Common ports and protocols form the invisible channels that let devices discover, secure, and exchange data across networks. Understanding which services listen on which numbers and how they behave helps teams troubleshoot connectivity and harden infrastructure.
Whether you manage cloud workloads or on-prem appliances, every layer of the stack uses numbered endpoints to route traffic reliably. This guide highlights practical patterns engineers and operators see every day.
Core Protocol Reference
| Port | Protocol | Layer | Common Use | Security Notes |
|---|---|---|---|---|
| 22 | TCP | Transport | Secure Shell (SSH) | Use key-based auth, fail2ban, and firewall policies |
| 53 | TCP/UDP | Network | Domain Name System (DNS) | Restrict recursion, prefer DNS over TLS (DoT) or DNS over HTTPS (DoH) |
| 80 | TCP | Transport | HTTP | Redirect to HTTPS, enforce strong HSTS policies |
| 443 | TCP | Transport | HTTPS (HTTP over TLS) | Use modern ciphers, rotate certificates, enable OCSP stapling |
| 445 | TCP | Transport | Server Message Block (SMB) | Block from external traffic, prefer SMB 3.x with signing |
Transport Layer Security Deep Dive
TLS secures traffic between clients and servers, preventing eavesdropping and tampering across untrusted networks. Operators must combine correct cipher choices with disciplined certificate management.
Modern stacks deprecate legacy protocols and weak suites to reduce exposure to downgrade attacks and known exploits. Regular audits and automated renewal pipelines keep services online and compliant.
Key TLS Settings to Monitor
- TLS 1.2 and TLS 1.3 only
- Strong cipher suites such as ECDHE with AES-GCM
- Valid certificates with proper chaining and short lifetimes
- HSTS headers for web endpoints
- OCSP stapling and revocation checks
Application Layer Protocols
At the application layer, protocols like HTTP, SMTP, and LDAP define message formats and semantics, while ports provide the addressing hooks. Correct configuration prevents unnecessary exposure and data leaks.
For example, LDAP on port 389 should be reserved for internal directory replication, while LDAPS on 636 or StartTLS on 389 with strict validation protects identity data in transit. SMTP submission on 587 with authentication and encryption is preferred over legacy port 25 for mail relay.
Firewall and Host Controls
Network and host firewalls must align with service boundaries to limit lateral movement. Default-deny policies, combined with explicit allow lists, reduce the attack surface exposed by commonly scanned ports.
Organizations often segment management traffic into separate VLANs or security groups, allowing only trusted systems to reach database ports, admin interfaces, and configuration management agents. Logging and alerting on unexpected connection attempts further strengthens posture.
Operational Best Practices Summary
- Document every allowed port and protocol with owner contact and purpose
- Apply least privilege to firewall rules and host-based ACLs
- Regularly scan internally and externally to detect unintended exposures
- Automate certificate and key rotation for TLS-enabled services
- Segment networks so sensitive ports are never reachable from the Internet
FAQ
Reader questions
Which ports should be exposed to the internet for a typical web application?
Only ports 80 and 443 should be exposed to the public Internet for a standard web application, with all other ports restricted to internal networks or management jump hosts.
How can I verify that services are listening only on expected interfaces?
Use tools like ss, netstat, or Get-NetTCPConnection on Windows to list bound addresses and compare them against your intended network zones and firewall rules.
What should I do if legacy systems require unencrypted protocols like plain FTP or Telnet? Replace them with encrypted alternatives such as SFTP or SSH, or place legacy services behind tightly controlled VPNs or application gateways that terminate encryption and enforce strong access controls. How do I safely open ports for remote management without increasing risk?
Limit management access via jump hosts or bastion servers, enforce multi-factor authentication, use temporary elevated sessions, and continuously monitor logs for anomalous behavior.