Details of Port No., which Protocol, which Service for following services

[Lakshmi Narayanan]

Hi all,
can anybody give an information on the following services in RHEL AS4.0 for thier respective port no. which protocol it uses and which service it use for the following:

ftp, ssh, dns, nfs, nis, mailserver, webserver, samba, portmap, sftp, dhcp, Xwindow etc...

Thanks for your reply...
Bye,
Have a nice day

[Ivan Ferreira]

You can consult the /etc/services file.

[Matti_Kurkela · Accepted solution]

This sounds more like a "TCP/IP networking fundamentals" homework question than anything RHEL AS4-specific.

Xwindow:
Surprisingly, by default in modern Linux distributions this may not use any TCP nor UDP ports at all!
For security reasons, the X server is started with the option "-nolisten TCP" and the clients communicate with the server using UNIX domain sockets in /tmp/.X11-unix directory. This also means that remote Xwindow connections can succeed only using SSH's X11 connection forwarding or a similar method. The people familiar with "traditional" remote X11 connection methods are usually very confused when encountering this for the first time.

FTP:
By default, the server listens for FTP command channel connections in TCP port 21.
If the client requests active transfer mode, the server opens the data channel - traditionally from TCP port 20, but in modern implementations it can be any "high" TCP port (first free port number above 1024).
If the client requests passive transfer mode, the server picks a free TCP port, reports its number to the client and listens for *one* data connection on that port.
For a more detailed explanation on FTP, see here:
http://slacksite.com/other/ftp.html

SSH:
By default, the server listens on TCP port 22. Most SSH servers won't rely on /etc/services in specifying the port number, and sometimes SSH servers are configured to use arbitrary TCP port numbers as a security-by-obscurity measure to avoid automated break-in attempts.

DNS:
The server listens in port 53. Most normal queries are served using UDP protocol; if the query or the answer does not fit in a single UDP packet, TCP is used instead. DNS zone transfers between name servers in a master/slave relationship always use TCP.

NFS/NIS:
The port numbers and protocols are highly variable, and may change depending on the startup order of the various service component daemons. The SunRPC portmapper (aka rpcinfo) listens for connections in port 111 (both TCP and UDP). It knows which services of this family are available in which service version/protocol/port number combinations.

Mail server:
There are various email-related protocols. All of them are TCP-based. Many of them can be configured to allow the option of TLS encryption using the standard (plain mode) port numbers.
- SMTP (Simple Mail Transfer Protocol) is used to transfer email from one server to another, and often between email client and server to send email. The standard port number is 25. It may offer TLS option (known as STARTTLS). Sometimes a SSL-secured version is used in port 465.
- POP (Post Office Protocol) is used to retrieve mail from a mailserver to a local storage in the email client. The obsolete POP2 protocol version used port 109, but currently POP3 is the most common version. It uses port 110 for non-encrypted mode, and optionally 995 for SSL-secured mode.
- IMAP is another protocol which allows the email client to access mailboxes on the server. It is designed mainly for use when the email client intends to use the server as a primary storage location for emails and only download those the user wants to read immediately. The port numbers are 143 for plain (or optionally TLS-secured) connection and 993 for SSL-secured connection.
- Modern email servers can also offer a limited form of SMTP on port 587. This allows a different configuration for local email clients (mostly lenient, allowing relaying) and for incoming email from the outside world (can use a strict anti-spam policy).

Samba:
It will use the port numbers specified by Microsoft Windows SMB protocols, i.e. TCP and UDP 135-139 and/or TCP 445.

Portmap: see NFS/NIS above.

SFTP: this file transfer protocol is always encapsulated in SSH connections, see SSH above.

DHCP:
In this one, the protocol is UDP. Client listens on port 68, server on port 67. Because this needs to work before the client knows its own IP address, this is a bit tricky. Initially, the client sends queries as broadcasts using source address 0.0.0.0 and destination address 255.255.255.255. After successfully receiving an IP address from the server, the client reverts to normal unicast communication with the server to re-new the address lease as required by the server. If the renewing does not succeed, the client will return to broadcast mode and restarts the process.