Protocols and Ports — 220-1201 Study Guide

Two transports: connection-oriented TCP, connectionless UDP

A browser loading this page and a phone carrying a call both move data across the same network, yet they make opposite trades. The page cannot lose a single byte or the text corrupts; the call can drop a few frames and no one notices. That trade is the whole reason two transport protocols sit between the application and the network layer: TCP^[1] and UDP^[2]. This page owns the vocabulary the rest of the domain speaks: the two transports, the well-known port numbers, and the Wi-Fi generations and bands. Assembling those parts into a working network, the addressing scheme, DHCP, NAT, and which WPA mode to set, belongs to SOHO networks, and the hand tools that terminate and test the physical cabling belong to networking tools.

TCP: connection-oriented and reliable

TCP (Transmission Control Protocol) is connection-oriented, meaning the two ends establish a session before any data moves. That setup is the three-way handshake: the client sends a SYN (synchronize), the server replies SYN-ACK, and the client answers ACK, and only then does data flow. TCP numbers every byte with a sequence number, the receiver acknowledges what arrived, and anything unacknowledged is retransmitted, so the data lands complete and in order. The guarantee costs extra round trips and header overhead, which is the price TCP pays for reliability.

UDP: connectionless and fast

UDP (User Datagram Protocol) is connectionless: no handshake, no acknowledgments, no reordering. Each datagram is sent on its own and the protocol never looks back, so a lost datagram is simply gone. In exchange UDP adds almost no overhead and no setup delay, which suits traffic where a late packet is worse than a missing one, such as live voice and video, online games, and quick request-and-reply lookups.

Which protocol carries what

Reliability decides the split. Web, email, and file transfer ride TCP because a corrupted page or file is unacceptable. DNS lookups and DHCP use UDP for a fast single exchange, and real-time voice and video use UDP so a stalled retransmission never delays the stream. A single protocol can even use both: DNS answers ordinary queries over UDP 53 but switches to TCP 53 for a zone transfer, one DNS server copying a whole zone of records to another, and for responses too large for one datagram. Those port numbers are the standard assignment each service conventionally uses rather than a hard requirement, so a service can be configured onto a different port; the exam tests the conventional numbers, and this page uses them throughout. The figure contrasts the TCP handshake with UDP's single send.

TCP opens with a three-way handshake (SYN, SYN-ACK, ACK) then delivers data reliably; UDP sends a single datagram with no setup and no acknowledgment.

The well-known ports the exam makes you memorize

Point a firewall rule at 'the web server' and it means nothing; point it at TCP port 443 and it is exact. A port number^[3] is how one host tells apart the many services listening on a single IP address, and the range 0 to 1023 is reserved for the well-known ports that standard services claim. That range does not bound what you have to memorize, though: standard services sit above it too, RDP on 3389 in the table below among them. A+ hands you a symptom or a rule and expects the port, the protocol, and its transport, so memorize the three as one unit. The figure clusters the core ports by what they do; the table is the full list to drill.

The ports by function

Port	Protocol	Transport	What it does
20 / 21	FTP	TCP	File transfer (20 data, 21 control), cleartext
22	SSH / SFTP	TCP	Encrypted remote shell; SFTP is its file-transfer subsystem
23	Telnet	TCP	Legacy remote shell, cleartext
25	SMTP	TCP	Server-to-server mail relay
53	DNS	TCP and UDP	Name-to-IP resolution
67 / 68	DHCP	UDP	Automatic IP configuration (67 server, 68 client)
80	HTTP	TCP	Web, cleartext
110	POP3	TCP	Mailbox retrieval, download-and-delete
137-139	NetBIOS	TCP and UDP	Legacy Windows name and file sharing
143	IMAP	TCP	Mailbox retrieval, server-synchronized
161 / 162	SNMP	UDP	Device monitoring (161 poll, 162 trap)
389	LDAP	TCP	Directory queries
443	HTTPS	TCP	Web over TLS, encrypted
445	SMB	TCP	Windows file and printer sharing
3389	RDP	TCP	Graphical Windows remote desktop

Reading the table the way the exam does

Group the ports into four families and they stick. Remote access and management cluster at SSH 22^[4], Telnet 23^[5], RDP 3389, and SNMP 161/162^[6]. Email is SMTP 25^[7] for sending, then POP3 110^[8] and IMAP 143^[9] for retrieval, where POP3 downloads and deletes while IMAP keeps mail synchronized on the server. Web and file transfer are HTTP 80^[10], HTTPS 443, FTP 20/21^[11], and SMB 445, with the legacy NetBIOS 137-139 sitting alongside SMB. Naming and directory covers DNS 53^[12], DHCP 67/68^[13], and LDAP 389^[14]. SMB 445 and RDP 3389 both have wormable, brute-forced histories, so neither should face the internet directly.

The core well-known ports grouped into four families: remote access, email, web and file transfer, and naming and directory.

Cleartext protocols and their encrypted replacements

Capture the traffic from a Telnet or FTP session on any shared network and the username and password are right there in plain text, because these legacy protocols predate routine encryption. The fix is not a new tool but the protocol's encrypted replacement, which wraps the same function in TLS or SSH and, almost always, moves to a different port.

The swaps to know

Cleartext	Port	Encrypted replacement	Port
Telnet	23	SSH	22
HTTP	80	HTTPS	443
FTP	20 / 21	SFTP (subsystem of SSH)	22
LDAP	389	LDAPS	636
POP3	110	POP3S	995
IMAP	143	IMAPS	993

The one pairing learners reverse is FTP. Its secure options are two different mechanisms: SFTP is the file-transfer subsystem of SSH^[4] and runs on port 22, while FTPS is FTP^[11] wrapped in TLS. They solve the same problem by different means, and SFTP is not FTP-over-TLS. On the mail side, retrieval moves from POP3 110^[8] and IMAP 143^[9] to their TLS ports 995 and 993, LDAP^[14] directory traffic moves to LDAPS on 636, and web moves from HTTP 80^[10] to HTTPS 443. Sending mail is the exception to the retrieval pattern: SMTP^[7] relays server-to-server on 25, but an authenticated mail client submits on 587 (commonly upgraded with STARTTLS) or the older 465. The habit to build: the secure port is a new number, so swapping Telnet for SSH also swaps 23 for 22.

Wi-Fi: 802.11 generations, bands, and channels

A phone that flies on the couch but crawls in the back bedroom is not broken; it is physics. Wi-Fi is the IEEE 802.11^[15] family of standards, and its trailing letters name generations that grow faster over time, while the radio band decides how far the signal reaches. Read the generation and the band together and most Wi-Fi questions answer themselves. The generations are compared in the table further down this page.

The generations

The lineage runs 802.11a and 802.11b (the originals), then g, then n, ac, and ax, and the Wi-Fi Alliance^[16] gave the recent ones friendlier names: 802.11n is Wi-Fi 4, 802.11ac is Wi-Fi 5, and 802.11ax is Wi-Fi 6. Each generation raised the top link rate: 802.11a and g reach 54 Mbps, n reaches up to 600 Mbps using MIMO (multiple antenna streams), ac reaches roughly 6.9 Gbps with MU-MIMO (MIMO that serves several devices at once), and ax reaches roughly 9.6 Gbps with OFDMA (which splits a channel among users for efficiency).

The bands

A generation runs on one or more of three unlicensed bands, and the band, not the letter, sets the range-versus-speed trade:

2.4 GHz travels farthest and passes through walls best, but it is the slowest and most crowded, shared with Bluetooth, cordless phones, and every neighbor's router.
5 GHz is much faster with many more channels, at shorter range and weaker wall penetration.
6 GHz is the newest, widest, and cleanest band, reachable only by Wi-Fi 6E (the 6 GHz extension of Wi-Fi 6) and later, at the shortest range.

So 802.11b and g are 2.4 GHz only, 802.11a and ac are 5 GHz, 802.11n spans 2.4 and 5 GHz, and 802.11ax spans all three once the gear is Wi-Fi 6E.

The 2.4 GHz channel trap

The 2.4 GHz band is where channel planning bites. Its channels overlap, and in North America only channels 1, 6, and 11 sit far enough apart not to interfere. Put two nearby access points on any other choice, say 3, 4, or 9, and they bleed into each other as adjacent-channel interference; put them on the same channel and they collide as co-channel interference. Keep 2.4 GHz at a 20 MHz channel width and save the wide 40, 80, and 160 MHz channels for 5 and 6 GHz, where there is room. The figure shows why 1, 6, and 11 are the only clean choices.

In 2.4 GHz only channels 1, 6, and 11 are non-overlapping; any other 20 MHz channel bleeds into a neighbor and causes interference.

Short- and long-range wireless technologies

Reach for the wrong wireless technology and distance alone defeats you: no configuration makes NFC talk across a room or Bluetooth span two buildings. Each technology owns a native range, and matching the range to the job is the whole decision. The decision tree further down this page walks the pick; this section says what each one is and where it fits.

NFC (near-field communication) works only at a touch, a few centimeters, and that tiny range is the security model. It drives tap-to-pay, transit cards, and tap-to-pair, operating at 13.56 MHz as a short-range relative of RFID.
Bluetooth links devices across a room, commonly around 10 meters for typical class 2 radios, forming a personal-area network after a pairing step. It carries keyboards, mice, headsets, speakers, and phone tethering.
RFID (radio-frequency identification) reads a tag with a reader for inventory, asset tracking, and badge access. Passive tags carry no battery and are powered by the reader's field at very short range, while active tags have a battery and reach farther.
Wi-Fi (802.11) covers a building, as the earlier sections detail.
Long-range fixed wireless bridges point-to-point links across open distance, from a campus to miles, using directional antennas aimed line-of-sight between two fixed points. It runs on licensed or unlicensed spectrum and connects sites where running cable is impractical.

Range decides the answer

Technology	Native range	Typical use
NFC	A few centimeters	Tap-to-pay, tap-to-pair
RFID	Centimeters to meters	Tags, badges, inventory
Bluetooth	About 10 m (a room)	Peripherals, audio, tethering
Wi-Fi (802.11)	A building	Wireless LAN access
Long-range fixed wireless	Miles, point-to-point	Site-to-site bridges

A distance question is really a range question: a touch is NFC, a room is Bluetooth, a building is Wi-Fi, and a cross-site link is fixed wireless. Speed rarely decides it, because at a given distance the technology with the right range usually has no substitute. These wireless technologies sit in the A+ Core 1 networking objectives^[17].

How the exam frames protocols, ports, and wireless

Protocol, port, and wireless questions come in a few repeatable shapes, and almost every one rewards mapping the stem to a single fact from the sections above, then rejecting the near-miss distractor beside it.

Question stem says	Right answer	Common wrong answer
Secure replacement for Telnet	SSH on TCP 22	Keeping Telnet on 23
Encrypt an internal website	HTTPS on TCP 443	HTTP on 80
Graphical remote desktop into Windows	RDP on TCP 3389	SMB on 445
Reliable, in-order file transfer	TCP	UDP
Live VoIP with minimal delay	UDP	TCP
Zone transfer or oversized DNS reply	DNS over TCP 53	DNS over UDP 53 only
Which 2.4 GHz channels do not overlap	1, 6, and 11	1, 5, and 9
Fastest Wi-Fi that reaches the 6 GHz band	Wi-Fi 6E (802.11ax)	Wi-Fi 5 (802.11ac), 5 GHz only
Tap-to-pay at a terminal	NFC	Bluetooth
Wireless keyboard and headset	Bluetooth	Wi-Fi

The thread through all of them: name the protocol with its port and transport as one unit, and read a wireless stem as a distance-or-band question. When a stem is really about configuring the router, the IP scheme, or firewall rules rather than which protocol runs where, it belongs to SOHO networks; a stem about the meter or analyzer you would grab to test the link belongs to networking tools.

Wi-Fi (802.11) generations compared

Attribute	802.11a	802.11b	802.11g	802.11n (Wi-Fi 4)	802.11ac (Wi-Fi 5)	802.11ax (Wi-Fi 6/6E)
Band(s)	5 GHz	2.4 GHz	2.4 GHz	2.4 and 5 GHz	5 GHz only	2.4, 5, and 6 GHz
Max link rate	54 Mbps	11 Mbps	54 Mbps	600 Mbps	~6.9 Gbps	~9.6 Gbps
Signature feature	First 5 GHz use	First mass-market Wi-Fi	2.4 GHz at 54 Mbps	MIMO	MU-MIMO, 256-QAM	OFDMA, 1024-QAM
Reaches 6 GHz band	No	No	No	No	No	Only Wi-Fi 6E

Decision tree

Cheat sheet

Sharp facts the exam loves — give these one last read before exam day.

Cheat sheet

Sharp facts the exam loves — scan these before test day.

Use connection-oriented TCP when every byte must arrive in order

TCP is connection-oriented: it opens a session, numbers every byte, acknowledges what arrives, and retransmits anything lost, so data lands complete and in order. That reliability costs setup round trips and header overhead, which is why it carries web, email, and file transfer where a corrupted result is unacceptable.

Trap Choosing UDP for a file transfer that must arrive intact; UDP never retransmits a lost datagram.

8 questions test this

UDP is connectionless: no handshake, no acknowledgment, no reordering

UDP sends each datagram on its own with almost no overhead and no setup delay, and it never confirms or reorders anything. That makes it the right transport for real-time voice and video, online games, and quick request-and-reply lookups, where a late packet is worse than a missing one.

Trap Assuming UDP guarantees ordered, reliable delivery; it has no sequence numbers and no acknowledgments.

15 questions test this

TCP opens a session with the three-way handshake

Before any TCP data flows, the client sends a SYN, the server replies SYN-ACK, and the client answers ACK, which establishes the connection. Only after that exchange does the sequenced, acknowledged data transfer begin.

8 questions test this

DNS runs on both UDP 53 and TCP 53

Ordinary name-to-IP lookups use UDP 53 for a fast single exchange, but DNS switches to TCP 53 for zone transfers and for responses too large to fit one UDP datagram. A single protocol using both transports is exactly the kind of detail the exam probes.

Trap Answering 'UDP only' for a DNS zone transfer; oversized transfers use TCP 53.

11 questions test this

SSH on TCP 22 is the encrypted replacement for Telnet on TCP 23

SSH gives an encrypted remote shell on port 22, while Telnet on port 23 sends everything, including the login, in cleartext. Any remote-administration question that mentions security wants SSH, not Telnet.

1 question tests this

A technician needs to securely administer a headless Linux server over the network using an encrypted command-line session. Which of the…

RDP uses TCP 3389 for a graphical Windows remote desktop

RDP carries a full graphical Windows session over TCP 3389. Because it has a long brute-force and worm history, it should never be exposed raw to the internet; reach it through a VPN or a jump host.

Trap Exposing RDP 3389 directly to the internet instead of tunneling it through a VPN or jump host.

SMB uses TCP 445; the legacy NetBIOS path was 137-139

Modern Windows file and printer sharing uses direct-host SMB on TCP 445, while ports 137-139 are the older NetBIOS path. Like RDP, SMB 445 has a wormable history and should not face the internet.

Trap Citing port 139 for current SMB; direct-host SMB uses TCP 445, and 137-139 is the legacy NetBIOS range.

HTTP is TCP 80; HTTPS is TCP 443

Web traffic is cleartext HTTP on port 80 and TLS-encrypted HTTPS on port 443. The encrypted version is the same web protocol on a different port, so securing a site swaps 80 for 443.

FTP uses TCP 20 and 21: 21 controls the session, 20 carries data

FTP opens a control channel on port 21 and moves file data on port 20, and both channels are cleartext. Knowing which port is control versus data is a common exam detail.

2 questions test this

SMTP relays on TCP 25; authenticated clients submit on 587

Server-to-server mail relay uses SMTP on port 25, but an authenticated mail client submits outgoing mail on port 587, commonly upgraded with STARTTLS. Providers often block outbound 25 from clients to fight spam.

Trap Configuring a mail client to send on port 25; authenticated submission uses 587 and many ISPs block outbound 25.

2 questions test this

POP3 (110) downloads and deletes mail; IMAP (143) keeps it synced on the server

POP3 on port 110 pulls messages down and removes them from the server, while IMAP on port 143 keeps the mailbox synchronized so the same mail appears on every device. Choose IMAP when a user reads mail from more than one device.

Trap Choosing POP3 for a user who reads mail on several devices; POP3 removes messages from the server, IMAP keeps them synced.

DHCP uses UDP with the server on 67 and the client on 68

The DHCP client (port 68) broadcasts a DISCOVER because it has no address yet, and the server (port 67) answers, following the DORA sequence of Discover, Offer, Request, Acknowledge. Both ports are UDP.

Trap Swapping the DHCP ports; the server listens on UDP 67 (bootps) and the client on UDP 68 (bootpc).

3 questions test this

SNMP polls agents on UDP 161 and receives traps on UDP 162

An SNMP manager polls agents for status on port 161, and agents push unsolicited alerts, called traps, to the manager on port 162. Both run over UDP.

Trap Expecting an SNMP trap to arrive on 161; scheduled polls use 161, but agent traps arrive on 162.

4 questions test this

LDAP is TCP 389; the TLS version LDAPS is TCP 636

Directory queries, such as against Active Directory, run cleartext LDAP on port 389 and TLS-encrypted LDAPS on port 636. The secure variant moves to its own port like the other swaps.

5 questions test this

SFTP is an SSH subsystem on port 22, not FTP-over-TLS

SFTP is the file-transfer subsystem of SSH and runs on port 22, while FTPS is FTP wrapped in TLS. They secure file transfer by different mechanisms, so treating SFTP as FTP-over-TLS is wrong.

Trap Treating SFTP as FTP-over-TLS; SFTP runs inside SSH on port 22, and FTPS is the TLS-wrapped form of FTP.

1 question tests this

A technician must transfer confidential files to a remote server across the internet and needs the file contents encrypted while in…

Secure mail retrieval ports: POP3S 995 and IMAPS 993

The TLS versions of the mailbox protocols each claim their own port: POP3S on 995 and IMAPS on 993. They pair with the cleartext POP3 110 and IMAP 143.

802.11 generations map to Wi-Fi 4, 5, and 6

The Wi-Fi Alliance renamed the recent 802.11 standards: 802.11n is Wi-Fi 4, 802.11ac is Wi-Fi 5, and 802.11ax is Wi-Fi 6. Wi-Fi 6E is the variant of Wi-Fi 6 extended into the 6 GHz band.

802.11ac (Wi-Fi 5) operates only in the 5 GHz band

Wi-Fi 5 (802.11ac) transmits only in the 5 GHz band, unlike 802.11n, which spans 2.4 and 5 GHz, and 802.11ax, which can use 2.4, 5, and 6 GHz. Dual-band Wi-Fi 5 gear still reaches a 2.4 GHz network, but through its 802.11n radio, since 802.11ac has no 2.4 GHz mode.

Trap Assuming 802.11ac itself runs on 2.4 GHz; the ac amendment is 5 GHz only, and a dual-band device falls back to 802.11n for 2.4 GHz.

1 question tests this

Which of the following 802.11 wireless standards operates exclusively on the 5 GHz frequency band?

Only Wi-Fi 6E and later can use the 6 GHz band

The 6 GHz band is reachable only by Wi-Fi 6E (the 6 GHz extension of 802.11ax) and newer gear. A plain Wi-Fi 6 device without 6E stays on the 2.4 and 5 GHz bands.

Trap Assuming any Wi-Fi 6 device reaches 6 GHz; only the 6E variant and later use the 6 GHz band.

In 2.4 GHz only channels 1, 6, and 11 do not overlap

The 2.4 GHz channels overlap, so in North America access points should sit on channel 1, 6, or 11 at 20 MHz width. Any other choice causes adjacent-channel interference, and two APs on the same channel cause co-channel interference.

Trap Spacing access points on channels 1, 5, and 9; only 1, 6, and 11 are non-overlapping in 2.4 GHz.

10 questions test this

2.4 GHz reaches farthest; 5 and 6 GHz are faster at shorter range

The 2.4 GHz band penetrates walls best and reaches farthest but is the slowest and most congested. The 5 GHz band is much faster with more channels at shorter range, and 6 GHz is the widest and cleanest band but the shortest range.

4 questions test this

NFC works only at a touch, a few centimeters

NFC operates at 13.56 MHz over just a few centimeters, and that tiny range is itself the security model. It drives tap-to-pay, transit cards, and tap-to-pair, and it is a short-range relative of RFID.

Trap Choosing Bluetooth for a tap-to-pay terminal; contactless payment uses NFC at a few centimeters.

Bluetooth links peripherals across a room, about 10 meters

Bluetooth forms a personal-area network after a pairing step and carries keyboards, mice, headsets, speakers, and phone tethering, typically to about 10 meters for common class 2 radios. It is the room-scale wireless, one step up from NFC's touch range.

Passive RFID tags have no battery; active tags do

A passive RFID tag draws power from the reader's field and works only at very short range, while an active tag carries its own battery and reaches much farther. RFID drives inventory, asset tracking, and badge access.

Trap Assuming every RFID tag is battery-powered; passive tags are energized by the reader's radio field.

Long-range fixed wireless bridges point-to-point links across miles

Fixed wireless uses directional antennas aimed line-of-sight between two fixed points, on licensed or unlicensed spectrum, to connect buildings or rural sites where running cable is impractical. It is the technology for a distance far beyond what Wi-Fi covers.

NTP on UDP 123 keeps clocks in sync for time-sensitive services

NTP (Network Time Protocol) runs on UDP port 123 and synchronizes system clocks across networked devices. Services that depend on close time agreement, above all Kerberos authentication and correlated log timestamps, begin failing when server clocks drift apart, so a set of hosts showing different times points straight at NTP.

Trap Treating a Kerberos or logon failure as a broken authentication server when clock skew across the hosts is the real cause.

5 questions test this

TCP paces a sender with the sliding window the receiver advertises

TCP does flow control with a sliding window: the receiver advertises a window size that says how much unacknowledged data it can still buffer, and the sender never sends past it. This is what makes a fast sender slow down for a slow or congested receiver instead of overrunning its buffer, and it is separate from the connection setup and the acknowledge-and-retransmit that provide reliability.

Trap Crediting the three-way handshake, which only opens the session, with pacing the ongoing data flow.

6 questions test this

Wi-Fi 6 (802.11ax) is built for high-density environments

802.11ax, marketed as Wi-Fi 6, was designed to raise efficiency where many clients share the air, such as stadiums, convention centers, and crowded offices. It does this with OFDMA and enhanced MU-MIMO, which let one transmission serve several stations at once and lift the average throughput per client rather than only the peak speed.

Trap Choosing Wi-Fi 5 (802.11ac) for its raw peak speed when the real problem is many simultaneous clients.

4 questions test this

Also tested in

N10-009 CompTIA Network+

References

RFC 9293: Transmission Control Protocol (TCP) Whitepaper
RFC 768: User Datagram Protocol (UDP) Whitepaper
RFC 6335: IANA Procedures for the Service Name and Transport Protocol Port Number Registry Whitepaper
RFC 4253: The Secure Shell (SSH) Transport Layer Protocol Whitepaper
RFC 854: Telnet Protocol Specification Whitepaper
RFC 3411: An Architecture for Describing SNMP Management Frameworks Whitepaper
RFC 5321: Simple Mail Transfer Protocol (SMTP) Whitepaper
RFC 1939: Post Office Protocol - Version 3 (POP3) Whitepaper
RFC 9051: Internet Message Access Protocol (IMAP) - Version 4rev2 Whitepaper
RFC 9110: HTTP Semantics Whitepaper
RFC 959: File Transfer Protocol (FTP) Whitepaper
RFC 1035: Domain Names - Implementation and Specification (DNS) Whitepaper
RFC 2131: Dynamic Host Configuration Protocol (DHCP) Whitepaper
RFC 4511: Lightweight Directory Access Protocol (LDAP): The Protocol Whitepaper
IEEE 802.11 Wireless LAN Working Group
Wi-Fi CERTIFIED 6 (802.11ax)
CompTIA A+ (Core 1) Certification