Port Cheatsheet

⇥Port reference — 35 of 35

Port	Proto	Service	Why support cares
20	TCP	FTP data	Passive FTP. Blocked by most firewalls.
21	TCP	FTP control	Cleartext credentials — avoid.
22	TCP	SSH	Linux/Unix remote administration.
23	TCP	Telnet	Cleartext. Your JD names it as a test tool.
25	TCP	SMTP	Outbound mail from a mail client.
53	TCP/UDP	DNS	UDP for lookups, TCP for zone transfers.
67	UDP	DHCP server	Offers and acknowledgements.
68	UDP	DHCP client	Discover and Request.
69	UDP	TFTP	Used during PXE network boot.
80	TCP	HTTP	Unencrypted web.
88	UDP/TCP	Kerberos	AD authentication ticket exchange.
123	UDP	NTP	Time sync — Kerberos fails without it.
137	UDP	NetBIOS name	Legacy Windows name service.
139	TCP	NetBIOS session	Legacy file sharing.
143	TCP	IMAP	Mail retrieval.
161	UDP	SNMP	Network monitoring polling.
162	UDP	SNMP trap	Unsolicited device alerts.
389	TCP/UDP	LDAP	AD directory queries.
443	TCP	HTTPS	Also RDP-over-Gateway, SQL Server TLS.
464	TCP/UDP	Kerberos password change
500	UDP	IKE (IPsec)	VPN negotiation phase 1.
514	UDP	Syslog	Centralised log shipping.
636	TCP	LDAPS	LDAP over TLS.
3389	TCP/UDP	RDP	Remote Desktop. Almost guaranteed in a support call.
4500	UDP	NAT-T / IPsec	VPN when UDP 500 is blocked.
3268	TCP	Global Catalog	AD global catalogue search.
3269	TCP	Global Catalog TLS
5985	TCP	WinRM (HTTP)	PowerShell Remoting.
5986	TCP	WinRM (HTTPS)	Remoting over TLS.
1433	TCP	MS SQL Server
3306	TCP	MySQL
5432	TCP	PostgreSQL
27017	TCP	MongoDB
8080	TCP	HTTP alternate	Proxies, Tomcat.
8443	TCP	HTTPS alternate

The ports you must know with no hesitation

Port	Service	Why it comes up
20/21	FTP	Cleartext — usually "should be blocked"
22	SSH	Linux remote admin
23	Telnet	Named in your JD as a testing tool
25	SMTP	Outbound mail
53	DNS	UDP queries, TCP transfers
67/68	DHCP	Server / client
69	TFTP	PXE boot
80	HTTP	Unencrypted web
88	Kerberos	AD authentication
123	NTP	Time sync — Kerberos depends on it
161/162	SNMP	Monitoring / traps
389	LDAP	AD directory queries
443	HTTPS	Also TLS-wrapped services
445	SMB	File and print sharing
500/4500	IKE / NAT-T	IPsec VPN
1433	MSSQL
3306/5432/27017	MySQL / PostgreSQL / MongoDB
3389	RDP	The single most asked port in support
5985/5986	WinRM	PowerShell remoting
3268/3269	Global Catalog	AD multi-DC searches

UDP vs TCP — the difference that matters

	TCP	UDP
Connection	3-way handshake	None
Reliability	Retransmits, ordered	Fire and forget
Speed	Slower	Faster
Used by	HTTP, SSH, SMB, RDP	DNS, DHCP, SNMP, NTP

✖The handshake

TCP: client sends SYN, server replies SYN-ACK, client sends ACK. That is a connection. If you can complete it, the port is open. This is exactly what Test-NetConnection and telnet are testing.

Private IP ranges

Range	Meaning
10.0.0.0/8	Private, Class A
172.16.0.0/12	Private, Class B (172.16–172.31)
192.168.0.0/16	Private, Class C
127.0.0.0/8	Loopback
169.254.0.0/16	APIPA — DHCP failed
224.0.0.0/4	Multicast

Subnet prefixes

Prefix	Mask	Usable hosts
/24	255.255.255.0	254
/25	255.255.255.128	126
/26	255.255.255.192	62
/27	255.255.255.224	30
/28	255.255.255.240	14
/29	255.255.255.248	6
/30	255.255.255.252	2

Default gateways commonly seen

Port / interface	Typical value
Consumer router LAN	192.168.0.1 or 192.168.1.1
pfSense	192.168.10.1
Server SVI	192.168.10.1

Troubleshooting in one line each

Test-NetConnection <host> -Port <n>    # is the port open?
netstat -ano | findstr :<n>            # who is listening here?
nslookup <name>                        # does the name resolve?
Resolve-DnsName <name>                 # richer DNS output
arp -a                                 # IP to MAC on this segment
tracert <host>                         # where does the path stop?

ss -tulpn            # Linux sockets
nc -zv <host> <port> # port test
dig +short <name>    # DNS
ip r                 # routing table