TCP and UDP Ports,
Protocols, and Their Purposes

Transfers files between a client and a server. FTP actually uses two ports: port 21 is the control connection, used to send commands (login, navigate directories, initiate a transfer), while port 20 is used for the actual data transfer itself in active mode. FTP transmits credentials and data in plaintext, which is why FTPS (FTP over SSL/TLS) or SFTP (FTP over SSH, port 22) are preferred in security-conscious environments.

Provides an encrypted command-line connection to a remote device, allowing secure remote administration of servers, network equipment, and other systems. SSH replaced the older, insecure Telnet protocol for this purpose because all traffic — including login credentials — is encrypted. SSH is also commonly used as the secure transport underneath SFTP (secure file transfer) and SCP (secure copy).

An older protocol providing remote command-line access to a device, functionally similar to SSH but with one critical difference: Telnet transmits everything — including usernames and passwords — in plaintext, with no encryption whatsoever. Telnet is considered obsolete and insecure for any sensitive use today, retained mostly for legacy equipment or specific diagnostic purposes, and is almost universally replaced by SSH in modern practice.

Handles the sending and relaying of email between mail servers, and from a mail client to its outgoing mail server. SMTP is a "push" protocol — it's responsible for getting a message from sender to recipient's mail server, but it does not handle a client retrieving/reading mail from a mailbox (that's the job of POP3 or IMAP, covered below).

Resolves human-readable domain names to IP addresses (and vice versa), as covered in objective 2.3. DNS primarily uses UDP for standard, fast lookup queries, since speed matters more than guaranteed delivery for a quick name lookup (and a client will simply retry if no response comes back). DNS falls back to TCP for larger transfers, such as zone transfers between DNS servers or responses too large to fit in a single UDP packet.

Automatically assigns IP addressing information to clients via the DORA process (objective 2.6). Port 67 is used by the DHCP server, while port 68 is used by the DHCP client. DHCP uses UDP because, at the moment a client needs an address, it has no IP address yet at all — UDP's connectionless, broadcast-friendly nature fits this "I don't even have an address yet" bootstrapping scenario far better than TCP, which requires an established connection between two addressed endpoints first.

Transfers web page content — HTML, images, scripts — between a web server and a client's browser, as introduced in objective 2.3. HTTP traffic is sent in plaintext, meaning anyone able to intercept the traffic could read it, which is the core reason HTTPS (below) has become the standard for the modern web.

Allows a mail client to retrieve email from a mail server. POP3's defining behavior: by default, it downloads messages to the local client and then deletes them from the server, making mail essentially local to whichever single device retrieved it. This made sense in an era of one computer per person, but is a poor fit for anyone who checks email from multiple devices — which is exactly the gap IMAP fills.

Also retrieves email from a mail server, but unlike POP3, IMAP keeps mail synchronized on the server — messages, folders, and read/unread status remain on the server and are mirrored across every device that connects, rather than being downloaded and removed. This is why IMAP is the standard choice today: a user can check the same mailbox from a phone, laptop, and webmail interface and see a consistent state everywhere.

A legacy Windows networking protocol suite used for name resolution, datagram services, and session services on local networks — historically the basis for early Windows file/printer sharing before SMB took over those responsibilities more directly. Port 137 handles name service, port 138 handles datagram service, and port 139 handles session service. NetBIOS is largely legacy at this point but is still occasionally encountered, especially in older or mixed-OS environments.

Used to access and maintain distributed directory information services — most commonly associated with Microsoft Active Directory, where it's used to query and authenticate against information like user accounts, group memberships, and organizational structure. LDAP is central to how centralized authentication and authorization (AAA, objective 2.3) works in a Windows domain environment. A secure variant, LDAPS (LDAP over SSL/TLS), typically runs on port 636.

The encrypted version of HTTP, using TLS (Transport Layer Security) to encrypt traffic between the browser and the web server, protecting against eavesdropping and tampering. HTTPS is now the default expectation for virtually all websites, particularly anything involving logins, payments, or personal data — modern browsers actively flag plain HTTP sites as "Not Secure."

The protocol behind Windows file and printer sharing — when a user maps a network drive or accesses a shared folder on a Windows network (objective 2.3's fileshare role), SMB is doing the work underneath. CIFS is an older, specific dialect/implementation of SMB; the two terms are frequently used interchangeably, though "SMB" is the more current and accurate umbrella term for the modern protocol used by Windows file sharing today.

A Microsoft protocol that provides a full graphical remote desktop session to a Windows machine — unlike SSH or Telnet, which provide command-line-only access, RDP lets a remote user see and interact with the entire graphical desktop as if sitting in front of the machine. Widely used for remote IT support and remote work scenarios involving Windows systems.