2. Ports and Protocols: SSH, HTTP, HTTPS, FTP/SFTP and DNS
2.1 Ports and the Well-Known Port List
In short: A port is a 16-bit number (0–65535) that identifies a specific process/service on a host.
IP mhanje building, port mhanje flat number. Ek server var ekach veli web server (80), SSH (22) aani MySQL (3306) chalu shaktat karan pratyek vegla port aiktoy (listen karto).
A port is a 16-bit number (0–65535) that identifies a specific process/service on a host. One server with one IP can run a web server (port 80), SSH (port 22) and MySQL (port 3306) at the same time because each listens on a different port. The combination IP:port (e.g. 203.0.113.10:443) is called a socket.
| Range | Name | Meaning |
|---|---|---|
| 0 – 1023 | Well-known ports | Reserved for standard services; need root to bind on Linux |
| 1024 – 49151 | Registered ports | Used by applications (MySQL, MongoDB, dev servers) |
| 49152 – 65535 | Dynamic / ephemeral | Temporary client-side ports chosen by the OS |
Common ports you must remember
| Port | Protocol | Service | Where you will see it |
|---|---|---|---|
| 20, 21 | TCP | FTP (data, control) | Legacy file transfer (avoid; insecure) |
| 22 | TCP | SSH / SCP / SFTP | Logging in to EC2, copying files |
| 23 | TCP | Telnet | Legacy, insecure — never open |
| 25 | TCP | SMTP | Sending e-mail (AWS throttles port 25 by default) |
| 53 | UDP/TCP | DNS | Domain name lookups |
| 67, 68 | UDP | DHCP | Automatic IP assignment |
| 80 | TCP | HTTP | Websites (unencrypted) |
| 110 / 143 | TCP | POP3 / IMAP | Receiving e-mail |
| 443 | TCP | HTTPS | Websites with TLS/SSL |
| 3000 | TCP | Node.js / React dev server | Express apps, npm start |
| 3306 | TCP | MySQL / MariaDB | Database |
| 3389 | TCP | RDP | Windows Remote Desktop |
| 4200 | TCP | Angular dev server | ng serve |
| 5000 | TCP | Flask dev server | flask run |
| 5432 | TCP | PostgreSQL | Database |
| 6379 | TCP | Redis | Cache |
| 8000 | TCP | Gunicorn / Django dev server | Python apps |
| 8080 | TCP | Alternate HTTP / Tomcat / Jenkins | Java apps, proxies |
| 27017 | TCP | MongoDB | NoSQL database |
Security rule of thumb
Only ports 22, 80 and 443 normally need to be open to the internet. Application ports (3000, 5000, 8080) should sit behind a reverse proxy (Nginx/Apache), and database ports (3306, 27017) should never be open to 0.0.0.0/0.
sudo ss -tlnp # which programs are listening on which TCP ports?
sudo ss -ulnp # same for UDP
nc -zv 127.0.0.1 22 # is TCP port 22 open locally?
Why this matters for security
Every open port is a door. Attackers begin with a port scan (Nmap, Part 10) to find doors, then look for weak services behind them. Defenders do the reverse: close every port that is not needed, and restrict the rest by source IP. "Attack surface" (हल्ल्यासाठी उघडी असलेली बाजू) is mostly the list of open ports and the services behind them.
Ravindra Bagale's Tip
Many students memorise the list of ports but forget which ones use TCP and which use UDP – DNS 53 (UDP and TCP), DHCP 67/68 UDP. By default Nmap scans only TCP, so UDP services "don't show up". Remember the protocol column in the table too.
Ravindra Bagale's Tip – मराठी
बरेच students ports ची list पाठ करतात पण कोणत्या port वर TCP आणि कोणत्या वर UDP हे विसरतात – DNS 53 (UDP आणि TCP), DHCP 67/68 UDP. Nmap default ने फक्त TCP scan करतो, म्हणून UDP services "दिसत नाहीत". Table मधला protocol column पण लक्षात ठेवा.
Ravindra Bagale's Tip – हिंदी
बहुत से students ports की list रट लेते हैं पर भूल जाते हैं कि किस port पर TCP है और किस पर UDP – DNS 53 (UDP और TCP), DHCP 67/68 UDP. Nmap default रूप से सिर्फ़ TCP scan करता है, इसलिए UDP services "दिखती नहीं". Table का protocol column भी याद रखो.
Practice task
Without looking, write the default ports for SSH, FTP, Telnet, SMTP, DNS, HTTP, HTTPS, MySQL, RDP and PostgreSQL. Then run sudo ss -tlnp on a Linux machine and name each listening service.