Protocol = communication rules
HTTP defines web requests. DNS defines name lookups. TCP defines reliable, ordered transport. Protocols exist at different layers.
Ports & protocols cheat sheet
Compare common services, their default port numbers, and their place in the OSI model. Start here: a protocol is a set of rules; a port number identifies a communication endpoint within a device.
IP address = network address
An IP address identifies a network interface for packet delivery. It helps traffic reach the destination device.
Port = endpoint number
TCP and UDP carry source and destination port numbers. These help deliver data to the right application or service. They are different from physical switch ports.
Remember: the service and its port belong to different layers. HTTP is commonly mapped to Layer 7. TCP is Layer 4, and its header carries port 80. Saying “HTTP uses port 80” does not make HTTP a Layer 4 protocol.
Common ports at a glance
These are common default uses, not every registered transport or every possible configuration. All port numbers below are carried at Layer 4; the service column shows the conventional OSI mapping of the protocol above that transport.
| Protocol / service | Port(s) | Transport | Service layer | Purpose | Remember |
|---|---|---|---|---|---|
| FTP | 20 / 21 | TCP | L7* | File transfer | 21: control; 20: server data port in active FTP. Passive FTP uses a negotiated data port. |
| SSH / SFTP | 22 | TCP | L7* | Secure remote login / file transfer | SFTP runs over SSH; it is different from FTPS. |
| Telnet | 23 | TCP | L7* | Remote terminal | Unencrypted legacy protocol; use SSH for secure administration. |
| SMTP | 25 | TCP | L7* | Server-to-server email | Mail transfer between servers. |
| DNS | 53 | UDP / TCP | L7* | Name resolution | Both transports are required; TCP is used for zone transfers and other cases, including large replies. |
| DHCPv4 | 67 / 68 | UDP | L7* | Automatic IPv4 configuration | 67: server; 68: client. |
| TFTP | 69 | UDP | L7* | Simple file transfer | 69 starts the request; subsequent transfer packets use selected transfer IDs (UDP ports). |
| HTTP | 80 | TCP | L7* | Web requests | Common default for unencrypted HTTP. |
| POP3 | 110 / 995 | TCP | L7* | Retrieve email | 110: POP3, can upgrade with STLS; 995: implicit TLS. |
| NTP | 123 | UDP | L7* | Clock synchronization | Keeps device clocks aligned. |
| IMAP | 143 / 993 | TCP | L7* | Access mailboxes | 143: IMAP, can upgrade with STARTTLS; 993: implicit TLS. |
| SNMP | 161 / 162 | UDP | L7* | Network monitoring | 161: queries; 162: traps / notifications. SNMPv3 supports authentication and encryption. |
| BGP | 179 | TCP | L7* | Exchange routes between peers | Routing purpose relates to Layer 3; BGP messages run over TCP as an application/control protocol. |
| LDAP | 389 / 636 | TCP | L7* | Directory services | 389: LDAP, can upgrade with STARTTLS; 636: implicit TLS. |
| HTTPS | 443 | TCP / UDP | L7* | Encrypted web requests | HTTP/1.1 and HTTP/2 commonly use TLS over TCP; HTTP/3 uses QUIC over UDP. |
| SMB | 445 | TCP | L7* | File and printer sharing | Direct-hosted SMB, commonly used on Windows networks. |
| Syslog | 514 / 6514 | UDP / TCP | L7* | Device logs | 514/UDP: traditional syslog; 6514/TCP: syslog over TLS. |
| RIPv2 | 520 | UDP | L7* | Exchange IPv4 routes | Routing purpose relates to Layer 3; its messages use UDP. |
| DHCPv6 | 546 / 547 | UDP | L7* | Automatic IPv6 configuration | 546: client; 547: server / relay. |
| SMTP submission | 587 / 465 | TCP | L7* | Send email from a client | 587: submission, commonly with STARTTLS; 465: submission with implicit TLS. |
| RIPng | 521 | UDP | L7* | Exchange IPv6 routes | IPv6 version of RIP. |
| RDP | 3389 | TCP / UDP | L7* | Remote desktop | Modern RDP can use both transports. |
*L7 is a practical teaching mapping for application protocols. BGP, RIP, and RIPng exchange routing information used by Layer 3, but their messages run above TCP or UDP. Internet protocols do not always fit neatly into one OSI layer.
A port number alone does not prove which application is running or whether traffic is safe. Defaults can be changed, and TCP port 53 and UDP port 53 are separate endpoints.
Where do protocols fit in the seven layers?
The OSI model describes functions. Real TCP/IP implementations combine some of these functions, especially Layers 5–7.
| Layer | Main job | Examples / functions | Port relationship |
|---|---|---|---|
| 7 · Application | Network services and application messages | HTTP, DNS, DHCP, SSH, SMTP, SNMP | Services use transport ports; ports are not in their application headers. |
| 6 · Presentation | Data representation, encoding, encryption | Encoding and serialization; TLS is often discussed here as an encryption example. | No separate “Layer 6 port.” TLS does not map perfectly to a single OSI layer. |
| 5 · Session | Manage application conversations | Session setup, coordination, and checkpoints | No separate “Layer 5 port”; applications often implement these functions. |
| 4 · Transport | Communication between endpoints | TCP, UDP | Source and destination port numbers live here. |
| 3 · Network | Address and route packets | IPv4, IPv6, ICMP, OSPF | These protocols have no TCP/UDP port of their own. |
| 2 · Data Link | Deliver frames across a local link | Ethernet MAC, Wi-Fi MAC, ARP (commonly mapped here) | Uses link identifiers such as MAC addresses, not TCP/UDP ports. |
| 1 · Physical | Transmit bits as signals | Copper electrical signals, fiber light, radio signals | No logical service port numbers. |
ARP links IPv4 addressing to link-layer addressing, so some explanations place it between Layers 2 and 3. It is carried directly in link-layer frames. The OSI model applies to communication within a LAN as well as across WANs.
Protocols that do not use TCP/UDP ports
| Protocol | Common OSI mapping | Identifier / job |
|---|---|---|
| ARP | Layer 2 / L2–L3 boundary | EtherType 0x0806 on Ethernet; resolves a local IPv4 address to a MAC address. |
| IPv4 / IPv6 | Layer 3 | EtherTypes 0x0800 / 0x86DD on Ethernet; provide packet addressing and delivery. |
| ICMP / ICMPv6 | Layer 3 | IP protocol numbers 1 / 58; errors and diagnostics. Ping uses echo messages, not a TCP/UDP port. |
| OSPF | Layer 3 | IP protocol number 89; exchanges routing information directly over IP. |
| EIGRP | Layer 3 | IP protocol number 88; exchanges routing information directly over IP. |
| GRE / ESP | Layer 3 | IP protocol numbers 47 / 50; tunneling / IPsec protection. ESP is distinct from UDP encapsulation used with NAT traversal. |
Protocol number ≠ port number. TCP is IP protocol 6; UDP is IP protocol 17. Those identify what IP carries. A TCP or UDP header then identifies endpoints using ports. OSPF's 89 is an IP protocol number, not “port 89.”
One web request, several layers
Example: a laptop opens an HTTPS website using HTTP/2 over TCP. The addresses and client port below are illustrative.
L7 · Application: HTTP request for a web page, protected by TLS above TCP.
L4 · Transport: TCP source port
53000 → destination port 443.L3 · Network: Source IP
192.168.1.10 → server IP 203.0.113.20 (before any NAT).L2 · Data Link: On the first Ethernet hop, a frame uses the laptop's MAC and the gateway's MAC when the server is on another network.
L1 · Physical: The frame's bits travel as electrical, light, or radio signals.
The server's reply uses source port 443 and destination port 53000. A NAT device may rewrite the source IP and port along the path. With HTTP/3, the web request instead travels over QUIC over UDP, commonly to port 443.
Port ranges & common questions
0–1023: system / well-known ports (0 is reserved). 1024–49151: user / registered ports. 49152–65535: dynamic / private ports. Client ephemeral port ranges vary by operating system and configuration.
Does every protocol have a port number?
No. TCP and UDP use ports, but IP, ARP, ICMP, and OSPF do not have TCP/UDP ports of their own.
Is a TCP connection the same as an application session?
No. TCP manages a transport connection at Layer 4. Application sessions, such as a signed-in website session, can continue across multiple connections.
Does port 443 automatically mean the connection is secure?
No. HTTPS uses encryption, but the number 443 itself does not provide security. The application must use TLS or another appropriate secure protocol and validate its peer.
Which ports should I memorize first?
Start with SSH 22, DNS 53, DHCPv4 67/68, HTTP 80, HTTPS 443, NTP 123, and SNMP 161/162. Connect each number to its purpose and transport.
Reference sources
Use the registries for assigned numbers and the RFCs for protocol behavior. This sheet lists common operational uses rather than every registry entry.