In this lesson,
we're going to discuss ports and protocols.
In security, one of the most important things
is for you to ensure that you understand
what openings you've created inside
of your computer systems.
When it comes to computers and networks,
most of these openings are going to be created
using the concept of an open port.
Now, a port is simply a logical communication endpoint
that exists on your computer or server.
For example, if you're running a secure
web server that's used for e-commerce
on your system, you're going to have port 443 open
and listening for any inbound requests
from your potential visitors.
Now, ports are going to be classified
as either inbound or outbound ports.
An inbound port is used when a computer
or server is listening for a connection.
Just as in my earlier example,
our web server had port 443 open
and listening for a connection.
That is an inbound port.
It's just sitting there and waiting for somebody
to come along and connect to it.
Now, an outbound port on the other hand,
is going to be open by a computer whenever it wants
to connect to a given server.
If my computer is attempting to make a connection
to your web server over port 443,
then my computer is actually going to open
up a random high number port,
like port 52363,
and then it's going to make an outbound request
to your web server using your port 443.
Now, what does all this look like
out in the real world?
Well, let's say we have an example of an inbound
and outbound port that's going to be used
when my laptop attempts to connect
to a remote server over SSH,
which is the Secure Shell protocol.
Now first we're going to have a server
that has a public IP address assigned to it
that's listening on port 22.
So port 22 is going to be our inbound port
awaiting a new connection.
In this case, port 22 will be open
awaiting for that connection to occur.
Now I also have my laptop
and it's the one that wants
to make that connection.
My laptop is going to
be assigned a private IP address
because my network is using network address translation
at the router, and this gives me
additional protections inside of my network.
Now notice at this point,
my laptop doesn't have any ports open yet,
so now my laptop wants to go and establish
that SSH connection.
To do that, it's going to open
up an outbound port on itself and assign
some high number random port to it,
like 51233, and then it's going to
send a request to the SSH server
that is listening over port 22,
which is the server's inbound port,
and it's going to be destined for its IP address,
which in this case
is going to be assigned as 46.124.6313.
Now once the server receives this request
on port 22, it has to respond to it.
So it's going to send a packet of information back
to my laptop's IP using the outbound port
that was opened originally, in this case,
that was port 51233, in reality,
it's going to be a public facing IP address
of my router.
But for our example here on the screen,
I'm just going to use the private IP address
of 192.168.145 just to keep our example clear.
So at this point, my laptop has gone out
and made the request to the server
and the server has answered that request.
This now establishes a session
between both of these devices
and we can then communicate
back and forth as needed.
Once that session is over,
the connection is going to be closed,
my laptop will close its outbound port
because it's no longer needed,
and the server will keep open its inbound port
so they can receive requests from the next user
who wants to be able to use it.
So now that we understand a little bit
about how ports work in the real world,
let's talk a little bit more
about the ports themself.
In addition to being classified
as either an inbound or outbound port,
your port is also going to get a number
and then it's going to be assigned to one
of three groups based on that number.
Now this number can be anywhere
from zero all the way up to 65,535,
and this is a really big range,
so it's actually been divided
into three smaller groups.
Our first group is known as the well-known ports.
Now a well-known port is any port
that is numbered between zero and 1023.
Now these are called well-known ports
because they're designated by IANA,
which is the Internet Assigned Numbers Authority,
and they're going to be able to assign it
to a commonly used port and protocol
that everyone can use.
Now, for example,
something like secure web browsing
is something that we all use on a daily basis,
and it uses HTTPS,
which utilizes port 443.
Another example of a really well-known port
is actually port 23,
which uses Telnet as its protocol.
Both of these are considered
to be well-known ports, and there are hundreds
of others out there as well.
Now, the second group we have
is going to cover our ports from 1024 up to 49,151.
This range is known as the registered port range
because they all have to be used by vendors
for their own proprietary protocols,
and each vendor is going to register the number they want
to use with IANA prior to being able to use them.
For example, Microsoft has an SQL server
that is using one of these registered ports.
In this case it's port 1433,
which is the registered port
for the Microsoft SQL server.
Another good example of this is if you're going to
use the proprietary Microsoft protocol known as RDP
or the Remote Desktop Protocol
because it operates over port 3389.
Now the third and final group we have
is what's known as the dynamic and private ports.
This uses the port range of 49,152
all the way up to the end of our port ranges,
which is 65,535.
These ports can be used by any application
at any time without having
to be registered first with IANA.
Now this range is usually going to be used
by your client whenever it picks
its own random high number port
for its application.
Anytime it wants
to have a temporary outbound connection,
this is the range we're going to be using,
this dynamic and private port range.
It's also very commonly used in things
like gaming, instant messaging and chat too.
Now, once each port is opened,
you can now have communications
to or from your device over that port
using what is known as a protocol.
Now, a protocol is a defined set of rules
and conventions that governs the communication
and data exchange between devices
or systems that specifies the format
and the sequence of messages
that are going to be used
for those communications.
So for example, when I mentioned
that we could use port 443
for secure e-commerce website traffic,
what I was really referring to is the fact
that port 443 is being used with a protocol known
as HTTPS,
which is the Hypertext Transfer Protocol secure
and this is going to be used to send encrypted data
to or from a given e-commerce web server
using data that is supported
over HTTPS connections like HTML.
Now for the rest of this video,
we're going to spend just a little bit of time
here going over each of the different well-known
and registered ports that you should be familiar
with as a cybersecurity professional.
Now for the exam, you are not going to
get a question like,
"Which of the following ports is used
with the SSH protocol?"
That is too easy.
You're not going to be able to select port 22
and get the right answer here,
but you will get questions
about why a secure web connection
is being blocked by a firewall.
And if you don't remember
that secure web connections rely on port 443
to communicate, you're going to miss that question.
Or you might get a question about RDP or SQL
or RADIUS or something like that.
And so all of these are things
that are important for you to understand
from a list of ports and protocols.
And so we do need to take a little bit
of time here to go over these well-known
or registered ports, and you need to take
some time to memorize four things
for each given port.
First, I want you to memorize the port number.
Second, I want you to memorize the protocol
used by that port by default.
Third, I want you to know
whether the protocol supports TCP
or UDP connections.
And fourth, I want you
to know a basic description of what that port
or protocol is going to be used for.
Alright, with all that said, let's get started
with our memorization of ports.
Now, port 21 is used for FTP
or the File Transfer Protocol.
FTP is going to be used to transfer files
from a host to host,
and it operates over port 21 using TCP.
Port 22 is going to be used
for three different things.
It's used for SSH, SCP and SFTP.
SSH is going to provide us
with secure remote terminal access
and file transfer capabilities
over port 22 using TCP.
Essentially, SSH is used for remote control
or remote access using a text-based environment
to a remote server.
SCP is going to provide
with you a secure copy functions over port 22
and SFTP will provide secure file transfers
over port 22 as well.
Next we have port 23,
which is going to be used for Telnet,
and this is a protocol
for remotely accessing network devices
and it operates over port 23 using TCP.
Telnet is the older version of SSH essentially.
It's going to allow you to have remote control
of a computer to be able to access it
over a text-based connection,
but it is unencrypted and considered
to be insecure, so you should not be using
it these days.
But it is important to know
that port 23 is Telnet, because a lot
of exam questions will focus on the ability
of using remote control over port 23
and then ask you how you can better secure it
and the answer would be to close Telnet
and then instead open an SSH port.
Next one we have is port 25.
Port 25 is used for SMTP
or the Simple Mail Transfer Protocol
that's responsible for sending emails
over port 25 using TCP.
Port 53 is going to be used for DNS
or the Domain Name System.
This is going to be used to translate domain names
into IP addresses and it functions
over port 53 using both TCP and UDP connections.
Port 69 is going to be used for TFTP
or the Trivial File Transfer Protocol,
which is a simplified file transfer protocol
that is often used
with network-based operating systems.
This is going to operate
over port 69 using a UDP connection.
Port 80 is the next one we have,
and this is used for HTTP
or the Hypertext Transfer Protocol.
HTTP is used for retrieving webpages
and it operates over page 80 using TCP
in an unencrypted mode.
Next we have port 88, which is used for Kerberos.
Kerberos is a network authentication protocol
that operates over port 88 using UDP.
Port 110 is used for POP3
or the Post Office Protocol Version Three.
POP3 is going to be responsible
for retrieving email from a server
and it operates over port one 10
using TCP connections.
Port 119 is going to be used for NNTP
or the Network News Transfer Protocol,
and it's used for accessing news groups
and it operates over port 119 using TCP.
Next we have port 135, which is used for RPC
or Remote Procedure Call facilities.
This is going to facilitate your communication
between different system processes
and it operates over port 135 using TCP and UDP.
Often you'll see RPC used as part
of the Windows file sharing system.
Next we have ports 137, 138 and 139,
which are all used for NetBIOS.
NetBIOS is a network protocol suite
and it operates over ports 137, 138 and 139
using UDP and TCP.
NetBIOS is used inside
of a Windows domain environment
for you to be able to share things
like internal network names as well
as doing file and printer sharing
in a local Windows environment.
Next we have port 143, which is used for IMAP.
IMAP or the Internet Message Access Protocol
allows for accessing email messages on a server
and be able to operate over port 143
using a TCP connection.
Next we have port 161, which is used for SNMP
or the Simple Network Management Protocol
and SNMP is used to manage network devices
and it operates over port 161 using UDP.
Port 162 is used for SNMP Traps
and SNMP Traps are responsible
for sending SNMP Trap messages
and it operates over port 162 using UDP.
Next we have port 389.
Port 389 is going to be used for LDAP
or the Lightweight Directory Access Protocol.
This is going to be able to help you
with directory services and it operates
over port 389 using TCP.
Port 443 is going to be used for HTTPS
or the Hypertext Transfer Protocol Secure.
And this provides us
with a secure web communication process
that operates over port 443 using TCP.
If you ever go to a website
and it has that little lock in the corner,
that means you're using an HTTPS connection.
Next we have port 445.
Port 445 is going to be used for SMB
or the Server Message Block,
and it's going to be used for file
and printer sharing over a network
and operates using port 445 using TCP.
Next we have ports 465 and 587,
which are going to be used for SMTPS.
SMTPS is also known as SMTP Secure
and it provides us
with secure SMTP communications
to send our emails over port 465
or 587 using either SSL
or TLS and a TCP connection.
Next we have port 514.
Port 514 is used for Syslog
and it's a protocol for sending log messages
and it operates over port 514
using a UDP connection.
Next we have port 636.
Port 636 is used for LDAP Secure or LDAPS.
This allows us
to have our LDAP directory communications happening
over an SSL or TLS connection that is encrypted
and operating over port 636
using a TCP connection.
Next, we have port 993.
Port 993 is used for IMAPS
or the Internet Message Access Protocol
over SSL or TLS and essentially,
this is the secure version of IMAP.
This is going to be used
to do the secure email retrieval over port 993
using a TCP connection.
Next we have port 995.
Port 995 is used for POP3S.
This is the Post Office Protocol Version Three
over SSL or TLS.
This allows us to have secure email retrieval
using a POP3 protocol over port 995
using a TCP connection.
Next we have port 1433.
Port 1433 is used for Microsoft SQL
to facilitate communication
with our Microsoft SQL server and it operates
over port 1433 using a TCP connection.
Next we have ports 1645 and 1646.
Now ports 1645 and 1646 are used for RADIUS
using the TCP version of RADIUS.
And RADIUS is a protocol
for remote authentication,
authorization and accounting
that operates over ports 1645 and 1646
using a TCP connection.
Next we have ports 1812 and 1813,
which are going to be used for RADIUS
when it uses a UDP session.
Now RADIUS again is going to function
over ports 1812 and 1813 using UDP
if we want to use UDP instead of TCP.
Next we have port 3389.
Port 3389 is used by RDP
or the Remote Desktop Protocol
and it enables remote desktop access
and operates over port 3389
using a TCP connection.
And finally we have port 6514
and port 6514 is going to be used for a Syslog TLS,
which is a secure and encrypted version
of Syslog that operates over port 6514
using a TCP connection.
Now, I know that was a lot
of information I just provided
in a very short amount of time.
After watching this video once,
I know you will not have
all these ports memorized
that I just went through.
So I do recommend you take the time
to make a list and test yourself
over and over again on these ports.
This is critical information to answer a lot
of questions on the exam, either directly
or indirectly as you're going to see on test day.
Remember, you can rewatch this video
as many times as you like
to learn these different ports and protocols.
Now with that being said,
I do like the old fashioned method
of making some flashcards
to testing yourself on these ports and protocols.
If you do that, I would write down the protocol
on one side like HTTP, and then I want you
to flip it over and then on the other side,
I want you to have the port number
and the connection type like port 80 TCP.
This way you'll be able to know
what you have on both sides
and you can take the time
to learn these ports and protocols
before you take the exam.
I promise you, taking the time
to learn these ports and protocols is going
to help you a lot come test day
as well as in your future career
as a cybersecurity professional.