Certopolis

CompTIA Network+ (V9)

TCP vs UDP and common ports for Network+

TCP sets up a connection with a three-way handshake and then gives a reliable, in-order byte stream. UDP sends each datagram at once with no connection, no delivery guarantee and no duplicate protection. IANA records which port and transport each service uses, and several exam questions turn on the transport, not just the number.

TCP or UDP

RFC 9293 calls the three-way handshake the procedure used to establish a TCP connection. A receiver does not hand data to the application until the connection reaches the ESTABLISHED state. TCP then detects lost packets with sequence numbers and errors with checksums, and retransmits.

RFC 768 says UDP is transaction oriented and that delivery and duplicate protection are not guaranteed. There is no setup, so the first datagram carries the request straight away.

Pick UDP when one short request expects one short reply and the application resends on its own if no reply comes. Pick TCP when the application needs every byte in order and does not want to handle loss itself.

Ports to know (IANA registry)

File and remote access: FTP data 20 and control 21, SSH 22, Telnet 23, TFTP 69, 3389 registered as ms-wbt-server (used by RDP), 445 registered as microsoft-ds (used by SMB).

Name, address and time: DNS 53 on both UDP and TCP, DHCP 67 server and 68 client, NTP 123.

Mail: SMTP 25, POP3 110, IMAP 143, IMAPS 993, POP3S 995, submission 587, submissions 465.

Management and directory: SNMP 161, SNMP traps 162, LDAP 389, LDAPS 636, syslog 514.

Web, database and voice: HTTP 80, HTTPS 443, Microsoft SQL Server 1433, SIP 5060, SIP over TLS 5061.

Where the transport matters

Syslog: IANA lists syslog on 514 over UDP only. TCP 514 is registered to a different service, shell. RFC 5426 says a syslog receiver listens on UDP port 514 by default. A firewall in front of a collector with default settings must allow UDP 514.

Mail submission: RFC 8314 describes two methods. With STARTTLS the client opens a cleartext session and then issues a command that upgrades it to TLS; that is used on port 587. With Implicit TLS the TLS handshake starts as soon as the TCP connection opens; for submission that is port 465. Port 25 is SMTP between mail servers.

The same split applies elsewhere: LDAP 389 versus LDAPS 636, and SIP 5060 versus SIPS 5061.

Where the exam catches people

  • Believing syslog defaults to TCP 514: IANA registers syslog on UDP 514; TCP 514 belongs to shell.
  • Believing port 465 is the STARTTLS submission port: 465 is Implicit TLS. STARTTLS upgrades a cleartext connection on 587.
  • Believing UDP discards duplicate or out-of-order datagrams: RFC 768 gives no such guarantee, so the application must handle it.
  • Believing TCP delivers data before the handshake completes: data waits until the connection reaches ESTABLISHED.

Written from CompTIA's documentation

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

  1. An application sends one short request and expects one short reply, and it resends the request itself if no reply arrives. Which of the following protocols delivers that first request with the least delay?

    Right. In the game that’s Renown for your Networking Concepts building.

    Not that one: B is right. In the game your Networking Concepts building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    UDP has no connection setup, so its first datagram carries the request at once, and this application already handles loss by resending.

    Written from www.rfc-editor.org/rfc/rfc9293.html

  2. Switches send their log messages to a central syslog collector using the protocol's default transport and port, with nothing customized. Which of the following must a firewall in front of the collector permit?

    Right. In the game that’s Renown for your Networking Concepts building.

    Not that one: C is right. In the game your Networking Concepts building would lose a little Renown, and this question would come back later.

    Written from www.iana.org/assignments/service-names-port-numbers

  3. A mail client connects to its submission server in cleartext, then issues a command that upgrades the same connection to TLS before sending a message. Which of the following ports is it using?

    Right. In the game that’s Renown for your Networking Concepts building.

    Not that one: C is right. In the game your Networking Concepts building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    Section 3.3 places that mechanism on the submission port 587, and places Implicit TLS, where TLS is negotiated immediately at connection start, on the separate 'submissions' port 465. A connection that starts in cleartext and is upgraded is therefore on 587.

    Written from www.rfc-editor.org/rfc/rfc8314.html