3.1.1. TCP/IP, UDP, and Common Ports

💡 First Principle: To diagnose service-specific connectivity issues, you must associate common network services with their standard protocols (TCP/UDP) and port numbers.

Scenario: You are configuring a firewall for a new web server. You need to create rules to allow inbound traffic on port 80 (HTTP) and port 443 (HTTPS), but explicitly block traffic on ports like 21 (FTP) and 23 (Telnet) to enhance security.

Protocols define the rules of communication, and port numbers are like apartment numbers for services running on a server.

• Core Protocols:
  • TCP (Transmission Control Protocol): Connection-oriented, reliable, and ordered delivery. Used for services where data integrity is critical (e.g., web browsing, email, file transfer, SSH remote access).
  • UDP (User Datagram Protocol): Connectionless, unreliable, and faster. Used for services where speed is more important than guaranteed delivery (e.g., DNS queries, DHCP, VoIP, TFTP, NTP, SNMP).
• Common Ports and Protocols:
  • 20/21 - FTP (File Transfer Protocol): Transfers files.
  • 22 - SSH (Secure Shell): Secure remote command-line access. SFTP (SSH File Transfer Protocol) also runs over port 22 and encrypts both the login and the data, unlike FTP (21) or TFTP (69).
  • 23 - Telnet: Unencrypted remote command-line access; replaced by SSH.
  • 25 - SMTP (Simple Mail Transfer Protocol): Sends email between mail servers.
  • 587 - SMTP submission: The standard port for a client to send (submit) outgoing email to its mail server with authentication, normally secured with STARTTLS (RFC 6409). If a user can receive mail but outgoing messages stick in the outbox, check the SMTP/submission settings and port 587.
  • 53 - DNS (Domain Name System): Resolves domain names to IP addresses (uses both UDP and TCP).
  • 69 - TFTP (Trivial File Transfer Protocol): A very simple, lightweight file transfer over UDP with no authentication or encryption; used for router/switch configuration files and PXE network boot (RFC 1350).
  • 80 - HTTP (Hypertext Transfer Protocol): Standard, unencrypted web traffic.
  • 110 - POP3 (Post Office Protocol 3): Receives email by downloading it to a single client, so deletions and folder changes are not mirrored on other devices. Encrypted POP3S uses port 995.
  • 123 - NTP (Network Time Protocol): UDP-based clock synchronization with an authoritative time source; accurate timestamps matter for log correlation, audits and authentication.
  • 143 - IMAP (Internet Message Access Protocol): A more modern protocol for receiving email. Mail stays on the server, so reading, deleting and moving messages stay synchronized across a user's phone, laptop and tablet. Encrypted IMAPS uses port 993.
  • 161/162 - SNMP (Simple Network Management Protocol): Monitors and manages network devices; a management system polls routers and switches on UDP 161 (traps arrive on 162).
  • 389 - LDAP (Lightweight Directory Access Protocol): Accesses directory services such as Active Directory (unencrypted). 636 - LDAPS is the encrypted version.
  • 443 - HTTPS (Hypertext Transfer Protocol Secure): Secure, encrypted web traffic.
  • 445 - SMB (Server Message Block): Windows file and printer sharing.
  • 3389 - RDP (Remote Desktop Protocol): Graphical remote access to Windows machines.
  • 5060/5061 - SIP (Session Initiation Protocol): Sets up, manages and ends real-time voice and video sessions (VoIP phones); 5061 is the TLS-secured port.
• Related protocol (no port): ARP (Address Resolution Protocol) resolves a known IPv4 address to the MAC address of a device on the local network (view the cache with arp -a).
• Secure vs. Insecure Ports: Encrypted: 22 (SSH/SFTP), 443 (HTTPS), 636 (LDAPS), 993 (IMAPS), 995 (POP3S). Cleartext by default: 21 (FTP), 23 (Telnet), 25 (SMTP), 80 (HTTP), 110 (POP3), 143 (IMAP), 389 (LDAP).

⚠️ Common Pitfall: Confusing POP3/IMAP with SMTP. POP3 and IMAP are for receiving email from a server. SMTP is for sending email from a client.

Key Trade-Offs:

• Security (HTTPS/SSH) vs. Legacy Compatibility (HTTP/Telnet): Secure protocols should always be preferred, but you may encounter legacy systems that still use their insecure counterparts.

Reflection Question: A user can browse secure websites (HTTPS) but not standard websites (HTTP). What specific port might be blocked on a firewall that would cause this issue?