2. Ports and Protocols: SSH, HTTP, HTTPS, FTP/SFTP and DNS
2.1 Ports and the Well-Known Port List
IP mhanje building, port mhanje flat number. Ek server var ekach veli web server (80), SSH (22) aani MySQL (3306) chalu shaktat karan pratyek vegla port aiktoy (listen karto).
A port is a 16-bit number (0–65535) that identifies a specific process/service on a host. One server with one IP can run a web server (port 80), SSH (port 22) and MySQL (port 3306) at the same time because each listens on a different port. The combination IP:port (e.g. 203.0.113.10:443) is called a socket.
| Range | Name | Meaning |
|---|---|---|
| 0 – 1023 | Well-known ports | Reserved for standard services; need root to bind on Linux |
| 1024 – 49151 | Registered ports | Used by applications (MySQL, MongoDB, dev servers) |
| 49152 – 65535 | Dynamic / ephemeral | Temporary client-side ports chosen by the OS |
Common ports you must remember
| Port | Protocol | Service | Where you will see it |
|---|---|---|---|
| 20, 21 | TCP | FTP (data, control) | Legacy file transfer (avoid; insecure) |
| 22 | TCP | SSH / SCP / SFTP | Logging in to EC2, copying files |
| 23 | TCP | Telnet | Legacy, insecure — never open |
| 25 | TCP | SMTP | Sending e-mail (AWS throttles port 25 by default) |
| 53 | UDP/TCP | DNS | Domain name lookups |
| 67, 68 | UDP | DHCP | Automatic IP assignment |
| 80 | TCP | HTTP | Websites (unencrypted) |
| 110 / 143 | TCP | POP3 / IMAP | Receiving e-mail |
| 443 | TCP | HTTPS | Websites with TLS/SSL |
| 3000 | TCP | Node.js / React dev server | Express apps, npm start |
| 3306 | TCP | MySQL / MariaDB | Database |
| 3389 | TCP | RDP | Windows Remote Desktop |
| 4200 | TCP | Angular dev server | ng serve |
| 5000 | TCP | Flask dev server | flask run |
| 5432 | TCP | PostgreSQL | Database |
| 6379 | TCP | Redis | Cache |
| 8000 | TCP | Gunicorn / Django dev server | Python apps |
| 8080 | TCP | Alternate HTTP / Tomcat / Jenkins | Java apps, proxies |
| 27017 | TCP | MongoDB | NoSQL database |
Security rule of thumb
Only ports 22, 80 and 443 normally need to be open to the internet. Application ports (3000, 5000, 8080) should sit behind a reverse proxy (Nginx/Apache), and database ports (3306, 27017) should never be open to 0.0.0.0/0.
sudo ss -tlnp # which programs are listening on which TCP ports?
sudo ss -ulnp # same for UDP
nc -zv 127.0.0.1 22 # is TCP port 22 open locally?
Why this matters for security
Every open port is a door. Attackers begin with a port scan (Nmap, Part 10) to find doors, then look for weak services behind them. Defenders do the reverse: close every port that is not needed, and restrict the rest by source IP. "Attack surface" (हल्ल्यासाठी उघडी असलेली बाजू) is mostly the list of open ports and the services behind them.
Ravindra Bagale's Tip
Khup students ports che list ratatat pan kontya port var TCP aani kontya var UDP he visartat – DNS 53 (UDP aani TCP), DHCP 67/68 UDP. Nmap default fakt TCP scan karto, mhanun UDP services "disat nahit". Table madhla protocol column pan lakshat theva.
Practice task
Without looking, write the default ports for SSH, FTP, Telnet, SMTP, DNS, HTTP, HTTPS, MySQL, RDP and PostgreSQL. Then run sudo ss -tlnp on a Linux machine and name each listening service.