Network+ N10-009 Ports and Protocols Cheat Sheet
Every port on the Network+ N10-009 objectives in one table: protocol, port, TCP or UDP, purpose and secure alternative, plus IP and traffic types.
By CompCertQuiz Editorial · Published · Last reviewed · 7 min read
Part of the Network+ N10-009 study hub: CompTIA Network+ Study Guide (N10-009): 5 Domains
Objective 1.4 of CompTIA Network+ N10-009 lists twenty protocols and their port numbers, and you are expected to know them cold. This cheat sheet puts every port from that list in one table, with the transport protocol, what it does and the secure alternative to each clear-text protocol, then adds the IP protocol types and traffic types from the same objective.
The port list comes from the N10-009 exam objectives (version 6.0) on comptia.org. Transport columns and notes come from the protocol standards and the IANA port registry.
Network+ N10-009 ports and protocols
| Protocol | Port | Transport | What it does | Secure alternative |
|---|---|---|---|---|
| FTP | 20/21 | TCP | File transfer. 21 carries commands, 20 carries data in active mode. Sends credentials in clear text. | SFTP or FTPS |
| SFTP | 22 | TCP | File transfer over an SSH connection. | Already secure |
| SSH | 22 | TCP | Encrypted remote command line and tunnelling. | Already secure |
| Telnet | 23 | TCP | Clear-text remote command line. | SSH |
| SMTP | 25 | TCP | Mail transfer between mail servers. | SMTPS or STARTTLS |
| DNS | 53 | UDP and TCP | Name resolution. UDP for normal queries, TCP for zone transfers and large responses. | DNSSEC, DoH, DoT |
| DHCP | 67/68 | UDP | Automatic IP configuration. 67 is the server, 68 is the client. | n/a |
| TFTP | 69 | UDP | Simple file transfer with no authentication, used for boot images and device configs. | SFTP |
| HTTP | 80 | TCP | Web traffic in clear text. | HTTPS |
| NTP | 123 | UDP | Clock synchronization. | NTS (Network Time Security) |
| SNMP | 161/162 | UDP | Monitoring and management. 161 is polling of agents, 162 is traps sent to the manager. | SNMPv3 |
| LDAP | 389 | TCP and UDP | Directory queries, such as Active Directory lookups. | LDAPS |
| HTTPS | 443 | TCP | Web traffic encrypted with TLS. | Already secure |
| SMB | 445 | TCP | Windows file and printer sharing. | SMB with signing and encryption |
| Syslog | 514 | UDP | Log messages sent to a collector. TCP is also used, usually on a configured port. | Syslog over TLS (TCP 6514) |
| SMTPS | 587 | TCP | Mail submission, normally upgraded to TLS with STARTTLS. The N10-009 objectives list it as SMTPS. | STARTTLS required, or implicit TLS on 465 |
| LDAPS | 636 | TCP | LDAP over TLS. | Already secure |
| SQL Server | 1433 | TCP | Microsoft SQL Server database connections. | Encrypted connections |
| RDP | 3389 | TCP (and UDP) | Remote graphical desktop for Windows. | RDP through a VPN or gateway |
| SIP | 5060/5061 | UDP and TCP | VoIP call setup. 5060 is unencrypted, 5061 uses TLS. | SIP over TLS (5061) |
One detail to know: the exam objectives list SMTPS as port 587. In real networks, 587 is the mail submission port that normally upgrades to TLS with STARTTLS, and 465 is used for SMTP over implicit TLS. For the exam, answer 587 when the question says SMTPS.
Clear-text protocols and their secure replacements
A common question pattern gives you an insecure protocol and asks for the secure option. Memorize these pairs:
| Clear text | Secure replacement |
|---|---|
| Telnet (23) | SSH (22) |
| HTTP (80) | HTTPS (443) |
| FTP (20/21) | SFTP (22) or FTPS |
| LDAP (389) | LDAPS (636) |
| SNMPv1 and v2c (161/162) | SNMPv3 (adds authentication and encryption) |
| SMTP (25) | SMTPS or STARTTLS (587) |
| TFTP (69) | SFTP (22) |
| Syslog over UDP (514) | Syslog over TLS (TCP 6514) |
IP protocol types
Objective 1.4 also lists IP types. These are identified by an IP protocol number, not a port, and several of them have no port at all.
| Protocol | IP protocol number | Notes |
|---|---|---|
| ICMP | 1 | Error and diagnostic messages. Used by ping and traceroute. Has no ports. |
| TCP | 6 | Connection-oriented, reliable delivery with a three-way handshake. |
| UDP | 17 | Connectionless, no delivery guarantee, low overhead. |
| GRE | 47 | Generic Routing Encapsulation, a tunnelling protocol with no encryption of its own. |
| ESP | 50 | IPsec Encapsulating Security Payload: encrypts and authenticates the payload. |
| AH | 51 | IPsec Authentication Header: authenticates but does not encrypt. |
| IKE | None (uses UDP 500) | Internet Key Exchange: negotiates the IPsec security associations. Uses UDP port 500, or 4500 with NAT traversal. |
TCP versus UDP in one minute
- TCP sets up a session with a three-way handshake (SYN, SYN-ACK, ACK), numbers and acknowledges data, and retransmits what is lost. Choose it when every byte matters: web, email, file transfer, SSH.
- UDP just sends. It has less overhead and no retransmission, so it suits traffic where speed matters more than completeness: DNS lookups, DHCP, NTP, voice and video.
Traffic types
| Type | Delivered to | Example |
|---|---|---|
| Unicast | One specific host | Loading a web page from a server |
| Multicast | A group of subscribed hosts (224.0.0.0/4 in IPv4) | Routing protocol updates, IPTV |
| Anycast | The nearest of several hosts sharing one address | DNS root servers and CDNs |
| Broadcast | Every host in the local broadcast domain | ARP requests, DHCP discovery |
Port number ranges
- 0 to 1023: well-known ports, used by standard services such as the table above.
- 1024 to 49151: registered ports, assigned to specific applications such as SQL Server (1433) and RDP (3389).
- 49152 to 65535: dynamic or ephemeral ports, assigned by the client operating system for the source side of a connection (49152 to 65535 by IANA convention; Linux defaults to 32768 to 60999).
Related ports that are not on the N10-009 list
These are not in objective 1.4, but they show up in A+ and in real troubleshooting, so they are worth knowing:
| Protocol | Port | Notes |
|---|---|---|
| POP3 | 110 | Downloads mail from a server. POP3S is 995. |
| IMAP | 143 | Syncs mail with a server. IMAPS is 993. |
| NetBIOS | 137 to 139 | Legacy Windows name and session services. |
| RADIUS | 1812/1813 | Authentication and accounting for network access, UDP by default. |
| TACACS+ | 49 | Device administration AAA from Cisco, TCP. |
How to memorize the list
- Group by job. Remote access (22, 23, 3389), file transfer (20/21, 22, 69, 445), mail (25, 587), name and address services (53, 67/68, 123), management and logging (161/162, 514) and directory and database (389, 636, 1433).
- Learn the secure pairs first. If a question mentions encryption, the answer is often one of 22, 443, 587, 636 or 5061.
- Use flashcards in both directions. Port to protocol and protocol to port, because the exam asks both.
- Test yourself on real scenarios. The Network+ N10-009 practice questions include free items, and the free A+ Core 1 practice test has a ports matching exercise.
Next, read the Network+ N10-009 study guide for the other four domains, and practice IPv4 math with the free subnetting practice tool.
Frequently asked questions
What port does SSH use?
TCP 22. SFTP also uses 22, because it runs inside an SSH connection.
What is the difference between ports 67 and 68?
DHCP servers listen on UDP 67 and DHCP clients use UDP 68.
Which ports does DNS use?
Port 53. Normal queries use UDP, and TCP is used for zone transfers and responses too large for UDP.
Do I need to memorize every port for Network+?
You need the ports in objective 1.4, which is the table at the top of this page. The exam can ask you to match a port to a protocol, choose the secure alternative or pick the right service for a scenario.
Related reading
CompCertQuiz is an independent practice-exam site and is not affiliated with, endorsed by, or sponsored by CompTIA. Our practice questions are original material written for exam preparation. CompTIA and its certification names are trademarks of CompTIA, Inc. Always confirm exam details on comptia.org.