Cheat sheet
Ports and services
Recognising a service from its port saves time, whether you are reading a scan, a firewall log or a network capture.
The essentials
| Port | Service | Key point |
|---|---|---|
| 21/tcp | FTP | Cleartext credentials; check for anonymous login |
| 22/tcp | SSH | Encrypted remote access; the banner often gives the version and OS |
| 23/tcp | Telnet | Everything travels in cleartext |
| 25/tcp | SMTP | Sending email; 465 and 587 for the encrypted variants |
| 53/tcp+udp | DNS | UDP for queries, TCP for zone transfers |
| 67-68/udp | DHCP | IP address assignment |
| 69/udp | TFTP | Transfer without authentication |
| 80/tcp | HTTP | Cleartext web; 8080 and 8000 are common variants |
| 88/tcp | Kerberos | Almost certainly a domain controller |
| 110/tcp | POP3 | Retrieving email; 995 for the encrypted version |
| 111/tcp | rpcbind | Often associated with NFS |
| 135/tcp | MSRPC | Windows RPC endpoint mapper |
| 137-139 | NetBIOS | Legacy Windows sharing, NetBIOS names |
| 143/tcp | IMAP | Retrieving email; 993 for the encrypted version |
| 161/udp | SNMP | Monitoring; default communities “public” / “private” |
| 389/tcp | LDAP | Directory (Active Directory); 636 for LDAPS |
| 443/tcp | HTTPS | The certificate often reveals hostnames |
| 445/tcp | SMB | Windows shares; a target and a lateral movement vector |
| 514/udp | Syslog | Sending logs to a collector |
| 873/tcp | rsync | File synchronisation, sometimes without authentication |
| 1433/tcp | MSSQL | Microsoft database |
| 1521/tcp | Oracle TNS | Oracle database |
| 2049/tcp | NFS | Unix network shares; check the exports |
| 3268/tcp | Global catalog | LDAP across the whole AD forest |
| 3306/tcp | MySQL | Database |
| 3389/tcp | RDP | Windows Remote Desktop; logon type 10 |
| 5432/tcp | PostgreSQL | Database |
| 5601/tcp | Kibana | Elastic's interface |
| 5985-5986 | WinRM | Remote PowerShell administration (HTTP / HTTPS) |
| 6379/tcp | Redis | Key-value store, sometimes exposed without a password |
| 9200/tcp | Elasticsearch | Elastic's REST API |
Recognising a machine's role
| Port combination | Most likely |
|---|---|
| 53, 88, 135, 389, 445, 636, 3268 | Active Directory domain controller |
| 135, 139, 445, 3389 | Windows workstation or server |
| 22 alone, or 22 + 80/443 | Linux server, often a web server |
| 25, 110/995, 143/993 | Mail server |
| 111, 2049 | NFS file server |
| 5601, 9200 | Elastic stack (SIEM) |
ReminderA port is only a convention: a service can listen anywhere. Version detection (banner, service response) is what counts.