Common Ports & Protocols

Every networked service speaks a protocol, an agreed set of rules for how two machines exchange data, and listens on a port, one of 65,536 numbered doorways (0 to 65535) on a host. If an IP address is the street address of a building, the port is the specific door, and the protocol is the language spoken behind it. When your browser loads a secure site, it connects to port 443 and speaks HTTPS. Memorizing the standard port-and-protocol pairs is core security literacy. It lets you read firewall rules, tell normal traffic from suspicious traffic, and spot dangerous misconfigurations at a glance. Seeing Telnet on port 23, or a database quietly exposed on 3306 to the open internet, is an immediate red flag.

Almost every protocol rides on one of two transport protocols. TCP (Transmission Control Protocol) opens a connection with a three-way handshake (SYN, then SYN-ACK, then ACK) and then guarantees that every byte arrives in order, resending anything lost. UDP (User Datagram Protocol) just fires packets off with no handshake and no guarantee, trading reliability for speed and low overhead. A file download or a login session needs TCP, because one missing byte would corrupt it. A live voice call or a DNS lookup prefers UDP, because it is faster and a single lost packet is cheaper to ignore than to wait for.

Defenders constantly ask two questions: what ports is this machine listening on, and does each open port belong there? These commands answer that. Run them against your own machine or a lab VM to build the habit of auditing your attack surface.

Using listening-ports.txt and the tables on this sheet, answer each question. Where a command helps, write ONE command using pipes. Column 5 is Local Address:Port: awk '{print $5}' prints it, cut -d: -f2 keeps just the port, and tail -n +2 skips the header line. 1. How many TCP sockets are in the LISTEN state? ( grep -c ) 2. Exactly one port number appears twice, once on a udp line and once on a tcp line. Which port is it, and which protocol from this sheet uses both transports on that port? ( awk, cut, sort -n, uniq -d ) 3. Two services accept connections only from the same machine, because they are bound to 127.0.0.1. Which two port numbers are they, and which database server does the Well-known ports table list for each? 4. One listening TCP port runs the protocol this sheet says sends every keystroke in plaintext and should be replaced by SSH. What port number is it, and what local address is it bound to? 5. How many different port numbers in the file fall in the well-known range, 0 to 1023? Count a port number once even if it appears on two lines. ( sort -nu, then awk '$1 < 1024', then wc -l ) Bonus: run ss -tuln on your own machine or lab VM and compare its listeners with this server's.