TCP and UDP ports every network engineer should memorize

Network engineers spend their careers troubleshooting connectivity, configuring firewalls, and designing secure systems. A solid grasp of common TCP and UDP ports is foundational to all three. Whether you are preparing for CCNA, NSE, or managing production infrastructure, knowing which ports carry which traffic prevents costly misconfigurations and speeds diagnosis during incidents. This guide covers the ports you should recognize instantly.

The well-known ports: 0 to 1023

Well-known ports, reserved by IANA, handle core network and application services. These are the ones that appear in every certification exam and real-world deployment. Commit these to memory first.

• →Port 20 and 21 (TCP): FTP data and control. FTP is legacy; SFTP on port 22 is preferred.
• →Port 22 (TCP): SSH. Secure remote access and file transfer. The de facto standard for device management.
• →Port 23 (TCP): Telnet. Unencrypted remote access. Avoid in production.
• →Port 25 (TCP): SMTP. Mail submission from clients to mail servers. Often blocked on residential ISPs.
• →Port 53 (TCP and UDP): DNS. Domain name resolution. UDP for queries; TCP for zone transfers and large responses.
• →Port 80 (TCP): HTTP. Unencrypted web traffic. Redirects to HTTPS in modern deployments.
• →Port 110 (TCP): POP3. Legacy mail retrieval protocol.
• →Port 143 (TCP): IMAP. Modern mail retrieval with folder support.
• →Port 161 (UDP): SNMP. Network device monitoring and management.
• →Port 162 (UDP): SNMP Trap. Unsolicited notifications from devices.
• →Port 389 (TCP and UDP): LDAP. Directory services and authentication.
• →Port 443 (TCP): HTTPS. Encrypted web traffic. Ubiquitous in modern networks.
• →Port 465 (TCP): SMTPS. SMTP over TLS. Mail submission with encryption.
• →Port 587 (TCP): SMTP submission. Modern mail submission port with STARTTLS.
• →Port 636 (TCP): LDAPS. LDAP over TLS.
• →Port 993 (TCP): IMAPS. IMAP over TLS.
• →Port 995 (TCP): POP3S. POP3 over TLS.

Registered ports: 1024 to 49151

Registered ports are assigned to specific applications but are not restricted to privileged use. You will encounter these frequently in enterprise networks.

• →Port 3306 (TCP): MySQL database service.
• →Port 3389 (TCP and UDP): RDP. Remote Desktop Protocol for Windows systems.
• →Port 5432 (TCP): PostgreSQL database service.
• →Port 5900 (TCP): VNC. Virtual Network Computing for remote desktop.
• →Port 8080 (TCP): HTTP alternate. Often used for proxies and application servers.
• →Port 8443 (TCP): HTTPS alternate. Common for management interfaces.
• →Port 27017 (TCP): MongoDB. NoSQL database default port.

Dynamic and private ports: 49152 to 65535

Dynamic ports are used for ephemeral connections and are not assigned to specific services. However, certain ranges are commonly reserved for internal use. These ports are typically assigned by the operating system to client connections.

When you see traffic on ports above 49151, you are usually looking at client-side connections responding to server requests on well-known or registered ports. Firewall rules often permit return traffic on the entire dynamic range to simplify stateful inspection.

TCP versus UDP: when and why

TCP provides reliable, ordered delivery with connection setup and teardown. Use it when data integrity is critical: email, web, file transfer, remote access. UDP is connectionless and fast, accepting occasional packet loss. Use it for real-time traffic: DNS queries, VoIP, video streaming, SNMP queries.

Some services run on both. DNS, for example, uses UDP port 53 for standard queries but falls back to TCP port 53 for zone transfers and responses exceeding 512 bytes. LDAP similarly supports both TCP and UDP on port 389, though TCP is more common in practice.

Practical tips for memorization and troubleshooting

• →Group by function: group mail ports (25, 465, 587, 110, 143, 993, 995), web ports (80, 443, 8080, 8443), and remote access ports (22, 23, 3389, 5900).
• →Learn the pattern: SSH is 22, Telnet is 23. SMTP is 25, SMTPS is 465. HTTP is 80, HTTPS is 443.
• →Use netstat or ss to verify: netstat -tuln (Linux) or Get-NetTCPConnection (PowerShell) shows listening ports in real time.
• →Test with telnet or nc: telnet 10.0.0.1 443 confirms reachability to a specific port.
• →Check firewall rules: verify inbound and outbound ACLs permit required ports before troubleshooting application issues.

Mastering these ports accelerates your ability to design networks, diagnose faults, and configure security policies. Print a reference sheet, use it daily in your lab, and the numbers will become automatic. For a complete, searchable reference organized by port number, protocol, and service, use the Elematron Port Reference tool below.

The infrastructure ports network engineers hit most

General port lists lean towards application services. These are the ones that turn up in routing, VPN and device-management work, and they are worth knowing on sight.

• →Port 179 (TCP): BGP. Any peering session that will not establish starts here.
• →Ports 500 and 4500 (UDP): IKE and IPsec NAT-T. If 4500 is blocked, tunnels fail wherever NAT sits in the path.
• →Port 123 (UDP): NTP. Broken time breaks certificate validation, log correlation and some authentication.
• →Port 514 (UDP): Syslog. The first thing to check when a device stops reporting.
• →Ports 1812 and 1813 (UDP): RADIUS authentication and accounting, behind most 802.1X and admin-login designs.