Common Ports

What It Is

Ports identify application services above IP. TCP and UDP port numbers are not security labels, but they are still useful for firewall policy, packet captures, NAT, service discovery, troubleshooting, and exposure reviews. Modern port work is less about memorizing every number and more about knowing what should never be exposed, what needs bidirectional flows, and what encryption or tunneling hides.

Core Operator Ports

Modern note: HTTPS on 443 no longer means "web page." It may be an API, tunnel, remote access tool, malware C2, QUIC fallback, or SaaS control plane.

Infrastructure And Management

Watch out: Management ports belong on management networks, VPN/ZTNA, or bastion paths. A firewall allow rule is not an access strategy.

Database And Application Ports

Watch out: Many databases now support TLS and authentication, but they still should not be treated like public-facing services.

Network And Routing Protocols

Modern note: Not every firewall rule is TCP or UDP. GRE, ESP, AH, ICMP, OSPF, and other IP protocols need protocol-level handling.

Web, DNS, And Modern Client Traffic

Watch out: Blocking UDP/443 may break HTTP/3 but most clients fall back to TCP/443. That can be a troubleshooting clue.

"Do Not Expose" Short List

Cisco IOS/IOS-XE Examples

Simple infrastructure ACL pattern:

ip access-list extended INFRA-IN
 remark Allow SSH from management subnet only
 permit tcp 10.10.10.0 0.0.0.255 any eq 22
 remark Allow SNMP polling from monitoring servers only
 permit udp host 10.10.20.50 any eq 161
 remark Allow DNS to approved resolvers
 permit udp any host 10.10.30.53 eq 53
 permit tcp any host 10.10.30.53 eq 53
 deny ip any any log

Control-plane reminder:

show control-plane host open-ports
show access-lists INFRA-IN

Notes:

• Match source and destination deliberately. A port-only allow rule is usually too broad.
• Add remarks so the rule explains ownership and intent.
• Place management service ACLs close to the device or management boundary.
• Use platform control-plane protection where available. Interface ACLs alone may not cover every punt path.

Troubleshooting

Commands

ss -tulpen
nc -vz example.com 443
dig example.com A
dig +tcp example.com A
curl -v https://example.com/
tcpdump -nn host 198.51.100.10 and port 443

show control-plane host open-ports
show ip sockets
show access-lists
show platform software fed active punt cause summary

Expected clues:

• The service is actually listening on the expected interface.
• Firewall logs show allow, deny, or timeout behavior.
• TCP handshakes complete before TLS or app troubleshooting starts.
• UDP return traffic is allowed back through stateful devices.
• DNS can use TCP when responses require it.
• Control-plane ports on routers and switches are not exposed to untrusted networks.

Watch Out

• Do not trust a port number alone to identify an application.
• Do not expose management services directly to the Internet.
• Do not forget UDP when troubleshooting voice, VPN, DNS, QUIC, gaming, or telemetry.
• Do not block all ICMP and then expect PMTUD and diagnostics to work cleanly.
• Do not assume "closed" and "filtered" mean the same thing.
• Do not publish firewall rules without owner, purpose, source, destination, port, and expiration context.

References

• IANA Service Name and Transport Protocol Port Number Registry
• RFC 6335: Internet Assigned Numbers Authority Procedures for the Management of the Service Name and Transport Protocol Port Number Registry
• RFC 7858: DNS over TLS
• RFC 9000: QUIC
• RFC 9001: Using TLS to Secure QUIC