What are the most common network ports and protocols a SOC analyst should know by heart? Why is it important to recognize these when monitoring network traffic?

Question

Accepted Answer

As a SOC analyst, knowing common ports and protocols is fundamental to your ability to identify normal versus suspicious network activity. Ports are like numbered doors on a computer, and each well-known service uses a specific port by convention. When traffic appears on unexpected ports, it is often a sign of malicious activity.

The most critical ports and protocols to memorize include: HTTP on port 80 and HTTPS on port 443 for web traffic, DNS on port 53 for domain name resolution, SSH on port 22 for secure remote access, FTP on ports 20 and 21 for file transfers, SMTP on port 25 for email sending, RDP on port 3389 for remote desktop connections, and DHCP on ports 67 and 68 for IP address assignment. Additionally, you should know Telnet on port 23, which is an insecure remote access protocol, and common database ports like MySQL on 3306 and Microsoft SQL Server on 1433.

Recognizing these ports matters because attackers frequently try to disguise their activities. For example, if you see what appears to be DNS traffic on port 53 but the packet sizes are unusually large, this could indicate DNS tunneling, where an attacker is exfiltrating data through DNS queries. Similarly, if you notice SSH connections to external IP addresses from a server that should not be initiating outbound SSH, this could signal a compromised host being used for data exfiltration or as a pivot point.

During alert triage, you will constantly evaluate whether the ports and protocols in an alert make sense for the source and destination involved. A web server communicating on port 443 is expected, but that same server suddenly making connections on port 4444 could indicate a reverse shell. An internal workstation reaching out to an external IP on port 6667, the default IRC port, might suggest command-and-control communication.

Understanding the difference between well-known ports (0-1023), registered ports (1024-49151), and dynamic or ephemeral ports (49152-65535) also helps. Legitimate services typically use well-known ports, so traffic on unusual high-numbered ports, especially to external destinations, warrants closer inspection during your monitoring shifts.