Protocols & Ports
Ports are the doors into a system. Protocols are the languages spoken through those doors. Master both.
TCP vs UDP
TCP (Transmission Control Protocol)
- Connection-oriented: Establishes a session before sending data.
- Reliable: Guarantees delivery via acknowledgments (ACKs).
- Ordered: Packets arrive in sequence (sequence numbers).
- Error-checked: Corrupted packets are retransmitted.
- Flow control: Prevents overwhelming the receiver.
UDP (User Datagram Protocol)
- Connectionless: Fire and forget - no session setup.
- Unreliable: No delivery guarantee, no retransmission.
- Unordered: Packets may arrive out of sequence.
- No error recovery: Application must handle errors.
- Lightweight: Minimal overhead, very fast.
Pentest Insight
nmap -sU) - you might find SNMP, TFTP, or NFS hiding there.
The TCP 3-Way Handshake
Before any data is sent over TCP, a connection must be established. This is the foundation of TCP's reliability.
⚠️ Attack: SYN Flood (DoS)
An attacker sends thousands of SYN packets with spoofed source IPs. The server allocates resources for each half-open connection, eventually exhausting memory.
hping3 -S --flood -V -p 80 <target>
Common Ports Reference
Memorize these. On every engagement, you'll encounter them.
High-Value Targets
| Port | Service | Protocol | Why It Matters |
|---|---|---|---|
| 21 | FTP | TCP | Anonymous login, cleartext creds |
| 22 | SSH | TCP | Bruteforce, key-based auth bypass |
| 23 | Telnet | TCP | Cleartext everything - sniff it all |
| 445 | SMB | TCP | EternalBlue, null sessions, relay attacks |
| 3389 | RDP | TCP | BlueKeep, NLA bypass, credential spray |
| 1433 | MSSQL | TCP | xp_cmdshell, sa account |
| 3306 | MySQL | TCP | Root no password, UDF exploitation |
Web Services
| Port | Service | Notes |
|---|---|---|
| 80 | HTTP | Standard web - always enumerate |
| 443 | HTTPS | Check for SSL vulns, virtual hosts |
| 8080 | HTTP Proxy | Tomcat, Jenkins, dev servers |
| 8443 | HTTPS Alt | Management interfaces |
Active Directory / Windows
| Port | Service | Attack Surface |
|---|---|---|
| 88 | Kerberos | AS-REP Roasting, Kerberoasting |
| 135 | RPC | Enumeration, DCOM attacks |
| 389 | LDAP | Anonymous bind, user enumeration |
| 636 | LDAPS | Encrypted LDAP |
| 5985 | WinRM HTTP | Remote PowerShell access |
| 5986 | WinRM HTTPS | Encrypted remote PowerShell |
Quick Scan Commands
nmap -sT -T4 <target>nmap -sV -sC -p- <target>nmap -sU --top-ports 100 <target>nmap -sV -p 21,22,23,25,80,443,445,3389 <target>Related Tools
Port Reference
Complete searchable port database.
Nmap Builder
Interactively build scan commands.
Evidence Collection
A port finding is a claim about a control and a state. Keep the record that shows both:
The scan record:
The nmap XML or normal-format output with the command line it came from - the scan type matters: -sS, -sT, -sU and -Pn produce different pictures of the same host.
Start and end time: The scan start and finish timestamps, and the source address it was launched from. A port that was open last week is not evidence of anything today.
State, not just "open":
For every port you report, the state as returned - open, closed or filtered - because a filtered port is a boundary control and a closed one is a host with nothing listening.
Service proof:
The banner or -sV probe response for each open port, quoted rather than inferred from the port number. Port 8443 is not automatically an administrative interface.
False Positive Identification
- Filtered read as closed: A host-based firewall rejecting with RST is indistinguishable from a closed port at the scanner. Only the vantage point separates them; report "closed" as "nothing listening" and nothing more.
- UDP silence: No ICMP port-unreachable is not proof that no UDP service exists - rate limiting, ICMP filtering and application-level drop all look the same. Repeat, widen the timeout, and say so.
- Middlebox resets: Load balancers, IPS and proxies answer on behalf of the backend. A SYN-ACK from an appliance proves the appliance is reachable, not the service behind it.
- A service on a moved port: Finding an admin panel on 8443 does not prove 443 is closed, and finding nothing on 8080 does not prove the application is not published on another virtual host.
Scan Verification Checklist
TCP
- ☐ Run the sweep twice, minutes apart, and reconcile the differences before reporting them.
- ☐ Fall back to a TCP connect scan when a SYN scan returns everything filtered, and note which you used.
- ☐ Confirm service versions with a version probe rather than assuming from the port number.
UDP
- ☐ Scan the top UDP ports, not the whole range - and check whether ICMP unreachables are permitted to your source.
- ☐ Probe the classic quiet services directly: SNMP, TFTP, NTP, mDNS and IKE on 500/4500.
- ☐ Record which ports timed out versus answered, since the two mean different things.
Corroboration
- ☐ Compare against the client asset inventory and the firewall rule export for the same segment.
- ☐ Re-scan from a second vantage point to separate host-local filtering from network filtering.
- ☐ Check for services bound to loopback or a management interface that never answered the scan at all.
Remediation & Defense
The fix is rarely "close one port" - it is reducing what listens and controlling what can reach it.
Reduce exposure
- • Retire cleartext legacy daemons - telnet 23, FTP 21, POP3/IMAP on 110/143, SMBv1 on 445 - rather than firewalling them.
- • Bind management services to a management interface or loopback, and publish admin consoles only through Bastion or a VPN.
- • Disable unused services on the host itself; a port that is closed on the host cannot be exposed by a future rule change.
Filter at the boundary
- • Default-deny inbound ACLs with an explicit allow per service, per source, per direction, reviewed quarterly.
- • Enable SYN cookies and connection rate limits on internet-facing listeners so a scan or flood cannot exhaust the backlog.
- • Log denies on the boundary device and alert on scans of the high-value ports listed on this page.