Series
Port & protocol security
15 posts in this series. Read them in order or jump to any one.
- Common backdoor and trojan ports to investigate
Ports tied to trojans, backdoors and C2 — NetBus, Back Orifice, ingreslock, Meterpreter and abused legit services — and how to detect a compromise.
- Common TCP and UDP ports: a cheat sheet
A scannable reference of common TCP and UDP ports grouped by purpose — web, mail, file transfer, remote access, databases, and infrastructure.
- How to check which ports are open (Windows, Linux, macOS)
Check open and listening ports on Windows, Linux, and macOS, map a PID to its process, and scan a remote host with Nmap. Commands you can copy-paste.
- How to close or block a port (Windows & Linux)
Learn how to close a port the right way: stop the service vs firewall it. Covers Windows Firewall, ufw, firewalld, iptables, and disabling services safely.
- How to scan ports with Nmap: a practical guide
Learn how to scan TCP and UDP ports with Nmap: install, port selection, SYN vs connect scans, version detection, NSE scripts, and output formats.
- The most commonly attacked ports (and how to secure them)
The internet-facing ports attackers hit first — RDP, SSH, SMB, databases — and the single most important hardening step for each.
- Which ports should you block at the firewall?
A practical guide to ports you should never expose to the internet — SMB, RDP, Telnet, databases and more — with the risk and a safer alternative for each.
- TCP vs UDP: what's the difference?
A clear comparison of TCP and UDP: handshakes, reliability, headers, real-world use cases, and why UDP fuels amplification DDoS attacks.
- UDP amplification DDoS: the ports attackers reflect off
How reflection and amplification DDoS attacks abuse UDP services like DNS, NTP, SNMP, SSDP and Memcached — with amplification factors and how to avoid being a reflector.
- Well-known, registered, and dynamic ports explained
Understand the IANA port ranges: well-known (0-1023), registered (1024-49151), and dynamic (49152-65535), plus how the 16-bit port space and ephemeral ports work.
- What ports does Active Directory use?
The full list of ports a domain controller needs — Kerberos, LDAP, SMB, RPC, Global Catalog — plus why none of them should ever face the internet.
- What ports does DNS use? 53, DoT, mDNS & LLMNR
DNS uses port 53 over both UDP and TCP, with DNS-over-TLS on 853, mDNS on 5353 and LLMNR on 5355. Learn why, plus DNS attacks and how to encrypt lookups.
- What ports does email use? SMTP, IMAP & POP3
A complete guide to email ports: SMTP 25, submission 587, SMTPS 465, POP3 110/995, IMAP 143/993 — when to use each and how to secure them with TLS.
- What ports does FTP use? FTP, FTPS and SFTP ports explained
FTP uses port 21 for control and port 20 for data, with FTPS on 990. Learn active vs passive mode, why SFTP is really SSH on port 22, and what to use.
- What ports does SMB use?
SMB and CIFS use port 445 today, with legacy NetBIOS on 137 and 139. Here is what each does, why 445 is the top ransomware vector, and what to block.