CompTIA Network+ Ports and Protocols: The N10-009 List by Job

The N10-009 port table, grouped by job

CompTIA Network+ N10-009 objective 1.4 prints a table of protocols and ports. The version 4.0 objectives, checked October 18, 2026, list the 20 entries below. This page regroups them by job, because exam questions usually describe a task or a failure, not a number.

The transport column comes from each protocol's specification or, for Microsoft services, from Microsoft's port references, all opened October 18, 2026. The IANA registry assigns most of these numbers for both TCP and UDP, so the registry alone does not tell you which one a service uses.

Two entries share port 22. SSH can run named subsystems inside a connection, and RFC 4254 anticipates a file-transfer subsystem among them, which is how SFTP rides on SSH's port. The objectives list them separately, so learn both labels.

Port numbers are defaults. An administrator can move a service, and a question means the default unless it says otherwise.

TCP, UDP, and the five UDP services on the list

TCP opens a connection and delivers a reliable, ordered byte stream (RFC 9293). UDP sends independent datagrams with no promise that they arrive. Most services in the 1.4 table use TCP. Five are UDP in normal use, and they are mostly management and infrastructure traffic:

• DHCP, 67/68. RFC 2131 says DHCP uses UDP, with clients sending to server port 67 and servers replying to client port 68.
• TFTP, 69. A very simple file transfer protocol built on UDP (RFC 1350), with no login step.
• NTP, 123. RFC 5905 defines the NTP packet as a UDP datagram.
• SNMP, 161/162. RFC 3417 has agents listen on UDP 161 and notification receivers, where traps arrive, on UDP 162.
• Syslog, 514. RFC 5426 requires receivers to accept syslog datagrams on UDP 514. The registry assigns 514/tcp to a different service, "shell."

Three more use both. DNS runs over UDP and TCP on 53, and RFC 7766 says DNS implementations must support both. RFC 3261 requires every SIP element to implement UDP and TCP. Microsoft lists RDP on TCP 3389 and UDP 3389.

The exam habit to build: when a firewall change breaks monitoring, logging, time or address assignment, check whether the rule allowed only TCP.

Port 587: why the exam says SMTPS and the registry says submission

This is the one entry where CompTIA's label and the standards bodies' naming differ, and both are worth knowing.

• The N10-009 objectives list "Simple Mail Transfer Protocol Secure (SMTPS)" on port 587.
• The IANA registry names 587 "submission" and 465 "submissions."
• RFC 8314 puts implicit TLS for mail submission on 465 and notes that STARTTLS on 587 is widely deployed. It also records that 465 was briefly registered as "smtps" years ago and that the registration was revoked.

For the exam, learn the objectives' pairing: 587 with the SMTPS label. In real configurations, expect 587 called submission, usually with STARTTLS, and 465 used for implicit TLS. Port 25 remains SMTP between mail servers. Knowing both keeps vendor documentation from contradicting what you learned for the exam.

What CompTIA Network+ adds to the A+ port list

If you passed CompTIA A+ 220-1201, you already know 11 of these 20 entries. The A+ objective 2.1 list has 14, and Passy's A+ ports guide covers it. Compared with that list, the N10-009 table:

The additions lean toward running a network: time, monitoring, logging, secure directory access, voice and databases. CompTIA's objectives say their examples are not exhaustive, so treat POP3 and IMAP as background knowledge rather than something you can forget.

IP protocol types in 1.4: ICMP, GRE and IPSec

Objective 1.4 also lists IP types that are not ports at all. ICMP, TCP, UDP, GRE, ESP and AH are carried directly in IP and identified by an IP protocol number in IANA's registry:

A firewall rule for GRE, ESP or AH matches the protocol number, not a port. IKE, the IPSec key exchange, is different: IANA registers UDP 500 as "isakmp," and UDP 4500 as "ipsec-nat-t" for IPSec through NAT. That is why an IPSec VPN through a firewall commonly needs UDP 500 and ESP, plus UDP 4500 when NAT sits in the path.

Traffic types: unicast, multicast, anycast, broadcast

• Unicast: one sender to one receiver.
• Multicast: one sender to a group of receivers that joined it. IPv4 multicast uses the former class D range, 224.0.0.0 to 239.255.255.255 (RFC 1112, RFC 5771).
• Broadcast: one sender to every host on the local network. A DHCP client with no address broadcasts its first message (RFC 2131). IPv6 has no broadcast addresses (RFC 4291).
• Anycast: one address shared by several interfaces, with each packet delivered to the nearest one by routing distance, as RFC 4291 defines it for IPv6.

Symptom drills for the N10-009 ports

Cover the right-hand columns, read the symptom, and name the port, the transport and the reason. These scenarios are original.

Notice how many stems hinge on the transport, not only the number. A rule that names the right port with the wrong protocol fails the same way as a missing rule.

When you can name the port and transport from the symptom alone, try the directory-port case: the free mixed set includes a firewall item about LDAP over SSL, so work the directory firewall-port item in the free Network+ set → and read why each wrong port fails.

How ports map to the transport layer is in the OSI model guide. The monitoring guide covers SNMP versions and syslog severities.