Instructor: Now I'm going to apologize in advance
for two reasons.
First, this is a really long lecture.
And second, you're probably going to need to go through it two
or three times because the information in this lesson is
going to be so important to you because it makes
up a good percentage of your test.
If there is any of these lessons or videos
that you're going to start memorizing,
this is going to be the one for you.
Now, I'm going to go through each of the different ports
and protocols that you need to be aware of.
And for each one of those,
I'm going to give you a specified port number
that's used for that port and protocol.
Now, for the exam, you may get an easy question, like,
what port is used for HTTP?
And you need to select the right port number,
in this case, 80, from the list of choices.
But there are many other questions that are going to rely
upon the information from this video that aren't going to be
asked nearly as cleanly or easily or directly as that.
I have seen a lot of questions on the exam that actually
ask things that rely on your knowledge from this lesson.
For example, the exam might ask you a question, like,
one of your users is complaining that they can't connect
to the share drive inside your Windows-based office network.
You believe that their host-based firewall
might be blocking this service.
What port should you verify as open inside the firewall?
Now to answer this question,
you need to figure out a few things.
First, what service is being used to allow file transfer
and file sharing inside of a Windows-based network?
The answer to that is SMB,
the Server Message Block Protocol.
Now, once you've figured that out,
you then have to answer the question
of what port is used by SMB,
and in this case, it's port 445.
In security, one of the most important things is to ensure
that you understand what openings you have created
in your systems.
When it comes to computers and networks,
most of these openings are going to be created by ports.
Now, a port is simply a logical communication endpoint
that exists on your computer or your server.
For example, if you're running a web server,
you're going to have port 80 open and listening
for inbound requests from your potential visitors.
Now, ports are classified as either
inbound or outbound ports.
An inbound port is used when your computer
or server is listening for a connection.
Just as in my earlier example,
the web server had port 80 open.
That's an inbound port.
It's just waiting for somebody to
come along and connect to it.
An outbound port, on the other hand,
is open by your computer whenever
it wants to connect to a server.
If my computer is attempting to make a connection
to your web server over port 80, well,
then my computer's going to open up
a random high number port, such as port 52363,
and it's going to make an outbound request to that web server.
Now, what does all of this look like in the real world?
Well, let's look at an example of how an inbound
and outbound port are used when my laptop
attempts to connect to a remote server over SSH.
First, we have a server at the top of the screen
and it has a public IP address assigned to it
and it's listening on port 22.
So port 22 is the inbound port awaiting new connections,
and in this case, port 22 is open.
At the bottom of the screen,
I have my laptop that wants to make the connection.
Now, my laptop has a private IP address assigned
because my network is using NAT at the router
and that gives me some additional protections.
So, notice at this point,
my laptop doesn't have any ports open yet.
So now my laptop wants to go
and establish the SSH connection.
It's going to open up an outbound port on itself,
which is going to be some random high number port, like 51233,
and it's going to send a request to the SSH server
over port 22, which is the server's inbound port,
and destined for its IP address, in this case, 46.124.63.13.
Now, once the server receives this request,
it has to respond to it.
So it's going to send a packet of information back
to my laptop's IP and the outbound port that was opened.
In this case, that's port 51233, and in reality,
it would be the public-facing IP address of my router,
but for our example,
I'm going to use the private IP address of 192.168.1.45.
Now that my laptop has made the request
to the server and the server answered that request,
we now have a session established
and both devices can communicate back and forth as needed.
Once that session is over, the connection's going to be closed,
my laptop's going to close its outbound port
because it's no longer needed,
and the server will keep that inbound port open
so that they can receive requests
from the next user who wants to use it.
So now that we showed how ports work in the real world,
let's talk a little bit more about the ports themself.
In addition to being called inbound and outbound ports,
the ports are going to be assigned a number.
Now, the number can be anywhere between zero and 65,535,
but this big range is actually divided
into three smaller groups.
The first group is called the well-known ports.
This is for any ports that are between zero and 1,023.
These are called well-known ports because they're designated
by IANA, the Internet Assigned Numbers Authority,
and they're going to assign it to
commonly used protocols and ports.
Now, for example, secure web browsing is one we all know.
It's HTTPS and it uses port 443.
Telnet's another well-known one.
It's port 23.
Both of these are considered well-known ports
as well as hundreds of others.
Now, the second group we have is going to cover ports
from 1,024 up to 49,151.
This range is called the registered ports because they have
to be used by vendors for their own proprietary protocols
and each vendor is going to register them
with IANA prior to using them.
For example, Microsoft has an SQL server
and it uses port 1433, which is another registered port.
Another good example of this is the Remote Desktop Protocol,
which is a proprietary Microsoft protocol called RDP.
It operates on port 3389.
The third and final group is called
the dynamic and private ports.
This uses the ports between 49,152 all the way up to 65,535.
These ports can be used by any application at any time
without having to be registered with IANA first.
Now, this range is usually used by your client
whenever it picks a random high number
port for its application.
Anytime it wants to have a temporary outbound connection,
this is the range that it's going to use.
This is also commonly used in gaming
as well as instant message and chat.
So, as we get started going through this lesson,
I'm going to tell you the protocol, the port number,
and what it's going to be used for.
First, we have the File Transfer Protocol, or FTP.
FTP is going to operate on ports 20 and 21.
FTP is used to transfer files
between a client and a server on a computer network.
This is an unsecured method though
and the data's going to be transmitted in the clear,
which means there is no encryption.
So, it's really not safe for us anymore to use FTP,
especially for doing so over the internet
if we want to be transferring any sensitive files.
Remember, with FTP, there is no encryption,
so the files could be read by anyone
on the network who may be eavesdropping
to your conversation as you send it over port 20 and 21.
In summary, File Transfer Protocol, or FTP,
runs over ports 20 and 21 and it provides
insecure file transfers.
The next one we have is Secure Shell, or SSH.
This is going to operate on port 22.
So, what does SSH do?
Well, it allows you to remotely take control
of another computer using a command shell.
It's best known for its use as a remote login capability
and it is a cryptographic network protocol.
This means that it uses encryption and it's safe to use even
over an unsecured network, like the internet,
and it's safe from prying eyes.
For example, if I wanted to change the configuration
of my web server,
I can actually log in through SSH
from my house in Puerto Rico
all the way to my file server sitting in California
all the way over the internet using SSH
and I can be certain that nobody's
going to be able to see what I'm doing
because it's secure with encryption
on both ends of that connection if I'm using Secure Shell.
So in summary, Secure Shell, or SSH,
runs over port 22 and it provides secure remote control
of another machine using a text-based environment.
The next one we have is Secure File Transfer Protocol,
or SFTP, and this is another way to do file transfer,
but this time,
we're going to do it securely by using encryption.
SFTP operates on port 22,
the exact same port that we use for SSH, or Secure Shell,
because in all honesty,
all we're doing here is tunneling the FTP protocol
through SSH to give us a secure method
of doing that file transfer.
In summary, the Secure File Transfer Protocol, or SFTP,
is going to run over port 22 and provide us
with secure file transfer.
Next, we have Telnet and it works a lot like
the way that SSH does.
In fact, Telnet came out many years before SSH.
The problem with Telnet though is that it's insecure.
Telnet is used to provide bidirectional interactive
text-oriented communication using
virtual terminal connections.
Now, that is a whole lot of words
to simply say that Telnet provides us
with remote access via the command prompt.
The problem is that we're setting everything
in the clear with no encryption,
which means that we're going to be setting all this data
and somebody can see what we're doing,
including if we send our usernames and passwords.
Just like FTP,
Telnet is considered insecure
and you should never use Telnet
over an insecure network, like the internet,
because people can read your username, your password,
and every other command that you type in.
Really, do not do this or you will become the victim
of a data breach.
So, in summary,
Telnet is going to run over port 23
and it provides you with insecure remote control
of another machine using a text-based environment.
Next, we have the Simple Mail Transfer Protocol, or SMTP.
This operates on port 25.
It is the internet standard
for sending electronic messages or email.
It was founded back with the RFC,
or Request for Comments, 821 all the way back in 1982.
Then, in 2008, the current version came out,
which uses RFC 5321.
So, do you need to know these RFCs?
No.
No, you don't.
The only reason I'm including them here is to
give you an idea of just how long we've been
using SMTP to send our emails,
all the way back from 1982, to 2008,
all the way now to the present.
In summary, when you hear about SMTP, remember,
it runs over port 25 and provides
the ability to send emails over your network.
Next, we have DNS or the Domain Name System,
which uses port 53.
Now, DNS is what gives us a hierarchical
decentralized naming system for our computers, our services,
and other resources that are connected
to the private networks and the internet.
This is going to convert our domain names to IP addresses
and our IP addresses to domain names.
For example, if you go to diontraining.com,
that's going to be a lot easier for you to remember
than a long IP address, like 66.12.54.85.
This is because we as humans are better
at thinking about names and words than we are with numbers.
So, it's easier for us to remember diontraining.com
or copt.org or something like that, right?
So to make the computers
and the internet easier for people to use,
we're going to rely on domain names
instead of their IP addresses
and DNS allows us to do that.
For now, I just want you to remember that DNS runs
over port 53 and it converts domain names to IP addresses
and IP addresses back to domain names.
The next one we have is DHCP,
or the Dynamic Host Configuration Protocol,
and this operates over ports 67 and 68.
Now, DHCP servers are used to automatically
assign IP addresses and other network configuration
parameters to your network clients
to help simplify the administration of our networks.
This allows your computers to get IP addresses
and network parameters automatically,
which is really, really awesome and makes your life
as a network administrator much, much easier,
especially in large networks.
DHCP is a really important concept,
For now though,
I just want you to remember that DHCP
runs over ports 67 and 68
and it automatically is going to give you
you the network parameters to your clients,
such as their assigned IP address,
their subnet mask, the default gateway,
and the DNS server that they should be using.
Next, we have the Hypertext Transfer Protocol, or HTTP,
which operates over port 80.
This is the foundation of data communication
for the worldwide web.
HTTP is designed for collaborative
and hypermedia presentations
across many different types of devices.
If you're watching this video,
you've already used either HTTP
or its secure version, HTTPS, to access this website.
HTTP is the unsecure version
whereas HTTPS is going to use encryption,
and we'll talk later about that in this video.
In summary, when you hear HTTP,
I want you to remember that it operates
over port 80 and it's used for insecure web browsing.
The next one we have is Post Office Protocol Version Three,
or POP3.
POP3 is going to use port 110
and it's used by local email clients to retrieve email
from a remote server over a TCPIP connection.
POP3 is only used for inbound or incoming email.
POP3 also uses a store and forward method of communication.
So, if somebody sends you an email,
it will go to your email server
and it will wait there until you're ready to receive it.
When you're ready to receive it,
your email client will connect to your server over POP3
using port 110 and download those emails.
Then, your email client will either
tell the server to keep a copy of that on the server
or it'll tell it to delete the email from the server.
Either way, POP3 is going to be able to handle this for you.
POP3 is this older method of receiving emails,
but it is still heavily used by many people today.
In summary, I want you to remember
that Post Office Protocol Version Three, or POP3,
runs over port 110 zero and is used
for receiving incoming emails.
Next, we have NetBIOS and it's used to conduct
name querying, sending of data,
and other functions over a NetBIOS connection,
which operates over port 137 and 139.
NetBIOS provides a service for allowing applications
on a separate computer to communicate
over a local area network to share files and printers.
If you use file or printer sharing in a Windows network,
your port 139 is probably open
because you're using NetBIOS.
In summary, NetBIOS operates over port 137 and 139
and it's used for file or printer sharing
in a Windows network.
Next, we have the Internet Mail Application Protocol,
or IMAP, and it's going to operate over port 143.
Now, IMAP provides email clients
with the ability to retrieve email messages
from a mail server over a TCPIP connection.
IMAP is a newer type of email retrieval protocol
and it was designed to improve some things
over the older POP3 methods.
Basically, IMAP allows the end-user to view
and manipulate the messages as
if they were stored locally on their machine
even though they're still sitting on the server.
This is important because with POP3,
when I logged in from my laptop or my tablet,
I would show unread on one of those and read on the other
because the email server didn't keep track of the state
of each message as I read it or didn't read it.
But, with IMAP,
the server keeps all of these things synchronized
across all of my devices.
This makes IMAP much better for modern email communications
because most of us have a laptop, a desktop, a smartphone,
and maybe even a tablet, too.
In summary, remember that IMAP operates over port 143
and it's a newer method of retrieving incoming emails,
which improves upon our older POP3 method.
Next, we have the Simple Network Management Protocol,
or SNMP.
This is going to operate on ports 161 and 162.
SNMP is going to provide you with the ability
to collect and organize information
about all the managed devices on an IP network.
This includes things like routers, switches, VoIP phones,
and other devices.
SNMP can modify the information
by changing the device's behavior and it can provide you
with the ability to monitor the uptime,
downtime in other states of any given device.
For now, I want you to remember that SNMP operates
over ports 161 and 162 and SNMP is used to collect data
about network devices and monitor their status.
Next, we have LDAP,
or the Lightweight Directory Access Protocol.
L-D-A-P or LDAP is going to operate on port 389
and it's an open vendor-neutral
industry standard for accessing
and maintaining distributed directory information services.
Now, I want you to think about LDAP like
active directory in Windows,
but it's not just limited to the Windows networks.
Instead, active directory is a proprietary version of LDAP,
and for this reason,
LDAP and active directory both use port 389 to communicate.
So, what exactly does LDAP do?
Well, it's a directory service.
So, if you're in your email client, like Microsoft Outlook,
at work and you try to look up
somebody's name in the address book,
you're actually using LDAP to do that.
In addition to this,
LDAP can store information about
your users and their groups.
In summary, LDAP is going to operate over port 389
and it's used to provide directory services to your network.
Next, we have secure web browsing,
which is Hypertext Transfer Protocol Secure, or HTTPS.
HTTPS is going to operate over port 443, and essentially,
it's going to do everything that Hypertext Transfer Protocol,
unsecured version HTTP did,
except it's also going to do this over an encrypted tunnel.
This tunnel can either use a Secure socket Layer, SSL,
or Transport Layer Security, TLS, to operate.
Now, TLS is the newer and more secure method
whereas SSL is the older and less secure method.
By using a TLS or SSL tunnel with HTTP,
you now have an end-to-end encrypted tunnel
between your client and the web server
and this allows you to do things
like eCommerce, logging into your bank,
or going into any other website much more securely.
In summary, HTTPS is going to operate over port 443
and it's used as a secure and encrypted version
of web browsing.
Next, we have SMB, or the Server Message Block Protocol.
This is going to operate over port 445.
Now the Server Message Block Protocol is going to
provide your system with shared access to files, printers,
and other types of communication
between different devices on your network.
It operates a lot of times with NetBIOS as well.
NetBIOS is going to be used to do the authentication
over port 139 and then Server Message Block
will handle the actual passing out of those files
and printer services to you by handing over that data.
In summary, SMB is going to operate over port 445
and it's used for Windows file
and printer sharing services on a Windows network.
Next, we have the Remote Desktop Protocol, or RDP.
Now, RDP is going to operate over port 3389.
So, be careful here.
Notice 3389 looks a whole lot like 389 that we covered
with LDAP and students will commonly mix
up these two port numbers on the exam.
Because of this,
exam writers absolutely love to include both 389
and 3389 as answer choices
whenever you get a question about RDP, LDAP, or LDAPS,
so be careful here.
Now, the Remote Desktop Protocol is a proprietary protocol
that was developed by Microsoft
and it allows users to control their computers
remotely using a graphical interface.
Now, RDP is kind of similar to SSH and Telnet in
that it provides us with the ability to remotely
control another computer or server,
but it gives us this additional benefit
of being able to actually see what we're doing
by using a graphical user interface.
It gives us full control over it
with our mouse and our keyboard as if we were sitting
down in front of that other machine locally.
So, when we had SSH and Telnet,
we could only control computers using text-based commands
over a command line or a shell, but with RDP,
we have a full graphical user interface.
As you can see here,
I have an Android phone that's actually using
RDP through a web browser and it's able
to see this Windows machine and remotely control it.
This allows users with RDP software
to be able to access their computers
from anywhere they are,
whether they're doing so over the internet
or inside your network as long as they're using port 3389.
So, in summary,
remember that RDP operates over port 3389
and it provides you with graphical remote control
of another client or a server.
All right, that was a ton of information.
Like I said, this is a really important video
with a lot of dense material that you have to master.
You're going to need to remember the protocol, the port,
and what it's used for
for each of the things that we just covered in this lesson.
I promise you,
watching this video once is not
going to be enough for getting all of that
into your head and having it memorized,
so you need to go back
and rewatch this video a few more times to
ensure you've memorized all of these protocols and ports.
I also recommend that you create flashcards
and quiz yourself on these ports and protocols.
On the one side, you should write the port number,
and on the other side of the card,
I want you to write the protocol.
This way, you can start testing yourself as you go.
There really is no easy way to
memorize a lot of these, unfortunately.
It's just something you have to spend time
with and get it into your memory
and then quiz yourself often to ensure
you don't forget them before test day.
If you can remember the port, the protocol,
and what it's going to be used for,
you're going to do well on these questions come test day.