Updated 1 Nov 2026 · 6 min read
On this page
By the end of this guide you will be able to give the port number and transport for every protocol in CompTIA's N10-009 port table, pair each cleartext protocol with its protected replacement, and explain the few places where exam shorthand and the official port registry do not line up.
Where port numbers come from
Port numbers are assigned by IANA, and the official list is the Service Name and Transport Protocol Port Number Registry. RFC 6335 splits the number space into three ranges: System Ports, also known as Well Known Ports, from 0 to 1023, User Ports, also known as Registered Ports, from 1024 to 49151, and Dynamic Ports, also known as Private or Ephemeral Ports, from 49152 to 65535. Dynamic Ports are never assigned.
Two facts about the registry will save you confusion. First, a registration describes a service, not your traffic. IANA's own note on the registry warns that traffic flowing to or from a registered port does not necessarily correspond to the assigned service. Second, many services are registered for both TCP and UDP. HTTP has entries for 80/tcp and 80/udp, yet RFC 9110 names TCP port 80 as the default for http URIs. So learn the transport from each protocol's own specification, not from the registry alone.
TCP or UDP
RFC 9293 says TCP provides "a reliable, in-order, byte-stream service". UDP, defined in RFC 768, sends messages "with a minimum of protocol mechanism", and its delivery and duplicate protection are not guaranteed.
In the N10-009 table, the protocols whose specifications put them on UDP are DHCP (RFC 2131: "DHCP uses UDP as its transport protocol"), TFTP (RFC 1350 implements it on top of UDP), NTP (RFC 5905: "The NTP packet is a UDP datagram"), SNMP (RFC 3417 suggests configuring command responders to listen on UDP port 161 and notification receivers on UDP port 162) and syslog (RFC 5426 uses UDP port 514). DNS and SIP are specified for both transports. RFC 1035 provides DNS access over TCP and UDP on port 53, and RFC 7766 requires DNS servers to support TCP. RFC 3261 gives SIP a default port of 5060 for UDP, TCP and SCTP, and 5061 for TLS.
The N10-009 port table, grouped by job
CompTIA prints this list under objective 1.4 of the N10-009 exam objectives (version 4.0). The protocol names and ports below are CompTIA's. The transport column comes from each protocol's RFC or, for the Microsoft protocols, Microsoft's documentation.
| Group | Protocol (CompTIA's name) | Port | Transport |
|---|---|---|---|
| Remote access | Secure Shell (SSH) | 22 | TCP |
| Remote access | Telnet | 23 | TCP |
| Remote access | Remote Desktop Protocol (RDP) | 3389 | TCP and UDP |
| File transfer | File Transfer Protocol (FTP) | 20/21 | TCP |
| File transfer | Secure File Transfer Protocol (SFTP) | 22 | Runs inside SSH |
| File transfer | Trivial File Transfer Protocol (TFTP) | 69 | UDP |
| File transfer | Server Message Block (SMB) | 445 | TCP |
| Simple Mail Transfer Protocol (SMTP) | 25 | TCP | |
| Simple Mail Transfer Protocol Secure (SMTPS) | 587 | TCP, see the traps below | |
| Network services | Domain Name System (DNS) | 53 | UDP and TCP |
| Network services | Dynamic Host Configuration Protocol (DHCP) | 67/68 | UDP |
| Network services | Network Time Protocol (NTP) | 123 | UDP |
| Management | Simple Network Management Protocol (SNMP) | 161/162 | UDP |
| Management | Syslog | 514 | UDP |
| Directory | Lightweight Directory Access Protocol (LDAP) | 389 | TCP |
| Directory | Lightweight Directory Access Protocol over SSL (LDAPS) | 636 | Registered for TCP and UDP |
| Web | Hypertext Transfer Protocol (HTTP) | 80 | TCP |
| Web | Hypertext Transfer Protocol Secure (HTTPS) | 443 | TCP (HTTP/3 uses UDP) |
| Applications | Structured Query Language (SQL) Server | 1433 | TCP |
| Applications | Session Initiation Protocol (SIP) | 5060/5061 | UDP and TCP, TLS on 5061 |
DHCP's pair of ports is easy to reverse. RFC 2131 sends client-to-server messages to the DHCP server port, 67, and server-to-client messages to the DHCP client port, 68. SNMP splits the same way: RFC 3417 suggests 161 for command responders and 162 for notification receivers.
Secure and insecure pairs
Telnet and FTP expose passwords on the network. RFC 2941 notes that Telnet passwords "are passed in clear text through the network", and RFC 2228 says FTP uses usernames and passwords "passed in cleartext". Each protocol below has a protected counterpart.
| Cleartext protocol | Protected alternative | How the protection is added |
|---|---|---|
| Telnet, 23 | SSH, 22 | RFC 4251 describes SSH as a protocol for secure remote login over an insecure network. |
| FTP, 20/21 | SFTP, 22, or FTPS, 990 (control) and 989 (data) | SFTP is the file transfer protocol for SSH. FTPS adds TLS to FTP: RFC 4217 negotiates it on the normal FTP control port, and IANA separately registers 990 and 989 for FTP over TLS/SSL. |
| HTTP, 80 | HTTPS, 443 | RFC 9110 calls TCP port 443 the reserved port for HTTP over TLS. |
| LDAP, 389 | LDAPS, 636 | IANA registers 636 as "ldap protocol over TLS/SSL". |
| SMTP, 25 | Message submission on 587 or 465 | For mail clients sending mail: STARTTLS on 587, or TLS from the first byte on 465 (RFC 8314). Relay between mail servers continues to use port 25 (RFC 6409). |
| IMAP, 143, and POP3, 110 | IMAPS, 993, and POP3S, 995 | IANA registers both as the protocol over TLS. |
| DNS, 53 | DNS over TLS, 853 | RFC 7858 has servers accept TCP connections on 853. |
| SIP, 5060 | SIP over TLS, 5061 | RFC 3261 sets 5061 as the default for TLS. |
SNMP is the exception to the "new port" pattern. Security comes from the protocol version, not a port: RFC 3414 defines the User-based Security Model that gives SNMP version 3 message level security, while the ports suggested in RFC 3417 stay UDP 161 and 162.
Five details that trip people up
SFTP is not IANA's "sftp". In the IANA registry, the service name sftp on port 115 is the Simple File Transfer Protocol. The SFTP in CompTIA's table is the SSH File Transfer Protocol, which its IETF draft calls "the standard file transfer protocol for use with the SSH2 protocol". It uses SSH's connection on port 22.
CompTIA's SMTPS is port 587. In the IANA registry, 587 is "submission" (RFC 6409) and 465 is "submissions", Message Submission over TLS (RFC 8314). RFC 8314 asks clients and servers to support both STARTTLS on 587 and Implicit TLS on 465, and says there is no significant difference in security between them when both are correctly set up to require TLS. Answer exam questions with CompTIA's table, and know both ports for real mail servers.
FTP's data port is worked out, not separate. RFC 959 assigns the control connection port L = 21, and the server's default data port is the adjacent port, L minus 1. So 21 minus 1 gives 20.
HTTPS is not always TCP. HTTP/3 runs HTTP over QUIC, and RFC 9114 says servers may serve HTTP/3 on any UDP port. IANA also registers https on 443/udp.
Port 514 has two owners. IANA registers 514/udp as syslog, but 514/tcp as "shell".
How this fits your exam
CompTIA Network+ N10-009: objective 1.4, "Explain common networking ports, protocols, services, and traffic types", contains the port table above. The same objective lists the IP types ICMP, TCP, UDP, GRE and IPSec (AH, ESP and IKE) and the traffic types unicast, multicast, anycast and broadcast. The Network+ N10-009 exam guide covers the rest of the blueprint.
CompTIA Security+ SY0-701: objective 2.2, "Explain common threat vectors and attack surfaces", lists open service ports. Objective 4.5, "Given a scenario, modify enterprise capabilities to enhance security", lists ports/protocols under firewall, and protocol selection, port selection and transport method under implementation of secure protocols. Objective 2.5 lists disabling ports/protocols as a hardening technique. See the Security+ SY0-701 exam guide for how these objectives sit in the wider exam.
Frequently asked questions
Is SFTP the same as FTPS?
No. SFTP is the SSH File Transfer Protocol and travels inside an SSH connection, which listens on port 22. FTPS is ordinary FTP with TLS added. RFC 4217 starts the session on the normal FTP control port and switches to TLS with the AUTH TLS command, while IANA also registers ports 990 and 989 for FTP control and data over TLS/SSL.
Which ports in the N10-009 table use UDP?
DHCP on 67 and 68, TFTP on 69, NTP on 123, SNMP on 161 and 162, and syslog on 514 use UDP according to their RFCs. DNS on 53 and SIP on 5060 use both UDP and TCP, and RDP on 3389 is opened for both in Microsoft's instructions.
Is traffic on port 443 always HTTPS?
No. A port number is a convention, not a guarantee. IANA's registry note says traffic to or from a registered port does not necessarily correspond to the assigned service, and tells firewall administrators to configure systems on their knowledge of the traffic rather than on whether a port is registered.
Sources
- Service Name and Transport Protocol Port Number Registry
- RFC 6335: Internet Assigned Numbers Authority (IANA) Procedures for the Management of the Service Name and Transport Protocol Port Number Registry
- CompTIA Network+ N10-009 Certification Exam: Exam Objectives Version 4.0
- CompTIA Security+ SY0-701 Certification Exam: Exam Objectives Version 6.0
- RFC 8314: Cleartext Considered Obsolete: Use of Transport Layer Security (TLS) for Email Submission and Access
Put the port table to work with the free N10-009 practice questions, then read the full Network+ study guide.