The ones that actually come up — on the exam, in the interview, and at 2am when something's down.
There are 65,535 ports. You need about forty. Every "complete" port list buries the useful ones under IANA registrations nobody has touched since 1998, so here's the short version — grouped by what you're actually doing when you need it.
Web and remote access
Port
Protocol
What it's for
22
SSH / SFTP
Remote shell and secure file transfer. If it's closed, you're driving to the office.
23
Telnet
Unencrypted remote shell. Should be off. If it's open, that's a finding.
80
HTTP
Unencrypted web.
443
HTTPS
Encrypted web. The one that must never be blocked.
3389
RDP
Windows remote desktop. Never expose this to the internet — it's the single most brute-forced port there is.
5900
VNC
Cross-platform remote desktop.
8080
HTTP alt
Proxies, dev servers, app servers behind a load balancer.
Mail
Port
Protocol
What it's for
25
SMTP
Server-to-server mail relay. Usually blocked outbound by ISPs to fight spam.
587
SMTP submission
What a mail client should use to send. This is the one you want.
465
SMTPS
Implicit-TLS submission. Still widely supported.
110 / 995
POP3 / POP3S
Download-and-delete mail retrieval.
143 / 993
IMAP / IMAPS
Server-side mailbox sync. What everyone actually uses.
Core infrastructure
Port
Protocol
What it's for
53
DNS
Name resolution. When "the internet is down," it's usually this.
67 / 68
DHCP
Handing out IP addresses (server / client).
123
NTP
Time sync. Bad time breaks Kerberos, certificates, and logs.
161 / 162
SNMP
Device monitoring / traps.
514
Syslog
Centralized logging.
389 / 636
LDAP / LDAPS
Directory lookups — Active Directory lives here.
445
SMB
Windows file sharing. Never let this cross the internet; it's how ransomware spreads laterally.
137–139
NetBIOS
Legacy Windows naming. Usually a leftover you should close.
Databases and services
Port
Protocol
What it's for
1433
MS SQL Server
1521
Oracle DB
3306
MySQL / MariaDB
5432
PostgreSQL
6379
Redis
Historically unauthenticated by default — never expose it.
27017
MongoDB
Same warning. Bind to localhost.
5060 / 5061
SIP / SIP-TLS
VoIP call setup.
The interview trick: nobody expects you to recite all 65,535. They're checking whether you know why a port matters — that 3389 open to the internet is a real finding, that 587 is for clients and 25 is for servers, that DNS on 53 is the usual suspect when "everything's down." Learn the reasons and the numbers stick.
Fast recall, the honest way
Secure versions usually sit near the insecure one — 143→993 (IMAP), 110→995 (POP3), 389→636 (LDAP).
Under 1024 = privileged. On Linux, binding those needs root, which is why apps run on 8080 instead of 80.
If it's a remote-access port, assume it's being scanned right now. 22, 3389, and 5900 get hammered constantly.
Want this as a printable card?
The Common Ports & Protocols Reference Card — one clean page, made to print and pin above the desk. Instant download.