512 bytes. |
| 67 | UDP | DHCP (server) | Server side of DHCP. Client broadcasts to 67, server answers to 68. |
| 68 | UDP | DHCP (client) | Client side of DHCP. |
| 69 | UDP | TFTP plaintext | Trivial FTP. No authentication. Commonly used for IOS images and config backups.Secure alternative: SCP (22) |
| 80 | TCP | HTTP plaintext | Unencrypted web traffic.Secure alternative: HTTPS (443) |
| 88 | TCP/UDP | Kerberos | Ticket-based authentication. The default in Active Directory domains. |
| 110 | TCP | POP3 plaintext | Mail retrieval that downloads and typically deletes from the server.Secure alternative: POP3S (995) |
| 123 | UDP | NTP | Time synchronisation. Accurate time matters for logs, certificates and Kerberos. |
| 137-139 | TCP/UDP | NetBIOS | Legacy Windows name service, datagram and session services. |
| 143 | TCP | IMAP plaintext | Mail retrieval that keeps messages on the server and syncs state.Secure alternative: IMAPS (993) |
| 161 | UDP | SNMP | Network monitoring polls. v1 and v2c use plaintext community strings. |
| 162 | UDP | SNMP trap | Unsolicited alerts sent from device to management station. |
| 179 | TCP | BGP | Border Gateway Protocol. The only routing protocol that rides on TCP. |
| 389 | TCP/UDP | LDAP plaintext | Directory lookups, including Active Directory.Secure alternative: LDAPS (636) |
| 443 | TCP | HTTPS | Web traffic over TLS. Also the usual transport for SSL VPNs. |
| 445 | TCP | SMB / CIFS | Windows file and printer sharing. A frequent ransomware and worm target. |
| 465 | TCP | SMTPS | SMTP wrapped in TLS from the start of the connection. |
| 500 | UDP | ISAKMP / IKE | IPsec key exchange, phase 1 of tunnel establishment. |
| 514 | UDP | Syslog | Centralised log collection. |
| 587 | TCP | SMTP submission | Mail submission from a client, normally with STARTTLS and authentication. |
| 636 | TCP | LDAPS | LDAP over TLS. |
| 993 | TCP | IMAPS | IMAP over TLS. |
| 995 | TCP | POP3S | POP3 over TLS. |
| 1433 | TCP | Microsoft SQL Server | Default SQL Server listener. |
| 1812 | UDP | RADIUS (auth) | AAA authentication and authorization. Encrypts only the password field. |
| 1813 | UDP | RADIUS (accounting) | RADIUS accounting records. |
| 3306 | TCP | MySQL | Default MySQL and MariaDB listener. |
| 3389 | TCP | RDP | Remote Desktop. Heavily targeted when exposed to the internet. |
| 5060 | TCP/UDP | SIP plaintext | VoIP call signalling, unencrypted.Secure alternative: SIPS (5061) |
| 5061 | TCP | SIPS | SIP signalling over TLS. |
| 5900 | TCP | VNC | Remote framebuffer screen sharing. |
| 8080 | TCP | HTTP alternate | Common proxy and application-server port. |
Port ranges
| Range | Name | Used for |
|---|---|---|
| 0 to 1023 | Well known | IANA-assigned services. Binding usually needs elevated privileges. |
| 1024 to 49151 | Registered | Assigned to specific applications on request. |
| 49152 to 65535 | Dynamic / ephemeral | Source ports for outbound client connections. |
CCNA 200-301 ports to memorise
The CCNA tests ports where they touch configuration and troubleshooting, so the list is infrastructure heavy rather than application heavy: 22 SSH, 23 Telnet, 53 DNS, 67 and 68 DHCP, 69 TFTP, 80 HTTP, 123 NTP, 161 and 162 SNMP, 179 BGP, 443 HTTPS, 514 syslog, and 1812 with 1813 for RADIUS. Protocol numbers matter just as much, because ACL and routing questions use them: 1 ICMP, 6 TCP, 17 UDP, 47 GRE, 50 ESP, 88 EIGRP and 89 OSPF. Set the exam filter to CCNA to see only these, then read Cisco ACLs explained for how the numbers behave inside a real access list, or the CCNA study guide for where they sit in the blueprint.
CompTIA A+ 220-1201 ports to memorise
A+ publishes its port list explicitly, and it is short: 20 and 21 FTP, 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 67 and 68 DHCP, 80 HTTP, 110 POP3, 137 to 139 NetBIOS, 143 IMAP, 389 LDAP, 443 HTTPS, 445 SMB, and 3389 RDP. The questions are support shaped, so expect a scenario about mail not syncing across devices or a mapped drive failing rather than a request to recite a number. Pair the list with TCP versus UDP and check what changed in the current A+ objectives before you revise from an older list.
Security+ SY0-701 ports to memorise
Security+ cares less about the raw number than the pairing: 21 FTP against SFTP on 22, 23 Telnet against SSH, 80 against 443, 110 POP3 against 995, 143 IMAP against 993, and 389 LDAP against 636 LDAPS. Add the ports that anchor scenario questions: 88 Kerberos, 49 TACACS+, 1812 and 1813 RADIUS, 445 SMB, 3389 RDP, 500 for IKE, and 514 for syslog feeding a SIEM. Work through them alongside the Security+ acronym drill and the SY0-701 study guide, since the exam mixes acronyms and port numbers in the same stem.
Port by port: what each one actually does
The table gives you the number. These sections give you the reason a question gets asked about it, which is what scenario items really test. Jump to a port:
Ports 20 and 21 (FTP): the control and data split
FTP uses two ports at once. Port 21 carries the control channel, where the login and every command travel, and in plain FTP that includes the password in clear text. Port 20 carries the data channel in active mode, opened back toward the client by the server, which is why active FTP is awkward through a firewall. Passive mode keeps the data connection client initiated on a high port instead. Both are unencrypted, so the exam answer is SFTP on 22 or FTPS on 990.
Port 22 (SSH): one port, three services
TCP 22 is an encrypted remote shell, and it also carries SCP and SFTP, so one firewall rule covers management access and file transfer on a Cisco device. On IOS you generate the key pair with crypto key generate rsa, then restrict the VTY lines with transport input ssh, which is the configuration half of the exam question. Because 22 answers both remote access and secure file transfer, it is the correct option more often than any other port.
Port 23 (Telnet): the insecure counterpart you still have to know
Telnet gives you the same remote shell as SSH with none of the encryption, so the session, the password and every command are readable to anyone capturing the traffic. It stays on all three syllabuses as the wrong answer that proves you know the right one. The trap in ACL questions is that denying TCP 23 stops Telnet and leaves SSH on 22 wide open, and the reverse is also true. Switches still ship with Telnet available, so turning it off with transport input ssh is routine hardening.
Ports 25, 465 and 587 (mail submission): three ports, three jobs
Port 25 is server to server mail transfer, the job SMTP was designed for, and it carries no encryption of its own. Port 587 is the submission port a mail client uses to hand a message to its own server, normally with authentication and STARTTLS upgrading the connection in place. Port 465 is SMTP wrapped in TLS from the first byte instead. Exam stems describe the role rather than the port, so read for who is talking to whom: a user sending mail is 587, a relay between servers is 25.
Port 53 (DNS): the port that uses TCP and UDP
DNS answers ordinary lookups over UDP 53, because a query and its response fit in one exchange with no connection setup to pay for. It switches to TCP 53 for zone transfers and for responses too large for a single UDP datagram, the classic threshold being 512 bytes before EDNS0. That dual transport is why DNS appears in every TCP versus UDP question. Encrypted DNS moves elsewhere: DNS over TLS uses 853 and DNS over HTTPS hides inside 443, so filtering by port alone no longer blocks name resolution.
Ports 67 and 68 (DHCP): which end is which
The client sends from UDP 68 to UDP 67, and the server answers back to 68. Keep them straight by remembering that the server owns the lower number. The whole DORA exchange, discover, offer, request and acknowledge, rides on those two ports, and the first message is a broadcast, which is why a client on a different subnet from the server needs ip helper-address on the router interface to forward it. Troubleshooting items that mention a workstation holding a 169.254 address are testing that relay step.
Port 80 (HTTP): unencrypted web traffic
TCP 80 is the default for unencrypted HTTP, and its role on a modern exam is as the insecure half of a pair with 443. Blocking 80 at a firewall does nothing to HTTPS, which is the most common misread in ACL questions. Most public sites redirect 80 straight to 443, but the port stays open for that redirect, and captive portals and embedded device interfaces still serve real content there. Port 8080 is the usual alternate, used by proxies and application servers.
Ports 110 and 143 (POP3 and IMAP): download or sync
POP3 on TCP 110 downloads mail to one device and traditionally removes it from the server, so a message read on a laptop is gone from the phone. IMAP on TCP 143 leaves messages on the server and synchronises state, which makes it the answer whenever multiple devices have to stay in step. Both are plaintext, and both have TLS counterparts worth learning as a pair: POP3S on 995 and IMAPS on 993. A+ scenarios hinge on the download versus sync behaviour rather than on the numbers.
Ports 137 to 139 (NetBIOS): three services, not one port
The range covers three separate jobs. UDP 137 is the NetBIOS name service, the old Windows way of resolving names before DNS took over. UDP 138 is the datagram service for connectionless traffic such as browsing announcements. TCP 139 is the session service that carried early Windows file sharing. Modern SMB runs directly on TCP 445 and needs none of them, so the range survives as legacy support and as something you block at the perimeter. Questions usually name a single member, so read 138 or 139 as NetBIOS.
Ports 161 and 162 (SNMP): polls versus traps
UDP 161 is where the managed device listens for polls from the monitoring station, and UDP 162 is where the monitoring station listens for traps the device sends on its own initiative. The direction is the whole question: a poll is pulled on 161, a trap is pushed to 162. SNMP v1 and v2c authenticate with community strings that cross the network in plain text, so a capture gives away read and often write access. Version 3 adds authentication and encryption, which is why hardening answers end with v3.
Ports 389 and 636 (LDAP and LDAPS): directory lookups
LDAP on 389 is how applications query a directory, in most enterprises Active Directory, for users, groups and attributes. In its plain form it is unencrypted, so bind credentials and query results are readable on the wire. Port 636 is LDAPS, the same protocol inside TLS from the start of the connection, and it is the answer whenever a question asks how to secure directory traffic. StartTLS can also upgrade a session in place on 389, so traffic on the standard port is not automatically plaintext.
Port 443 (HTTPS): more than web traffic
TCP 443 carries HTTP inside TLS, and because it is open almost everywhere it has become the default transport for anything that needs to cross a firewall. SSL VPNs use it, DNS over HTTPS hides inside it, and management agents tunnel through it. That is why blocking by port number is a weak control: allowing 443 allows far more than browsing. On exams it is the secure half of the 80 and 443 pair, and the port behind any certificate question about a browser warning.
Port 445 (SMB): Windows file sharing and the perimeter rule
TCP 445 carries SMB, the protocol behind Windows file and printer sharing, running directly over TCP without the old NetBIOS session layer. Inside a network it is ordinary traffic, which is what makes it dangerous: worm and ransomware families have spread across flat networks by abusing flaws in older SMB versions on this port. The expected answer is that 445 should never be reachable from the internet and belongs behind a VPN, and that SMB version 1 should be disabled. Mapped drive failures usually come back to it.
Port 3389 (RDP): what port does Remote Desktop use
Remote Desktop listens on TCP 3389, and it is the port A+ and Security+ candidates are asked about most, because it is both the everyday answer for Windows remote support and one of the most attacked services on the internet. Exposed RDP attracts continuous credential guessing, so the expected recommendations are to reach it over a VPN or a gateway, require multifactor authentication, and keep network level authentication enabled. If a scenario names a Mac or Linux desktop instead, the answer is usually VNC on 5900.
What students actually mix up in class
After twenty years of enterprise networking and a lot of CCNA cohorts, the confusions are predictable enough that I teach against them directly. The worst offender is 88: Kerberos is a port number, EIGRP is an IP protocol number, and the exam will put both in the same answer set. The same trap runs through 89 OSPF, a protocol number with no port at all, so any answer giving OSPF a TCP or UDP port is wrong by construction. Next is RADIUS against TACACS+: TACACS+ is TCP 49 and encrypts the whole payload, RADIUS is UDP 1812 and 1813 and encrypts only the password. Direction catches people too, since SNMP polls go to 161 while traps arrive on 162.
Qazi Irfanullah, who teaches our A+ classes, sees a different pattern, because those questions are support scenarios rather than configuration. Students who know 110 and 143 as numbers still pick the wrong one when a scenario says mail read on the desktop disappears from the phone, which is POP3 behaviour. Remote access is the other one: 3389 is Remote Desktop on Windows, 5900 is VNC for cross platform screen sharing, and the scenario names the operating system to tell you which. Drill both directions, number to service and service to number, because recognising 3389 on a list is not the same skill as producing it from a description under time pressure.
Frequently Asked Questions
What is the difference between a port number and a protocol number?
A protocol number lives in the IPv4 header and selects the layer 4 protocol: 6 for TCP, 17 for UDP, 1 for ICMP, 89 for OSPF. A port number lives in the TCP or UDP header and selects the application above layer 4: 22 for SSH, 443 for HTTPS. Protocol numbers get you from layer 3 to layer 4, port numbers get you from layer 4 to the application. OSPF and EIGRP have protocol numbers but no port numbers, because they ride directly on IP rather than on TCP or UDP.
Which ports do I actually need to memorise for the CCNA?
Focus on the ones that appear in configuration and troubleshooting: 22 SSH, 23 Telnet, 53 DNS, 67 and 68 DHCP, 69 TFTP, 80 HTTP, 123 NTP, 161 and 162 SNMP, 179 BGP, 443 HTTPS, 514 syslog, and 1812 and 1813 RADIUS. Add protocol numbers 1 ICMP, 6 TCP, 17 UDP, 47 GRE, 50 ESP, 88 EIGRP, and 89 OSPF. Set the exam filter above to CCNA to see exactly that set, then print or export it.
Can I print this ports cheat sheet or download it?
Yes. Filter the table to your exam first, because every export contains exactly what is on screen. Print cheat sheet opens the browser print dialogue with the site navigation stripped out, so it prints or saves as a PDF one page reference. Copy as text drops the filtered rows into a note app, and Download CSV gives you a spreadsheet you can turn into flashcards. No account needed.
What port does RDP use, and why is it risky to expose?
Remote Desktop Protocol uses TCP 3389. Publishing it directly to the internet is risky because an exposed RDP listener receives continuous automated credential guessing, and one reused administrator password hands over the host. The expected exam answers are to place RDP behind a VPN or a remote desktop gateway, require multifactor authentication, and leave network level authentication enabled.
Why does DNS use both TCP and UDP on port 53?
UDP is used for ordinary queries because it is a single fast request and response with no connection setup. TCP is used when a response exceeds 512 bytes and for zone transfers between DNS servers, where reliable ordered delivery matters. Modern DNS with DNSSEC and EDNS0 pushes more traffic to TCP than the classic 512-byte rule suggests. Encrypted DNS moves off 53 entirely, to 853 for DNS over TLS and 443 for DNS over HTTPS.
Which ports are considered insecure?
Any protocol that carries credentials or data in plaintext: 21 FTP, 23 Telnet, 25 SMTP without STARTTLS, 69 TFTP, 80 HTTP, 110 POP3, 143 IMAP, 389 LDAP, and SNMP v1 and v2c on 161. Each has an encrypted counterpart, which this table lists beside it. Security+ asks about these pairings directly, and A+ expects you to recognise the secure option.
What are the port ranges called?
0 to 1023 are the well-known ports, assigned by IANA and normally requiring elevated privileges to bind. 1024 to 49151 are registered ports, assigned to specific applications on request. 49152 to 65535 are dynamic or ephemeral ports, used as the source port for outbound client connections. When your laptop opens an HTTPS connection, the destination is 443 but the source is an ephemeral port.
What is the fastest way to memorise port numbers?
Recall practice beats rereading a table. Filter this tool to your exam, switch to the Drill tab, and work the deck in both directions: port number to service, then service to port number. Mark anything you hesitate on as not yet, then re-run only the missed ones until that list is empty. Fifteen minutes a day beats one long session the night before the exam.
Learn where these ports actually show up
Memorising a table gets you through the question. Configuring ACLs, NAT, and syslog in Packet Tracer is what makes it stick. Our live CCNA 200-301 course runs both.
Ready to Advance Your IT Career?
Get in touch to find the right certification path for your goals.
Get in Touch
