44 services across 12 categories: what runs on each port, how attackers abuse it, how to defend it and what to replace it with. 27 of them send data in clear text by default - the first thing an exam (or an attacker) looks for.
Port numbers are the registered or common defaults. Any service can be moved to any port, so identify services by what answers, not by the number alone.
| Port | Service | Encrypted |
|---|---|---|
| 20, 21 /TCP | FTPFile Transfer Protocol | Cleartext |
| 22 /TCP | SSHSecure Shell | Yes |
| 23 /TCP | TelnetTelnet | Cleartext |
| 25 /TCP | SMTPSimple Mail Transfer Protocol | Cleartext |
| 53 /TCP/UDP | DNSDomain Name System | Cleartext |
| 67, 68 /UDP | DHCPDynamic Host Configuration Protocol | Cleartext |
| 69 /UDP | TFTPTrivial File Transfer Protocol | Cleartext |
| 80 /TCP | HTTPHypertext Transfer Protocol | Cleartext |
| 88 /TCP/UDP | KerberosKerberos | Yes |
| 110, 995 /TCP | POP3Post Office Protocol v3 | Cleartext |
| 123 /UDP | NTPNetwork Time Protocol | Cleartext |
| 135 /TCP | MS-RPCMicrosoft RPC Endpoint Mapper | Yes |
| 137, 138, 139 /TCP/UDP | NetBIOSNetBIOS | Cleartext |
| 143, 993 /TCP | IMAPInternet Message Access Protocol | Cleartext |
| 161, 162 /UDP | SNMPSimple Network Management Protocol | Cleartext |
| 389, 636 /TCP/UDP | LDAPLightweight Directory Access Protocol | Cleartext |
| 443 /TCP/UDP | HTTPSHTTP over TLS | Yes |
| 445 /TCP | SMBServer Message Block | Yes |
| 500, 4500 /UDP | IKEInternet Key Exchange (IPsec) | Yes |
| 514, 6514 /TCP/UDP | SyslogSyslog | Cleartext |
| 587, 465 /TCP | SubmissionSMTP Submission | Yes |
| 1433 /TCP | MSSQLMicrosoft SQL Server | Yes |
| 1812, 1813 /UDP | RADIUSRADIUS | Yes |
| 49 /TCP | TACACS+TACACS+ | Yes |
| 2049 /TCP/UDP | NFSNetwork File System | Cleartext |
| 3306 /TCP | MySQLMySQL / MariaDB | Yes |
| 3389 /TCP/UDP | RDPRemote Desktop Protocol | Yes |
| 5432 /TCP | PostgreSQLPostgreSQL | Yes |
| 5900 /TCP | VNCVirtual Network Computing | Cleartext |
| 5985, 5986 /TCP | WinRMWindows Remote Management | Yes |
| 6379 /TCP | RedisRedis | Cleartext |
| 9200 /TCP | ElasticsearchElasticsearch REST API | Yes |
| 27017 /TCP | MongoDBMongoDB | Yes |
| 1883, 8883 /TCP | MQTTMQTT | Cleartext |
| 5060, 5061 /TCP/UDP | SIPSession Initiation Protocol | Cleartext |
| 2375, 2376 /TCP | Docker APIDocker Engine API | Cleartext |
| 6443, 10250 /TCP | KubernetesKubernetes API server and kubelet | Yes |
| 11211 /TCP/UDP | MemcachedMemcached | Cleartext |
| 1900 /UDP | SSDPSimple Service Discovery Protocol (UPnP) | Cleartext |
| 502 /TCP | ModbusModbus TCP | Cleartext |
| 20000 /TCP/UDP | DNP3DNP3 | Cleartext |
| 102 /TCP | S7commSiemens S7 (ISO-TSAP) | Cleartext |
| 47808 /UDP | BACnetBACnet/IP | Cleartext |
| 44818 /TCP/UDP | EtherNet/IPEtherNet/IP (CIP) | Cleartext |