Ports and Common Network Services

• Map well-known ports to their services and risk profiles
• Enumerate what is listening on your own hosts
• Judge new or unexpected listeners as suspicious signals

• Reconnaissance (authorized scans of your own lab) enumerates open ports first — knowing the defaults is how you read a scan.
• An unexplained listener is an intrusion signal; the known-service map is your baseline.
• Port-triggered alerts (e.g., new 3389 or 445 listener) fire all day in SOCs; you must reason about them.
• Hardening = reducing exposed services to the minimum — a decision expressed in ports.

Each apartment (process) has a number (port) on the directory (well-known list). Security is like checking the building directory: you want to know who is home, who answers strangers, and which apartments shouldn't exist.

• A server binds a socket (IP:port), e.g., nginx listens on 0.0.0.0:443.
• A client connects to that address/port; the client side picks a random ephemeral source port.
• IANA defines the well-known range 0-1023 and registered range up to 49151; the rest are ephemeral.
• Security scanners probe ports to inventory services; each open port is then fingerprinted by banner or behavior.
• UDP services (53, 123) differ: they're stateless, so they're fingerprinted via requests or responses rather than connection.

• An asset scan benchmark expects 'SSH only on port 22 from the admin subnet'; anything else escalates.
• A SOC alert fires when a database node shows a new 3389 listener — mercilessly explained as 'DB shouldn't serve RDP'.
• A fire drill: closing 23 (telnet) and 21 (FTP) fleet-wide is the fastest way to stop cleartext admin traffic.

• Keep the open-port set minimal, documented and scheduled for review.
• Bind only what's needed: a DB bound to 127.0.0.1 beats the same port bound to 0.0.0.0.
• Change obvious defaults (SSH on 22 is discoverable; standing exotic passwords is worse than any port choice).
• Baseline listeners before an incident so 'what's new' is a 10-second query.

• Assuming 'port closed from outside' means the service is safe — internal-network attackers may still reach it.
• Treating port numbers as security in themselves; a service on 443 still speaks its own dangerous protocol.
• Forgetting ephemeral ports in firewall rules, breaking legitimate return traffic.

• ss -tulnp on the host answers 'is the service actually listening, and as which user?'
• For a 'nothing listens' claim that's still reachable, check proxies/NAT rewrites — the listener may be elsewhere.
• Cross-check listeners against the config that was supposed to be applied; drift is usually intentional and wrong.

• Every listener is a vector for the fingerprint-to-exploit loop; reduce and gate them.
• Port scanning your own lab, Docker hosts and home router (authorized equipment you own) is how you build the inventory muscle before ever touching production.