Lessons · Cybersecurity · port numbers and what lives there
Port numbers, and what usually lives there
A port number says which service on a machine a connection is for, and a handful of numbers cover most of what you will see: 22 remote command line, 25 mail between servers, 53 name lookups, 80 web, 443 encrypted web, 3389 remote desktop.
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
What it is for
The log says a connection to port 3389 from an address in another country. Knowing the number means knowing that somebody just tried to open a remote desktop on a machine that should not be reachable at all, and that is a page-the-manager moment rather than a note in the ticket.
How to think about it
Read the destination port first: it names the service. Then ask two questions: should this machine be offering that service at all, and should it be offering it to the address that is asking? A perfectly ordinary port in the wrong direction is the finding.
Worked example
Workstation to port 53 outward: name lookupsEvery machine does this constantly. Normal.
Workstation to port 443 outward: encrypted web trafficAlso normal, and also where most things hide, so the destination matters more than the port.
Outside address to port 22 on a server: somebody reaching for a command lineAllowed only from named addresses, never from anywhere.
Outside address to port 3389 on a laptop: remote desktop from the internetNothing good is at the other end of this one.
Your turn
Remote desktop reached straight from the internet is the finding above. Write what that port should be at the boundary.
port 3389 from the internet must be
Solve one, graded on the server
The trap
Treating the port number as proof of the service. Anything can listen on any port, which is why an odd service on a familiar number is worth more of your attention, not less.