Application layer protocols and their ports: FTP, SSH, Telnet, SMTP, POP3, DNS, HTTP(S), DHCP, SNMP

What is a protocol?

A protocol is an agreed set of rules for exchanging data between devices. It defines what is sent, how it is formatted and when each side should speak. For example, a protocol decides how a sender signals that it has finished, how the receiver confirms it got the message and how errors are detected. Standard protocols give devices from any manufacturer a common language.

Protocols at each TCP/IP layer

File transfer: FTP

The File Transfer Protocol copies files between a client and a server. It uses two separate connections: a control connection on TCP port 21 for commands, and a data connection (traditionally port 20) for the files themselves. It handles both text and binary files. FTP sends usernames and passwords in plain text, so use SFTP (over SSH) or FTPS instead.

Remote access: Telnet and SSH

• Telnet (TCP 23) lets you open a text session on a remote device, as if you were sitting at its console. Everything, including passwords, is sent unencrypted, so it should be disabled on all devices.
• SSH (Secure Shell) (TCP 22) does the same job securely: it authenticates both sides and encrypts the whole session. It is the standard way to manage routers, switches and servers.

Email: SMTP, POP3 and IMAP

• SMTP (Simple Mail Transfer Protocol) sends email: from your mail app to your mail server, and from server to server across the internet. It is a text-based protocol that runs over TCP (port 25 between servers; 587 for users submitting mail).
• POP3 (TCP 110, or 995 with TLS) downloads mail to one device so it can be read offline. It is simple, but mail usually lives on that one device and searching on the server isn't supported.
• IMAP (TCP 143, or 993 with TLS) keeps mail on the server and synchronises it across all your devices. This is what most people use today.

Names: DNS

The Domain Name System (UDP and TCP port 53) turns names that people remember, like example.com, into IP addresses that computers use. It also stores other records, such as which servers receive a domain's email.

Read the full story in How DNS works.

The web: HTTP and HTTPS

HTTP (TCP 80) is the protocol between browsers and web servers. It works in request and response pairs:

• A request contains a request line (the method, such as GET to fetch or POST to send data, and the page wanted), header fields (such as the server's name) and sometimes a message body.
• A response contains a status line (such as 200 OK or 404 Not Found), headers and the body, usually the page itself.

HTTP is stateless: each request stands alone, so websites use cookies to remember who you are.

HTTPS (TCP 443) is HTTP inside an encrypted TLS connection. It protects against eavesdropping and tampering, and proves the server's identity with a certificate. Every website should use HTTPS today.

Addresses: DHCP

The Dynamic Host Configuration Protocol hands out IP settings automatically: an IP address from a pool (called a scope), plus the subnet mask, default gateway and DNS servers. Addresses are leased for a set time and return to the pool when no longer used. A PC moved to another subnet simply receives a new address. DHCP uses UDP port 67 (server) and 68 (client). See DHCP explained.

Monitoring: SNMP

The Simple Network Management Protocol lets a monitoring system read information from network devices (traffic, errors, CPU, temperature) and receive alerts from them. Polling uses UDP port 161; alerts (traps) use UDP 162. Use SNMPv3, which adds authentication and encryption; versions 1 and 2c send their "community string" password in plain text.

Quick reference

Look up any port with the free port lookup tool.