Common examples
- 22/TCP – SSH
- 53/TCP/UDP – DNS
- 80/TCP – HTTP
- 443/TCP – HTTPS
- 445/TCP – SMB
- 3389/TCP – RDP
RR CYBERLAB • Network Security
Common Security Ports & Firewalls
Build practical awareness of common ports and how firewall decisions fit into security investigations.
QUICK READ
Ports help identify the intended service, but a port number is not proof of the application. Analysts should combine port, protocol, destination, asset role and observed application behavior.
Use this page after the daily quiz: learn the concept first, then follow the investigation workflow and examples.
Firewall investigation
- Determine which rule allowed or denied the connection.
- Identify source, destination, port and protocol.
- Check whether the flow is expected for the asset.
- Review repeated attempts and whether a successful connection followed.
- Correlate with endpoint and authentication evidence.
Example
A workstation repeatedly attempts SMB connections to many internal hosts. The analyst should determine whether the workstation is an approved management system, whether the user is expected to administer those hosts and whether endpoint telemetry shows related tools or processes.Common mistakes
- Treating a port as proof of maliciousness.
- Ignoring firewall direction and policy context.
- Failing to distinguish one failed connection from repeated scanning-like behavior.
Daily quiz hook
A host connects to many internal systems over TCP/445. What should the analyst determine before concluding lateral movement?
Quiz flow: introduce this topic briefly on social media, ask the question, reveal the answer, then send learners here for the detailed investigation.
Analyst practice note
A port is a transport endpoint, not a reliable service identity. Read protocol, source and destination, direction, state, host role, and the process or service owning the socket where telemetry is available. Compare the connection with an approved baseline before changing a firewall rule.
Use the virtual network evidence to explain why a connection exists and which control would limit it. A familiar port can carry an unexpected service, while a nonstandard port can be legitimate; verify application context before blocking.
Continue practicing: open a fictional mission and test your reasoning against the simulated evidence.