Network Security Ports and Protocols

IP addresses get data to the right device. Ports get data to the right application on that device. Protocols define the exact rules two devices follow when they communicate. Together, ports and protocols form the language of every network conversation — and attackers exploit them when that language has weaknesses.

What Is a Port

Imagine a large office building. The building address is the IP address. Each department inside the building has a room number — that is the port. The delivery company (the network) uses both the building address and the room number to deliver the right package to the right team.

IP Address: 203.0.113.50  (the building)

Port 80   → Web server (HTTP)      Room 80
Port 443  → Secure web (HTTPS)     Room 443
Port 25   → Email outgoing (SMTP)  Room 25
Port 22   → Remote login (SSH)     Room 22
Port 3306 → Database (MySQL)       Room 3306

A single server can run a web server, email server, and database all at once. Ports keep the traffic separated so each application receives only the data meant for it.

Port Number Ranges

Range            | Name              | Examples
0–1023           | Well-Known Ports  | HTTP(80), HTTPS(443), DNS(53)
1024–49151       | Registered Ports  | MySQL(3306), RDP(3389)
49152–65535      | Dynamic/Private   | Temporary client-side ports

Well-known ports are assigned by the IANA (Internet Assigned Numbers Authority). When your browser contacts a web server, it picks a temporary port from the dynamic range for itself and sends the request to port 443 on the server.

Your Browser                      Web Server
Port: 52341 (temporary)           Port: 443 (permanent)

Request:  52341 ──────────────►  443
Response: 52341 ◄──────────────  443

Common Protocols and What They Do

HTTP and HTTPS

HTTP (port 80) sends web pages in plain text. Anyone who captures the traffic can read every word. HTTPS (port 443) wraps HTTP in TLS encryption, making the content unreadable to anyone intercepting it. Never enter passwords or payment details on a site using only HTTP.

DNS – Domain Name System (port 53)

DNS translates human-readable names into IP addresses. When you type estudy247.com, your device asks a DNS server for the IP address behind that name. DNS runs over both UDP (fast, most queries) and TCP (larger responses).

You type: estudy247.com
    ↓
DNS Query → DNS Server
    ↓
DNS Reply: 203.0.113.10
    ↓
Your browser connects to 203.0.113.10

SSH – Secure Shell (port 22)

SSH lets administrators log into remote servers securely. It encrypts the entire session. Telnet (port 23) used to do the same job but sent everything in plain text — attackers could capture usernames and passwords. SSH replaced Telnet on well-managed networks.

FTP and SFTP

FTP (ports 20–21) transfers files but sends credentials in plain text. SFTP (port 22, running over SSH) transfers files with full encryption. Organizations should disable plain FTP wherever SFTP is available.

SMTP, IMAP, POP3

These three protocols handle email. SMTP (port 25) sends mail. IMAP (port 143/993) and POP3 (port 110/995) retrieve mail. The secure versions use ports with TLS enabled (993 for IMAP, 465/587 for SMTP).

How Attackers Exploit Ports

Port Scanning

Attackers use tools like Nmap to probe every port on a target. Open ports reveal what services run on the device, which services may have vulnerabilities, and which services are unnecessary and should be disabled.

Attacker scans 192.168.1.10:

Port 22   OPEN  → SSH running (try brute force?)
Port 80   OPEN  → Web server (check for old CMS?)
Port 3389 OPEN  → Remote Desktop (common attack target)
Port 23   OPEN  → Telnet running (major risk!)
Port 8080 OPEN  → Alt HTTP (maybe an unpatched app?)

Port Spoofing

Attackers disguise malicious traffic by using trusted port numbers. Malware that communicates on port 443 blends in with normal HTTPS traffic. Deep packet inspection firewalls can detect this by checking whether the actual protocol matches the port number.

Securing Ports

Security Action             | Reason
----------------------------|--------------------------------------------
Close unused ports          | Fewer open doors = smaller attack surface
Replace insecure protocols  | Telnet → SSH, FTP → SFTP, HTTP → HTTPS
Restrict ports by IP        | Only IT subnet can reach port 3389 (RDP)
Monitor port traffic        | Alerts on unexpected traffic to any port
Use a firewall ruleset      | Default deny all, allow only needed ports

A firewall that blocks every port by default and only opens the specific ports required for business is far harder to attack than one that leaves dozens of ports open "just in case." The principle of least privilege applies directly to ports — open only what you need, when you need it, for only the people who need it.