Common Network Port Numbers – Full Reference

1. What Are Ports and Why Do They Exist?

An IP address identifies a device on a network — but a modern device runs dozens of applications simultaneously (web server, SSH daemon, DNS resolver, SNMP agent). A port number is a 16-bit integer (0–65535) that identifies a specific service or process on a device, allowing the transport layer (TCP or UDP) to deliver each incoming packet to the correct application.

The combination of IP address + protocol + port number is called a socket. A unique socket pair (source socket + destination socket) identifies every active network session. For example, your browser connecting to a web server creates a session from 192.168.1.10:54321 → 93.184.216.34:443 — your device's random ephemeral port to the server's HTTPS port.

  How ports differentiate services on the same IP address:

  Device IP: 192.168.1.1

  Incoming packet → Dst port 22  → SSH daemon  (remote management)
  Incoming packet → Dst port 80  → HTTP server (web interface)
  Incoming packet → Dst port 161 → SNMP agent  (network monitoring)
  Incoming packet → Dst port 443 → HTTPS server (secure web)

  Without port numbers, the device would not know which application
  should receive each packet. Ports are the mechanism that allows
  a single IP address to host multiple concurrent services.

  Socket pair example — SSH session:
  Client: 10.0.0.5:52341   (source: random ephemeral port)
  Server: 192.168.1.1:22   (destination: SSH well-known port)
  These four values together uniquely identify the session.

Related pages: Ports Overview | Network Protocols | OSI Model | TCP/IP Model | ACL Overview | Firewall Overview | Applying ACLs

2. TCP vs UDP — Choosing the Right Transport

Port numbers exist in two flavours depending on the Layer 4 transport protocol. A port 80 TCP and port 80 UDP are technically different sockets — though in practice most well-known services use one or the other, not both (HTTP uses TCP 80; QUIC/HTTP3 uses UDP 443). Understanding why a protocol uses TCP or UDP explains much about its behaviour.

Port Number Ranges

3. Essential CCNA Port Numbers — Master Table

The following table covers every port number that appears on the CCNA exam or is encountered in real-world network configuration and troubleshooting. Sorted by port number for easy reference.

4. Routing Protocol Ports and Identifiers

Routing protocols are a special case — some use TCP or UDP port numbers, but others are defined as IP protocol numbers (not TCP/UDP ports at all) and operate directly above the IP layer. This distinction matters for ACL and firewall configuration.

5. File Transfer and Remote Access Ports

File transfer and remote access protocols are among the most commonly configured services on network devices and servers. Understanding their ports — and the security implications of each — is essential for both the CCNA exam and real-world network design.

FTP — Active vs Passive Mode (Ports 20 and 21)

  FTP Active Mode (uses both port 20 and 21):
  ┌────────────────────────────────────────────────────────────┐
  │ 1. Client connects FROM random ephemeral port TO server 21 │
  │    (control connection established)                        │
  │ 2. Client sends PORT command: "connect back to me on       │
  │    port X for data"                                        │
  │ 3. Server initiates data connection FROM port 20 TO client │
  │    port X                                                  │
  │ Problem: server initiates inbound — blocked by most NAT    │
  │ and firewalls on the client side.                          │
  └────────────────────────────────────────────────────────────┘

  FTP Passive Mode (uses only port 21 for control, dynamic for data):
  ┌────────────────────────────────────────────────────────────┐
  │ 1. Client connects FROM random port TO server 21           │
  │    (control connection)                                    │
  │ 2. Client sends PASV command: "tell me where to connect    │
  │    for data"                                               │
  │ 3. Server responds with a random high port (e.g., 50000)   │
  │ 4. Client initiates data connection TO server:50000        │
  │ Benefit: client always initiates both connections —        │
  │ NAT and firewalls work correctly.                          │
  └────────────────────────────────────────────────────────────┘

  Summary: Active mode uses port 20 for data (server-initiated).
  Passive mode uses a dynamic server port for data (client-initiated).
  Modern FTP clients use passive mode by default.

SSH vs Telnet Security Comparison

See also: SSH Overview | Telnet Overview | SSH vs Telnet Security | FTP Overview

6. Email Protocol Ports

Email uses multiple protocols and ports depending on whether the system is transferring mail between servers (MTA to MTA), or delivering mail to a client (mail client to mailbox). Understanding each role prevents common configuration mistakes.

  Email protocol flow:

  [Sender's email client]
         │
         │ SMTP Submission — TCP 587 (with STARTTLS)
         │ or SMTPS — TCP 465 (implicit TLS)
         ▼
  [Outbound Mail Server (MTA)]
         │
         │ SMTP — TCP 25 (server-to-server relay)
         ▼
  [Recipient's Mail Server (MTA/MDA)]
         │
         ├─ POP3  — TCP 110 (client downloads and deletes from server)
         │  POP3S — TCP 995 (encrypted)
         │
         └─ IMAP  — TCP 143 (client syncs with server; mail stays on server)
            IMAPS — TCP 993 (encrypted)
         ▼
  [Recipient's email client]

See also: SMTP Overview

7. Network Management and Monitoring Ports

8. AAA and Security Protocol Ports

9. Ports and ACL Configuration

Port numbers are the basis of many ACL (Access Control List) rules on Cisco routers and switches. Extended ACLs can match traffic based on source and destination IP addresses, protocol (TCP/UDP), and source/destination port numbers — making them far more granular than standard ACLs which only match source IP.

  Extended ACL using port numbers — practical examples:

  ! Permit SSH (TCP 22) from management network to any device:
  Router(config)# ip access-list extended MGMT-IN
  Router(config-ext-nacl)# permit tcp 10.0.10.0 0.0.0.255 any eq 22
  ! "eq 22" = equal to port 22 (destination port)

  ! Permit HTTP and HTTPS outbound from LAN:
  Router(config-ext-nacl)# permit tcp 192.168.1.0 0.0.0.255 any eq 80
  Router(config-ext-nacl)# permit tcp 192.168.1.0 0.0.0.255 any eq 443

  ! Permit DNS queries (UDP and TCP) outbound:
  Router(config-ext-nacl)# permit udp 192.168.1.0 0.0.0.255 any eq 53
  Router(config-ext-nacl)# permit tcp 192.168.1.0 0.0.0.255 any eq 53

  ! Permit DHCP (both ports needed for relay):
  Router(config-ext-nacl)# permit udp any eq 68 any eq 67

  ! Permit SNMP from NMS to all devices:
  Router(config-ext-nacl)# permit udp 10.0.20.5 0.0.0.0 any eq 161

  ! Permit BGP (TCP 179) between eBGP peers:
  Router(config-ext-nacl)# permit tcp 203.0.113.0 0.0.0.3 any eq 179
  Router(config-ext-nacl)# permit tcp any 203.0.113.0 0.0.0.3 eq 179
  ! BGP can be initiated from either side — need both directions

  ! Permit OSPF (IP protocol 89 — not TCP/UDP):
  Router(config-ext-nacl)# permit ospf any any

  ! Block Telnet (TCP 23) entirely — all sources:
  Router(config-ext-nacl)# deny tcp any any eq 23

  ! Implicit deny all at end (shown explicitly):
  Router(config-ext-nacl)# deny ip any any

ACL Port Matching Keywords

See also: ACL Overview | Applying ACLs | Named ACLs | Standard ACLs

10. Quick-Reference Cheat Sheet

A condensed, exam-ready summary of the most important port numbers. Memorise these — they appear regularly on the CCNA exam and are essential for ACL, firewall, and troubleshooting questions.

  ┌──────┬────────────────────────────┬─────────┬──────────────────────────┐
  │ Port │ Protocol                   │ TCP/UDP │ Key Note                 │
  ├──────┼────────────────────────────┼─────────┼──────────────────────────┤
  │  20  │ FTP Data (active mode)     │ TCP     │ Server-initiated data    │
  │  21  │ FTP Control                │ TCP     │ Always port 21           │
  │  22  │ SSH                        │ TCP     │ Secure CLI + SFTP/SCP    │
  │  23  │ Telnet                     │ TCP     │ Insecure — avoid         │
  │  25  │ SMTP (server relay)        │ TCP     │ MTA to MTA               │
  │  49  │ TACACS+                    │ TCP     │ Encrypts full packet     │
  │  53  │ DNS                        │ TCP+UDP │ UDP queries, TCP large   │
  │  67  │ DHCP Server                │ UDP     │ Server listens here      │
  │  68  │ DHCP Client                │ UDP     │ Client receives here     │
  │  69  │ TFTP                       │ UDP     │ IOS images, configs      │
  │  80  │ HTTP                       │ TCP     │ Unencrypted web          │
  │  88  │ Kerberos                   │ TCP+UDP │ AD authentication        │
  │ 110  │ POP3                       │ TCP     │ Email download           │
  │ 123  │ NTP                        │ UDP     │ Time sync                │
  │ 143  │ IMAP                       │ TCP     │ Email sync (server-side) │
  │ 161  │ SNMP (queries)             │ UDP     │ Manager → Agent          │
  │ 162  │ SNMP Trap                  │ UDP     │ Agent → Manager          │
  │ 179  │ BGP                        │ TCP     │ eBGP/iBGP sessions       │
  │ 389  │ LDAP                       │ TCP+UDP │ Directory queries        │
  │ 443  │ HTTPS / RESTCONF           │ TCP     │ Secure web + REST API    │
  │ 465  │ SMTPS (implicit TLS)       │ TCP     │ Email submission (TLS)   │
  │ 500  │ IKE / ISAKMP               │ UDP     │ IPsec phase 1            │
  │ 514  │ Syslog                     │ UDP     │ Log to central server    │
  │ 520  │ RIP / RIPv2                │ UDP     │ Routing updates          │
  │ 587  │ SMTP Submission (STARTTLS) │ TCP     │ Authenticated email send │
  │ 636  │ LDAPS                      │ TCP     │ Encrypted LDAP           │
  │ 646  │ LDP (MPLS labels)          │ TCP+UDP │ Label distribution       │
  │ 830  │ NETCONF                    │ TCP/SSH │ Programmatic config      │
  │ 993  │ IMAPS                      │ TCP     │ Encrypted IMAP           │
  │ 995  │ POP3S                      │ TCP     │ Encrypted POP3           │
  │1812  │ RADIUS Auth                │ UDP     │ Auth + Authorisation     │
  │1813  │ RADIUS Accounting          │ UDP     │ Session records          │
  │3389  │ RDP                        │ TCP+UDP │ Windows remote desktop   │
  │4500  │ IPsec NAT-T                │ UDP     │ IPsec over NAT           │
  └──────┴────────────────────────────┴─────────┴──────────────────────────┘

  IP Protocol Numbers (not TCP/UDP ports):
  Protocol 6   = TCP
  Protocol 17  = UDP
  Protocol 47  = GRE (Generic Routing Encapsulation)
  Protocol 50  = ESP (IPsec Encapsulating Security Payload)
  Protocol 51  = AH  (IPsec Authentication Header)
  Protocol 88  = EIGRP
  Protocol 89  = OSPF
  Protocol 103 = PIM
  Protocol 112 = VRRP

See also: Ports Overview | Network Protocols | ACL Overview | Firewall Overview | SSH | DHCP | NTP | SNMP | Syslog | DNS | BGP

Test Your Knowledge — Port Numbers Quiz