> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/06-network-security-basics/ports-and-services.md).

# Ports and Services

Network services listen on ports so other systems can communicate with them.

This lab introduces a few common ports that appear in Windows and Active Directory environments.

## Objective

Understand the relationship between an application, a protocol, and a network port.

## Common Examples

| Service  | Common Port | Purpose                                |
| -------- | ----------: | -------------------------------------- |
| DNS      |          53 | Name resolution                        |
| Kerberos |          88 | Active Directory authentication        |
| HTTP     |          80 | Web traffic                            |
| HTTPS    |         443 | Encrypted web traffic                  |
| LDAP     |         389 | Directory services                     |
| LDAPS    |         636 | Encrypted LDAP                         |
| SMB      |         445 | Windows file and service communication |
| RDP      |        3389 | Remote Desktop                         |

A port number does not prove which application is running. It is a useful clue that should be combined with process, service, and endpoint information.

## TCP and UDP

TCP creates a connection between systems and provides ordered delivery.

UDP sends datagrams without creating the same type of connection state.

Some services can use both protocols depending on the task.

## Observe Services in the Lab

On `DC01`, open Command Prompt as an administrator and run:

```
netstat -ano
```

Look for entries in the `LISTENING` state.

Do not try to memorize every port. Instead, choose a few entries and identify what service or process they belong to.

## Verification

The lab is complete when you can explain:

* What a port represents
* The difference between a listening port and an active connection
* Why the same port number should not be treated as proof of a specific application

## Security Relevance

Unexpected listening services can increase the attack surface of a system. During an investigation, ports help identify which services may have accepted or initiated network communication.