Ports 100–499

Port 110 — POP3

At a Glance

• Transport: TCP

• Common service: Post Office Protocol v3

• Main purpose: Downloads email to local client

• Status: Official, current

• Related ports: 995, 143, 993

What It Does

Retrieves email to a client. A POP3 client may delete messages from the server, but it can also be configured to leave copies there. POP3 is commonly associated with offline or single-client workflows.

ELI Explains Check a physical mailbox and take copies home. Depending on your settings, the originals may be removed or left for later. POP3 focuses on retrieval rather than live mailbox synchronization.

A 10-Year-Old's Example Teacher puts homework in your cubby. You collect a copy; the rules decide whether another copy remains. POP3 clients and servers make a similar retention choice.

Remember This POP3 retrieves mail and may remove server copies, depending on client and server policy. Use POP3 over implicit TLS on port 995; use IMAP when server-based multi-device synchronization is needed.

Port 123 — NTP

At a Glance

• Transport: UDP

• Common service: Network Time Protocol

• Main purpose: Synchronizes computer clocks

• Status: Official, current

• Related ports: None

What It Does

Synchronizes system clocks with network time sources. Achievable accuracy depends on the network and configuration, but consistent time is critical for logs, authentication, and distributed systems.

ELI Explains School's master clock. One accurate clock sends time to every classroom. Without it, every clock drifts differently.

A 10-Year-Old's Example School bell rings at exactly 8:45 — synced to a super-accurate clock. Every room shows same time. NTP is that bell.

Remember This NTP synchronizes clocks; actual accuracy varies. Consistent time is critical for logs and authentication.

Port 135 — MS-RPC Endpoint Mapper

At a Glance

• Transport: TCP/UDP

• Common service: Microsoft RPC Endpoint Mapper

• Main purpose: Maps RPC requests to dynamic ports

• Status: Official, current

• Related ports: 137, 138, 139, 445

What It Does

Windows services register here. Clients query to find which dynamic port a service uses. Essential for AD and Exchange.

ELI Explains Office receptionist: "I need Active Directory" — "office 49152 today." Don't memorize numbers, just ask.

A 10-Year-Old's Example Hospital desk: "Where's Dr. Smith?" — "Room 327, third floor." Port 135 is that desk for Windows.

Remember This Port 135 maps RPC services to ports. Block at perimeter firewalls.

Security Note Historically targeted by worms — block at perimeter firewalls.

Port 137 — NetBIOS Name Service

At a Glance

• Transport: UDP

• Common service: NetBIOS Name Service

• Main purpose: Resolves names on legacy Windows

• Status: Official, legacy

• Related ports: 138, 139, 445

What It Does

Resolves computer names without DNS. "Who is OFFICE-PC?" — that PC responds. Modern networks use DNS.

ELI Explains Before ID numbers: teacher calls your name, you raise your hand. NetBIOS: computers shouting names. DNS: organized directory.

A 10-Year-Old's Example Camp with no name tags: counselor yells "who is Alex?" Alex raises hand. NetBIOS is that name-shouting.

Remember This Legacy Windows name resolution. Modern networks use DNS.

Port 138 — NetBIOS Datagram

At a Glance

• Transport: UDP

• Common service: NetBIOS Datagram

• Main purpose: Broadcast announcements

• Status: Official, legacy

• Related ports: 137, 139, 445

What It Does

Handles broadcast announcements for legacy Windows — name registration, service discovery, resource browsing.

ELI Explains School loudspeaker: principal announces to every classroom at once. NetBIOS broadcasts to everyone simultaneously.

A 10-Year-Old's Example Camp whistle: "lunch in 10 minutes!" Everyone hears at once. Port 138 is that whistle.

Remember This Legacy Windows broadcast announcements. Modern networks use different discovery.

Port 139 — NetBIOS Session

At a Glance

• Transport: TCP

• Common service: NetBIOS Session

• Main purpose: Legacy file sharing sessions

• Status: Official, legacy

• Related ports: 137, 138, 445

What It Does

Session-based legacy Windows file and printer sharing. Modern Windows uses SMB directly on port 445.

ELI Explains Old telephone operator plugging wires to connect your call. Modern computers dial directly (port 445).

A 10-Year-Old's Example Before cell phones: operator connected landline calls. Port 139 is that operator. Today: direct dial (445).

Remember This Legacy file sharing. Modern SMB uses port 445 directly.

Port 143 — IMAP

At a Glance

• Transport: TCP

• Common service: Internet Message Access Protocol

• Main purpose: Accesses email kept on server

• Status: Official, current

• Related ports: 993, 110, 995

What It Does

Read and manage email on the server without downloading. Messages stay, keeping all devices synchronized.

ELI Explains Read books in a library instead of checking them out. Browse, read, put back. Book stays for next time. POP3 takes it home.

A 10-Year-Old's Example Comic books on your shelf — read from bed, desk, or floor. Comics stay put. IMAP keeps email on the server.

Remember This IMAP keeps email on the server for multi-device sync. Use IMAPS (993) for encryption.

Port 161 — SNMP Query

At a Glance

• Transport: UDP

• Common service: SNMP Query

• Main purpose: Polls devices for status

• Status: Official, current

• Related ports: 162

What It Does

Management systems poll devices for CPU, traffic, uptime. SNMPv3 adds encryption and authentication.

ELI Explains Building inspector checking every room: "Temperature okay? Fire alarm working?" Active checking, not waiting for reports.

A 10-Year-Old's Example Teacher walks around: "Finished problem 3? Problem 5?" SNMP queries each device: "How are you doing?"

Remember This Port 161 receives SNMP polling. Use SNMPv3 for encryption.

Port 162 — SNMP Trap

At a Glance

• Transport: UDP

• Common service: SNMP Trap

• Main purpose: Receives unsolicited alerts

• Status: Official, current

• Related ports: 161

What It Does

Device-initiated alerts — interface down, disk full, duplicate IP. Traps shout "something's wrong!" Queries ask "how are you?"

ELI Explains Fire alarm — nobody asks "is there a fire?" It goes off by itself when detecting smoke. Devices alert the moment something breaks.

A 10-Year-Old's Example Smoke detector beeps instantly — doesn't wait for a test button. SNMP traps are smoke detectors for networks.

Remember This Port 162 receives SNMP traps — unsolicited alerts from devices.

Port 179 — BGP

At a Glance

• Transport: TCP

• Common service: Border Gateway Protocol

• Main purpose: Routes between internet networks

• Status: Official, current

• Related ports: None

What It Does

Routes data between autonomous systems — the large networks of the internet. Without BGP, the internet fragments.

ELI Explains How a letter gets to another country: your post office to sorting center to "for France, through Paris." BGP is those handoffs.

A 10-Year-Old's Example Delivery driver: "I go there — give it to me, I'll hand it to someone who knows the neighborhood." BGP is that conversation.

Remember This BGP routes between internet networks — the backbone keeping the global internet connected.

Port 389 — LDAP

At a Glance

• Transport: TCP/UDP

• Common service: Lightweight Directory Access Protocol

• Main purpose: Queries directory services

• Status: Official, current

• Related ports: 636, 3269

What It Does

Queries directories like Active Directory for users, groups, computers. Behind every corporate login and permission check.

ELI Explains School's master student directory. One organized place instead of checking every classroom. Your computer asks LDAP what you can access.

A 10-Year-Old's Example Library card catalog: want dinosaur books? Check "dinosaurs" — don't search every shelf. LDAP is that catalog.

Remember This Protect LDAP with TLS: use LDAPS on port 636 or require StartTLS on port 389.

Port 443 — HTTPS

At a Glance

• Transport: TCP; UDP for HTTP/3 (QUIC)

• Common service: Hypertext Transfer Protocol Secure

• Main purpose: Encrypted web pages

• Status: Official, current

• Related ports: 80, 8443

What It Does

Carries HTTP over TLS. Traditional HTTPS uses TCP port 443, while HTTP/3 uses QUIC over UDP port 443. TLS protects traffic in transit when certificates are validated correctly.

ELI Explains A sealed, tamper-proof envelope instead of a postcard. Post office delivers, but nobody can read or change what's inside.

A 10-Year-Old's Example Secret note in a locked box. Only your friend has the key. Anyone sees a box — nobody reads the note. HTTPS is that box.

Remember This Port 443 delivers encrypted web traffic. Always check for HTTPS before entering passwords.

Port 445 — SMB Direct

At a Glance

• Transport: TCP

• Common service: Server Message Block

• Main purpose: Windows file and printer sharing

• Status: Official, current

• Related ports: 137, 138, 139

What It Does

Modern Windows file sharing directly over TCP. Shared folders, mapped drives, network printers. SMBv3 adds encryption.

ELI Explains Shared filing cabinet. Everyone with permission opens drawers, grabs files, adds documents. Rules about who accesses what.

A 10-Year-Old's Example Family photo album on the living room shelf. Anyone flips through, adds, or takes photos. Port 445 is that shared shelf.

Remember This Port 445: Windows file sharing. Never expose to the internet.

Security Note Frequent ransomware target — block at perimeter firewalls.

Port 465 — Message Submission over TLS

At a Glance

• Transport: TCP

• Common service: Message Submission over Implicit TLS

• Main purpose: Encrypted email submission

• Status: Official, current

• Related ports: 25, 587

What It Does

Provides SMTP message submission over implicit TLS: the TLS handshake begins as soon as the TCP connection opens. Current standards support port 465 alongside submission on port 587 with STARTTLS.

ELI Explains A secure mail counter whose locked door closes before the conversation starts. Port 465 starts TLS immediately; port 587 commonly starts the conversation and then upgrades with STARTTLS.

A 10-Year-Old's Example Two secure ways to submit a letter: door 465 checks the lock before opening, while door 587 opens the counter and then switches to a protected conversation.

Remember This Port 465 is the current submissions service for implicit TLS; port 587 is the submission service commonly used with STARTTLS.