Port Basics

Ports are logical numbers used by TCP/IP to identify what service or application should handle data

received by a system. Both TCP and UDP use ports with a total of 65,536 TCP ports (0 to 65,535) and

65,536 UDP ports (0 to 65,535). Administrators open ports on firewalls and routers to allow the

associated protocol into or out of a network. For example, Hypertext Transfer Protocol (HTTP) uses port 80, and an administrator allows HTTP traffic by opening port 80.

Additionally, administrators disable unnecessary ports and services as part of a basic security

practice. These ports and services are associated with specific protocols and if they are disabled, it blocks any attacks on these ports, services, and protocols.

The Internet Assigned Numbers Authority (IANA) maintains a list of official port assignments that

you can view at https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml.

IANA divided the ports into three ranges, as follows:

• Well-known ports: 0–1023. IANA assigns port numbers to commonly used protocols in the well-known ports range.

• Registered ports: 1024–49,151. IANA registers these ports for companies as a convenience to the IT community. A single company may register a port for proprietary use, or multiple companies may use the same port for a specific standard. As an example, Microsoft SQL Server uses port 1433 for database servers, Layer 2 Tunneling Protocol (L2TP) uses port 1701, and Point-to-Point Tunneling Protocol (PPTP) uses port 1723.

• Dynamic and private ports: 49,152–65,535. These ports are available for use by any application. Applications commonly use these ports to map an application to a port temporarily. These temporary port mappings are often called ephemeral ports, indicating that they are short-lived.

Although virtually all the ports are subject to attack, most port attacks are against the well-known ports. Port scanners often simply check to see if a well-known port is open. For example, SMTP uses the well-known port 25, so if port 25 is open, the system is likely running SMTP.

Network administrators who regularly work with routers and firewalls can easily tell you which protocol is associated with which well-known port, such as 20, 21, 22, 23, 25, 80, 443, and so on. The reason is that they use these ports to allow or block traffic.

For example, an administrator can close port 25 to block all SMTP traffic into a network. The router then ignores traffic on port 25 instead of forwarding it. Similarly, an administrator can close port 1433 to block database traffic to a Microsoft SQL server. On the other hand, the administrator can open port 25 or port 1433 to allow SMTP traffic or traffic to a Microsoft SQL server, respectfully.

Although ports are second nature to router and firewall administrators, they might not be so familiar to you. If you don’t work with the ports often, you’ll need to spend some extra time studying to ensure you’re ready for the exam.

Combining the IP Address and the Port

At any moment, a computer could be receiving dozens of packets, and each of these packets includes a destination IP address and a destination port. TCP/IP uses the IP address to get the packet to the computer. The computer then uses the port number to get the packet to the correct service, protocol, or application that can process it.

For example, if the packet has a destination port of 443, the well-known port for Hypertext Transfer Protocol Secure (HTTPS), the system passes the packet to the process handling HTTPS. It wouldn’t do much good to pass an SMTP email packet to the HTTPS service or send an HTTPS request packet to the SMTP service.

IP Address Used to Locate Hosts

Imagine that the IP address of GetCertifiedGetAhead.com is 35.221.53.172, and the address assigned to your computer in an internal network is 192.168.10.11. TCP/IP uses these IP addresses to get the packets from your computer to the web server and the web server’s answer back to your computer.

There’s a lot more that occurs under the hood with TCP/IP (such as DNS, NAT, and ARP), but the main point is that the server’s IP address is used to get the requesting packet from your computer to the server. The server gets the response packets back to your computer using your IP address (or the IP address of your NAT server).

SErver Ports

Different protocols are enabled and running on a server. These protocols have well-known or registered port numbers, such as port 22 for SSH, 25 for SMTP, 80 for HTTP, 443 for HTTPS, and so on. When the system receives traffic with a destination of port 443, the system knows to send it to the service handling HTTPS.

Any web browser knows that the well-known port for HTTPS is 443. Even though you don’t see port 443 in the URL, it is implied as HTTPS://GetCertifiedGetAhead.com:443. If you omit the port number, HTTPS uses the well-known port number 443 by default.

Popular web servers on the Internet include Apache and Internet Information Services (IIS). Apache is free and runs on Unix or Linux systems. Apache can also run on other platforms, such as Microsoft systems. IIS is included in Microsoft Server products. These web servers use port 443 for HTTPS. When the server receives a packet with a destination port of 443, the server sends the packet to the web server application (Apache or IIS) that processes it and sends back a response.