Icon

Network Ports & OSI Model Reference

Quick-reference learning guide mapping the standard OSI structural layers with core operational network ports.

Layer 7: Application Layer
Top Layer
How it works: This is the layer closest to the user. It provides network services directly to your software applications (like web browsers or email clients) so you can interact with the network.
Protocols & Port Numbers
HTTP (Port 80) Used for loading standard, unencrypted web pages.
HTTPS (Port 443 / 8443) Secured, encrypted version of HTTP using SSL/TLS certificates.
HTTP Alternate / Custom Web Services (Port 8001) Commonly used for secondary HTTP development servers, management consoles, and REST APIs.
mDNS (Multicast DNS) (Port 5351) Used for local network zero-configuration service discovery and hostname resolution.
DNS (Port 53) Translates domain names into IP addresses (uses UDP for queries, TCP for zone transfers).
DHCP (Ports 67, 68) Dynamically assigns IP addresses and network configurations to host devices on a network.
SSH / SCP / SFTP (Port 22) Secure, encrypted remote command-line login, shell execution, and file transfer.
Telnet (Port 23) Legacy text-based, unencrypted remote terminal access.
FTP (Ports 20, 21) Used for bi-directional file transfers (Port 21 for control/commands, Port 20 for data transfer).
TFTP (Port 69) Trivial FTP. Connectionless UDP file transfer commonly used for network booting and device configs.
SMTP (Port 25 / 587) Used for sending outbound email across mail servers (Port 587 for secure client submission).
POP3 (Port 110 / 995) Downloads incoming emails to local clients (Port 995 for SSL/TLS encrypted access).
IMAP4 (Port 143 / 993) Manages incoming emails directly on the remote server (Port 993 for secure SSL/TLS connection).
Kerberos (Port 88) Ticket-based authentication protocol widely used in Active Directory domains.
SNMP (Ports 161, 162) Used by monitoring platforms to poll network devices (161) and receive asynchronous traps (162).
SMB (Port 445) Microsoft Windows protocol for direct network file sharing, printer access, and IPC named pipes.
LDAP / LDAPS (Port 389 / 636) Queries and manages centralized directory services like Active Directory (636 for SSL/TLS encrypted).
RDP (Port 3389) Microsoft Remote Desktop Protocol for full Graphical User Interface (GUI) remote management.
Syslog (Port 514) Standard protocol for sending system log messages across network endpoints to SIEM targets.
NTP (Port 123) Synchronizes precise system clocks across network routers, servers, and security appliances.
LPD/LPR (Port 515) Line Printer Daemon/Line Printer Remote protocol for Unix/Linux print queues.
Layer 6: Presentation Layer
Data Translation
How it works: Acts as the translator. It takes data from Layer 7 and formats, compresses, or encrypts it so it can be universally understood across different operating systems and applications.
Protocols & Functions
SSL / TLS Cryptographic protocols responsible for encryption, decryption, and data privacy across applications.
Data Formats & Encoding Standardizes data syntax including ASCII, EBCDIC, JPEG, PNG, GIF, MPEG, and MIME types.
Layer 5: Session Layer
Communication Dialogs
How it works: Establishes, manages, maintains, and terminates communication sessions (dialogues) between applications on local and remote systems.
Protocols & Functions
NetBIOS / RPC (Ports 135, 137, 139) Coordinates authentication dialogues, remote procedure calls, and connection state management.
PPTP (Port 1723) Point-to-Point Tunneling Protocol used for legacy VPN session establishment.
Layer 4: Transport Layer
Segments / Datagrams
How it works: Receives application payload data and divides it into segments or datagrams. Handles end-to-end transport reliability, flow control, and multiplexing using port numbers.
Protocols & Functions
TCP (Transmission Control Protocol) Connection-oriented (3-way handshake). Guarantees reliable, ordered delivery via acknowledgments (Used by HTTP, HTTPS, SSH, SMB, RDP).
UDP (User Datagram Protocol) Connectionless and lightweight. Prioritizes speed and low overhead over error correction (Used by DNS, DHCP, TFTP, Syslog, VoIP).
Dynamic / Private / Ephemeral Ports (Port 1235, 32768) High-range outbound client ports dynamically assigned by OS transport stacks for temporary connection sessions.
Layer 3: Network Layer
Packets
How it works: Handles logical network addressing and determines optimal routing paths to pass packets across multiple subnetworks.
Protocols & Functions
IP (Internet Protocol) Assigns logical software addresses to devices. Includes IPv4 (32-bit) and IPv6 (128-bit).
NAT (Network Address Translation) Translates private internal IP addresses into public IP addresses to route internal host traffic over external networks.
ICMP Used for diagnostics, connectivity verification, and operational error reporting (e.g., ping and traceroute).
IPsec Suite of security protocols (AH, ESP) used to authenticate and encrypt IP packets at the network layer for VPNs.
IGMP Manages host memberships in IP multicast groups for efficient one-to-many data streaming.
Layer 2: Data Link Layer
Frames
How it works: Manages node-to-node physical communication within the same local network segment. Encapsulates packets into frames using hardware Media Access Control (MAC) addresses.
Protocols & Functions
ARP (Address Resolution Protocol) Resolves a known Layer 3 IP address to an unknown Layer 2 physical MAC address on local networks.
RARP (Reverse ARP) Resolves a known hardware MAC address to an IP address (legacy protocol replaced by DHCP).
Ethernet (802.3) / Wi-Fi (802.11) Defines frame structure, media access control (CSMA/CD / CSMA/CA), and local framing standards.
Layer 1: Physical Layer
Bits
How it works: The physical transmission medium. Converts data frames into raw electrical, optical, or radio signal pulses (1s and 0s) to transfer bits across physical media.
Physical Components
Hardware Infrastructure Ethernet copper cables (Cat5e/Cat6), Fiber Optics, Network Interface Cards (NICs), Switches (L1 layer aspects), Hubs, and Wireless Access Point transceivers.