Overview
Learning transport protocols pays off when you can recognize the common services that ride on them and the ports they use. Knowing that 443 is HTTPS or 22 is SSH lets you read a scan or a traffic capture at a glance. This lesson maps the everyday services to their protocols and ports.
Learning objectives
- Recognize common services and their default ports.
- Associate each service with TCP or UDP.
- Use this knowledge to interpret scans and traffic.
Core concept
A set of well-known services and ports appears constantly in networking and security work:
| Service | Port | Protocol | Purpose |
|---|---|---|---|
| HTTP | 80 | TCP | Unencrypted web |
| HTTPS | 443 | TCP | Encrypted web (TLS) |
| SSH | 22 | TCP | Secure remote shell |
| DNS | 53 | UDP (and TCP) | Name resolution |
| SMTP | 25 | TCP | Sending email |
| FTP | 21 | TCP | File transfer (control) |
| RDP | 3389 | TCP | Remote desktop |
| DHCP | 67/68 | UDP | Automatic IP configuration |
These are defaults — a service can be configured on a different port, but the conventions hold most of the time.
How it works
Servers listen on their service's port; clients connect to that port. Reliable, ordered protocols (web, remote shell, email, file transfer) generally use TCP; latency-sensitive or simple request/response protocols (DNS lookups, DHCP) generally use UDP. When you see traffic to port 443, you can reasonably infer HTTPS; to port 22, SSH — a mental map that speeds up every analysis.
Practical example
A port scan of a server returns open ports 22, 80, and 443. Reading the conventions, you conclude it is a web server (HTTP on 80, HTTPS on 443) that also allows remote administration over SSH (22). That single line of scan output already tells you the host's likely role and how one would connect to it — without touching the services themselves.
Cybersecurity relevance
Mapping services to ports is foundational to reconnaissance and defense. Testers use it to identify a host's role and likely vulnerabilities from open ports; defenders use it to spot unexpected services (e.g. RDP exposed to the internet) that widen the attack surface. Unusual traffic — such as a service answering on a non-standard port — can itself be an indicator worth investigating.
Common mistakes
- Assuming the port guarantees the service — defaults are conventions, not rules; verify before concluding.
- Forgetting DNS uses both UDP and TCP (UDP for typical queries, TCP for large responses/zone transfers).
- Ignoring that exposed admin services (SSH, RDP) are high-value targets when reachable.
Key takeaways
- Common defaults: HTTP 80, HTTPS 443, SSH 22, DNS 53, SMTP 25, FTP 21, RDP 3389, DHCP 67/68.
- Reliable services tend to use TCP; latency-sensitive or simple query services tend to use UDP.
- Recognizing service-to-port mappings lets you quickly interpret scans and traffic and spot anomalies.
Check your understanding
- Which protocol (TCP or UDP) and port would you expect for HTTPS, and which for a standard DNS query?
- A scan shows ports 80, 443, and 22 open — what role does the host most likely play, and how would you connect for administration?