Must-Know Ports and Protocols for OSI Model Beginners

If you’re getting into cybersecurity, ethical hacking, or networking, one of the first things you need to get comfortable with is common ports and protocols.

Why?

Because when you're scanning networks, analyzing traffic, or just exploring how computers talk to each other, you'll constantly see numbers like 21, 80, 443, and more. These aren't just random—they're ports, and each one represents a service or protocol.

Let’s break it all down.

What Are Ports?

Think of your computer like a huge office building, and each port is a specific room where a certain kind of work happens. If a port is “open,” it means the room is active and a certain service is running—like a file transfer room, a mail room, or a web server room.

These ports are associated with protocols, which are basically rules for how that type of work gets done.

Let’s look at the most important ports and what they mean.

TCP Ports You’ll See All the Time

Port 21 – FTP (File Transfer Protocol)

• Use: Transferring files between computers.

• You’ll see it: A LOT in CTFs and penetration testing labs.

• What it does: Allows you to upload/download files from a server.

Port 22 – SSH (Secure Shell)

• Use: Secure remote login to another machine.

• Why it matters: Encrypted, so safe to use over networks.

• Compare it to: Telnet (port 23), which does the same thing but is not secure (clear text).

Port 23 – Telnet

• Use: Remote login without encryption.

• Why it’s dangerous: Sends everything in plain text (e.g., passwords), so it’s rarely used today.

Email-Related Ports

Even though email isn’t a huge focus, you might see these:

• Port 25 – SMTP (Simple Mail Transfer Protocol): Sending mail.

• Port 110 – POP3 (Post Office Protocol): Receiving mail.

• Port 143 – IMAP (Internet Message Access Protocol): Managing emails on a server.

Web Browsing

Port 80 – HTTP

• Use: Unsecured web traffic.

• Common sites: Older websites or internal tools.

Port 443 – HTTPS

• Use: Secure web traffic.

• Why it matters: Encrypted (uses SSL/TLS), so it's safe for things like login pages, banking, etc.

• What you see most often today.

File Sharing – The Big One for Pen Testers

Ports 139 & 445 – SMB (Server Message Block)

• Also called: Samba (especially on Linux).

• Use: File sharing between computers.

• Why it’s HUGE in pentesting: So many vulnerabilities have been found here (like the infamous WannaCry ransomware, based on a flaw in SMB called EternalBlue).

⚠️ If you see port 445 open—perk up. This port has been involved in some nasty exploits.

DNS – Translating Names to Numbers

Port 53 – DNS (Domain Name System)

• Use: Turns easy names like google.com into IP addresses like 172.217.1.46.

• Why it’s both TCP and UDP: It uses UDP for most lookups, TCP for larger requests like zone transfers.

Other Useful UDP Ports

Port 67/68 – DHCP (Dynamic Host Configuration Protocol)

• Use: Automatically gives your device an IP address when you join a network.

• Fun fact: If you plug into your Wi-Fi and instantly get access—that’s DHCP doing its job.

Port 69 – TFTP (Trivial File Transfer Protocol)

• Use: A simpler, lighter version of FTP.

• Runs on: UDP instead of TCP.

• Common use: Transferring firmware or config files in small environments.

Port 161 – SNMP (Simple Network Management Protocol)

• Use: Used to monitor and manage devices on a network (like routers, switches).

• Can leak info: Sometimes you can get valuable data from misconfigured SNMP services.

Static vs. Dynamic IPs

• Dynamic IP (via DHCP): You get a random address for a short period (a lease).

• Static IP: You manually assign a specific IP that doesn't change.

• How does DHCP know your device? By your MAC address—your device’s unique fingerprint on a network.

Why Should You Memorize These?

Because every time you scan a network or look at open ports, you need to instantly recognize what services are running and what they mean for your attack surface.

Example:

You scan a machine and see port 21 open? Your brain should instantly go: “FTP. Can I log in anonymously?”

What’s Next?

Now that you understand these core ports and protocols, you’ll be ready to learn the OSI Model—the layered system that explains how data moves from one computer to another. And trust me, once you know what each port means, the OSI model will start to make way more sense.

---

Quick Reference Summary

Final Thoughts

This is the kind of knowledge that separates a beginner from someone who's actually dangerous in a good way. Ports and protocols are the front door to everything on a network. Learn them well, and the rest of networking and hacking will start to fall into place.

Stay tuned—we’re diving into the OSI Model next. Let’s keep leveling up.