Support Library
Internet Protocols Explained
Every website visit, email and video call depends on dozens of protocols, each doing one job. This guide describes the ones you are most likely to meet, with each one’s port, what it runs over and the standard that defines it, and links to deeper guides where we have them.
The short answer
A protocol is an agreed set of rules for how two programs exchange messages: what each message looks like, what order they come in and what to do when something goes wrong. Internet protocols are stacked in layers, and each layer relies on the one below:
- Application protocols such as HTTP, DNS and SMTP carry what the user actually wants: a page, an address, an email.
- TLS wraps them in encryption and proves the server’s identity.
- Transport protocols, TCP, UDP and QUIC, deliver data between programs using port numbers.
- IP moves packets between machines across networks, and BGP decides the routes between those networks.
- Link protocols such as Ethernet and Wi-Fi carry the packets over each local network.
To see several of them working together, step through what happens when you load a web page.
How the protocols stack
A single web request passes down through every layer on your device and back up on the server. The OSI and TCP/IP models guide explains the layers in more detail.
Web
The protocols a browser uses to fetch pages and talk to web applications.
HTTP Hypertext Transfer Protocol
The request and response protocol of the web. A client asks for a resource with a method such as GET or POST, and the server answers with a status code, headers and usually a body. Plain HTTP is unencrypted and today mostly just redirects to HTTPS.
- Port
- TCP 80
- Runs over
- TCP
Learn more: What Happens When You Load a Web Page HTTP Status Codes Explained
HTTPS HTTP over TLS
HTTP inside an encrypted, authenticated TLS connection. The certificate proves the server owns the name you typed, and nobody on the path can read or change the pages. Browsers mark plain HTTP pages as not secure.
- Port
- TCP 443, UDP 443 for HTTP/3
- Runs over
- TLS over TCP, or QUIC
- Defined in
- RFC 9110
Learn more: What Happens When You Load a Web Page HTTPS and HTTP-to-HTTPS Redirects HSTS: HTTP Strict Transport Security
HTTP/2 HTTP version 2
The same requests and responses as HTTP/1.1, sent as binary frames so many requests share one connection at once. Browsers only use it over TLS, and negotiate it in the TLS handshake with ALPN.
- Port
- TCP 443
- Runs over
- TLS over TCP
- Defined in
- RFC 9113
Learn more: What Happens When You Load a Web Page
HTTP/3 HTTP version 3
HTTP mapped onto QUIC instead of TCP. Connection setup takes one round trip fewer, and a lost packet only delays the request it belongs to. Sites advertise it with an Alt-Svc header or an HTTPS DNS record.
- Port
- UDP 443
- Runs over
- QUIC
- Defined in
- RFC 9114
Learn more: What Happens When You Load a Web Page SVCB and HTTPS DNS Records
WebSocket The WebSocket Protocol
A long-lived, two-way channel that starts as an HTTP request and is then upgraded, so a server can push messages to the page without being asked. Chat, live dashboards and multiplayer games use it.
- Port
- TCP 80 (ws), 443 (wss)
- Runs over
- TCP, usually with TLS
- Defined in
- RFC 6455
Naming and registration
How names become addresses, and how to find out who registered a name or an address block.
DNS Domain Name System
The internet’s directory. It turns names such as example.com into IP addresses and also publishes mail servers, verification records and security policies. Most lookups are a single UDP packet each way.
- Port
- UDP and TCP 53
- Runs over
- UDP, falling back to TCP
Learn more: How a DNS Lookup Works, Step by Step DNS Record Types Explained TCP vs UDP and Why DNS Uses Both
DNSSEC DNS Security Extensions
Digital signatures on DNS records, so a validating resolver can prove an answer came from the zone owner and was not forged on the way. It authenticates answers but does not encrypt them.
- Port
- Same as DNS
- Runs over
- DNS
Learn more: Debugging DNSSEC validation errors DNSSEC vs DoH
DoT DNS over TLS
DNS queries sent inside a TLS connection to a dedicated port, so the network can’t read or alter them. Android’s Private DNS setting uses it.
- Port
- TCP 853
- Runs over
- TLS over TCP
- Defined in
- RFC 7858
Learn more: DoH vs DoT vs DoQ
DoH DNS over HTTPS
DNS queries sent as HTTPS requests. They look like ordinary web traffic on port 443, which makes them hard to block or monitor. Browsers and public resolvers support it widely.
- Port
- TCP 443, or UDP 443 over HTTP/3
- Runs over
- HTTPS
- Defined in
- RFC 8484
Learn more: DoH vs DoT vs DoQ DNS over HTTPS (DoH) Testing
DoQ DNS over QUIC
DNS queries over a dedicated QUIC connection, combining encryption with QUIC’s fast setup and independent streams.
- Port
- UDP 853
- Runs over
- QUIC
- Defined in
- RFC 9250
Learn more: DoH vs DoT vs DoQ
mDNS Multicast DNS
Name lookups on a local network with no DNS server: a device asks everyone on the link for a name ending in .local, and the owner answers. Printers, speakers and AirPlay devices find each other this way, often together with DNS-SD.
- Port
- UDP 5353 (multicast)
- Runs over
- UDP
WHOIS
The original registration lookup: send a domain or IP address as a line of text and get back free-form text about who registered it. Many registries still run it, but the format varies and much of the data is now redacted.
- Port
- TCP 43
- Runs over
- TCP
- Defined in
- RFC 3912
Learn more: What Is WHOIS Information? WHOIS vs RDAP
RDAP Registration Data Access Protocol
WHOIS’s replacement: the same registration data returned as structured JSON over HTTPS, with standard fields and links between registries. Generic top-level domains must offer it.
- Port
- TCP 443
- Runs over
- HTTPS
Learn more: WHOIS vs RDAP IP WHOIS Lookup technical details
Sending mail between servers, reading it in an app, and proving who sent it.
SMTP Simple Mail Transfer Protocol
Moves email from your mail app to your provider and from one mail server to the next. Servers find each other through MX records in DNS, and upgrade to encryption with STARTTLS when both support it.
- Port
- TCP 25 between servers; 587 or 465 for submission
- Runs over
- TCP, with STARTTLS or TLS
Learn more: Why is email not being delivered? (DNS perspective) Secure Email Transport: STARTTLS and DANE
IMAP Internet Message Access Protocol
Reads mail that stays on the server, so every device sees the same folders, flags and read state. This is what mail apps use to fetch messages.
- Port
- TCP 993 (TLS), 143
- Runs over
- TCP, with TLS
- Defined in
- RFC 9051
POP3 Post Office Protocol version 3
An older way to read mail: the app downloads new messages and usually deletes them from the server. Simple, but it does not sync folders or state between devices.
- Port
- TCP 995 (TLS), 110
- Runs over
- TCP, with TLS
- Defined in
- RFC 1939
SPF, DKIM, DMARC Email authentication
Three DNS-published checks that let a receiving server tell real mail from forgeries. SPF lists the servers allowed to send for a domain, DKIM signs each message, and DMARC says what to do when both fail and where to send reports.
- Port
- Published in DNS, checked over SMTP
- Runs over
- DNS TXT records
Learn more: Email Phishing Protection: SPF, DKIM, DMARC DKIM Explained: Selectors and Key Rotation
MTA-STS and TLS-RPT SMTP MTA Strict Transport Security and TLS Reporting
Lets a domain require encrypted, authenticated connections for mail sent to it, with the policy fetched over HTTPS, and receive daily reports of delivery problems. DANE with TLSA records does the same job using DNSSEC.
- Port
- Policy on TCP 443; mail on TCP 25
- Runs over
- HTTPS and DNS
Learn more: MTA-STS and TLS-RPT Explained DANE for Email
Transport and security
The layer that carries data between programs, and the encryption that wraps it.
TCP Transmission Control Protocol
Reliable, ordered delivery between two programs. A three-way handshake opens the connection, every byte is numbered and acknowledged, lost data is resent and the sender slows down when the network is congested.
- Port
- Ports 0–65535
- Runs over
- IP
- Defined in
- RFC 9293
Learn more: TCP Handshakes and Port States Explained Common TCP and UDP Ports Explained
UDP User Datagram Protocol
Single packets with a port number and a checksum, and nothing else: no handshake, no retries, no ordering. It suits small lookups such as DNS and real-time traffic such as voice and games, and it is the base QUIC builds on.
- Port
- Ports 0–65535
- Runs over
- IP
- Defined in
- RFC 768
Learn more: TCP vs UDP and Why DNS Uses Both Common TCP and UDP Ports Explained
QUIC
A modern transport that runs over UDP with TLS 1.3 built into its handshake. It opens encrypted connections in one round trip, carries many independent streams, and can survive a change of network, such as Wi-Fi to mobile.
- Port
- UDP 443 for HTTP/3
- Runs over
- UDP
Learn more: What Happens When You Load a Web Page
TLS Transport Layer Security
Encryption and server authentication for a connection. The server proves its identity with a certificate, both sides agree on keys, and everything after the handshake is private and tamper-evident. TLS 1.3 is current; versions before 1.2 are deprecated. DTLS is the same idea for UDP.
- Port
- Same port as the protocol it protects
- Runs over
- TCP (built into QUIC)
Learn more: What Happens When You Load a Web Page Certificate Transparency for DNS Discovery
Internet and routing
Addressing, error reporting and the routing that carries packets between networks.
IPv4 Internet Protocol version 4
Delivers packets between machines using 32-bit addresses such as 192.0.2.10. With only about 4.3 billion addresses, most networks share public addresses through NAT.
- Port
- No ports; carries TCP, UDP, ICMP and others
- Runs over
- The link layer
- Defined in
- RFC 791
Learn more: IP Addresses, Subnets and CIDR NAT and Private IP Address Ranges
IPv6 Internet Protocol version 6
The successor to IPv4, with 128-bit addresses such as 2001:db8::10, enough for every device to have its own. DNS publishes IPv6 addresses in AAAA records.
- Port
- No ports; carries TCP, UDP, ICMPv6 and others
- Runs over
- The link layer
- Defined in
- RFC 8200
Learn more: IPv4 vs IPv6 and AAAA Records IPv6 Subnetting and Address Planning
ICMP Internet Control Message Protocol
IP’s messenger. Routers and hosts use it to report errors such as “destination unreachable” or “time exceeded”, and ping and traceroute are built on it. ICMPv6 does the same for IPv6 and much more.
- Port
- No ports (IP protocol 1; ICMPv6 is 58)
- Runs over
- IP
Learn more: Ping explained: latency, packet loss and jitter How to Read a Traceroute
ARP and NDP Address Resolution Protocol and Neighbor Discovery
Finds the hardware (MAC) address that belongs to an IP address on the local network, so a packet can be handed to the right device. ARP does this for IPv4; NDP, part of ICMPv6, does it for IPv6.
- Port
- No ports
- Runs over
- Ethernet or Wi-Fi (ARP); ICMPv6 (NDP)
BGP Border Gateway Protocol
How the tens of thousands of networks that make up the internet tell each other which addresses they can reach. Every route between providers is chosen by BGP, so a mistake or a hijack can send traffic the wrong way.
- Port
- TCP 179
- Runs over
- TCP
- Defined in
- RFC 4271
Learn more: BGP Basics: How Internet Routing Works Autonomous Systems and ASNs Explained
RPKI Resource Public Key Infrastructure
Signed statements, called ROAs, that say which network may announce an address block. Routers that check them reject BGP announcements from the wrong origin.
- Port
- Validators fetch data over rsync and RRDP (HTTPS)
- Runs over
- HTTPS and rsync
Learn more: RPKI Explained: Authorizing Your Routes BGP Hijacks and RPKI
OSPF Open Shortest Path First
A routing protocol used inside one organisation’s network. Routers share a map of their links and each works out the shortest path, re-routing quickly when a link fails.
- Port
- No ports (IP protocol 89)
- Runs over
- IP
Learn more: Leaf-and-Spine Data Center Networks
Network services and access
The protocols that hand out addresses, keep clocks right, watch devices and decide who may join the network.
DHCP Dynamic Host Configuration Protocol
Gives a device joining a network its IP address, subnet, default gateway and DNS servers, leased for a set time. DHCPv6 and router advertisements do the same for IPv6.
- Port
- UDP 67 (server), 68 (client); DHCPv6 UDP 546, 547
- Runs over
- UDP
Learn more: Why does DNS work on one network but not another?
NTP Network Time Protocol
Keeps clocks in sync, typically to within a few tens of milliseconds over the internet and far closer on a local network. Accurate time matters more than it seems: TLS certificates, DNSSEC signatures, Kerberos tickets and logs all depend on it.
- Port
- UDP 123
- Runs over
- UDP
- Defined in
- RFC 5905
SNMP Simple Network Management Protocol
Reads counters and settings from routers, switches and printers, and receives alerts (traps) from them. Older versions send a plain-text community string as the password; version 3 adds real authentication and encryption.
- Port
- UDP 161, traps on UDP 162
- Runs over
- UDP
Syslog The Syslog Protocol
Sends log messages from devices and servers to a central collector. Classic syslog over UDP is unencrypted and can drop messages; syslog over TLS fixes both.
- Port
- UDP 514, TCP 6514 with TLS
- Runs over
- UDP or TLS over TCP
LDAP Lightweight Directory Access Protocol
Queries and updates a directory of users, groups and devices, such as Active Directory. Applications use it to look up people and to check passwords.
- Port
- TCP 389, 636 for LDAPS
- Runs over
- TCP, with TLS
- Defined in
- RFC 4511
Kerberos
Single sign-on inside an organisation: you prove your password once to a key distribution center and get tickets that log you in to other services without sending the password again. Windows domains are built on it.
- Port
- UDP and TCP 88
- Runs over
- UDP or TCP
- Defined in
- RFC 4120
RADIUS Remote Authentication Dial-In User Service
Lets Wi-Fi access points, switches and VPN gateways ask a central server whether a user or device may connect, and which network to put it on.
- Port
- UDP 1812 (authentication), 1813 (accounting)
- Runs over
- UDP, or TLS (RadSec)
Learn more: RADIUS Explained: AAA for Network Access
802.1X and EAP Port-based network access control
Keeps a wired port or Wi-Fi connection closed until the device authenticates, usually with a certificate or a username and password checked by a RADIUS server through EAP.
- Port
- No ports (Ethernet frames)
- Runs over
- Ethernet or Wi-Fi
- Defined in
- IEEE 802.1X, RFC 3748
Learn more: 802.1X Explained: Port-Based Access Control Certificate-Based Network Authentication
Remote access and file sharing
Logging in to other machines and moving files between them. Several of these should never face the internet.
SSH Secure Shell
Encrypted remote login and command execution, and the base for SFTP, scp and port forwarding. Servers are identified by host keys, and users usually sign in with keys rather than passwords.
- Port
- TCP 22
- Runs over
- TCP
Learn more: Remote access ports
Telnet
Remote login from the 1970s that sends everything, passwords included, as plain text. It survives on old network gear; use SSH instead.
- Port
- TCP 23
- Runs over
- TCP
- Defined in
- RFC 854
RDP Remote Desktop Protocol
Microsoft’s protocol for using a Windows desktop remotely. It is a frequent target for password-guessing and ransomware, so it belongs behind a VPN or gateway, not open to the internet.
- Port
- TCP and UDP 3389
- Runs over
- TCP and UDP, with TLS
- Defined in
- Microsoft MS-RDPBCGR
FTP File Transfer Protocol
File transfer with separate control and data connections, which makes it awkward through firewalls and NAT. Plain FTP sends passwords unencrypted; FTPS adds TLS, and SFTP is a different protocol that runs over SSH.
- Port
- TCP 21, plus data ports
- Runs over
- TCP
SMB Server Message Block
Windows file and printer sharing, also used by macOS and Samba. Exposing it to the internet led to worms such as WannaCry, so port 445 should be blocked at the edge.
- Port
- TCP 445
- Runs over
- TCP, or QUIC
- Defined in
- Microsoft MS-SMB2
Tunnels and VPNs
Protocols that wrap one network’s traffic inside another, to connect sites or users securely or to stretch a network across a data centre.
IPsec IP Security
Encrypts and authenticates IP packets themselves, typically between two sites or from a laptop to a corporate VPN gateway. IKE negotiates the keys.
- Port
- IKE on UDP 500 and 4500; ESP is IP protocol 50
- Runs over
- IP or UDP
Learn more: ZTNA vs VPN for Remote Access
WireGuard
A small, modern VPN protocol with fixed, current cryptography and a single UDP port. It is built into Linux and used by many commercial VPN services.
- Port
- UDP, commonly 51820
- Runs over
- UDP
- Defined in
- WireGuard whitepaper
Learn more: ZTNA vs VPN for Remote Access
VXLAN Virtual Extensible LAN
Carries Ethernet frames inside UDP packets, so virtual machines in different racks or buildings can share one layer 2 network. It allows about 16 million segments where VLANs allow 4,094.
- Port
- UDP 4789
- Runs over
- UDP
- Defined in
- RFC 7348
Learn more: VLANs vs VXLAN Overlays
Test them yourself
- DNS: Domain Visualizer shows a domain’s live records, and Email Validation checks MX, SPF, DKIM and DMARC.
- TCP: TCP Port Check tells you whether a port is open, closed or filtered.
- ICMP: Ping and Traceroute measure latency and show the path packets take.
- BGP and registration data: ASN Lookup and IP WHOIS Lookup show who announces and who holds an address.
- HTTPS and TLS: Security Posture checks which certificate authorities may issue for a domain (CAA) and any DANE records, and whether the site serves HTTPS with a redirect from HTTP, HSTS and security headers.
For the default port of every service in one table, see common TCP and UDP ports.
FAQ
What is the difference between a protocol and a port?
A protocol is the set of rules two programs follow to talk to each other. A port is the number that tells the receiving machine which program a TCP or UDP message is for. Protocols have well-known default ports, such as 443 for HTTPS, but a service can run on any port.
Why do some protocols have no port?
Ports belong to TCP and UDP. Protocols that sit at or below the IP layer, such as IP itself, ICMP, OSPF, ARP and 802.1X, are identified by a protocol number in the IP header or a type field in the Ethernet frame instead.
Which of these protocols should never be open to the internet?
Telnet, RDP, SMB, NFS, SNMP, LDAP and database protocols are frequent targets and normally belong behind a VPN or firewall. Web, mail and DNS ports are meant to be reachable on servers that offer those services.
Who decides what the internet protocols are?
Most are published by the Internet Engineering Task Force (IETF) as RFCs, and IANA keeps the registries of port and protocol numbers. Some come from other bodies, such as the IEEE for Ethernet, Wi-Fi and 802.1X, or from a single vendor, such as Microsoft for RDP and SMB.
Sources and further reading
- RFC 1122: Requirements for Internet Hosts, Communication Layers
- RFC Editor: the published RFC series
- IANA: Service Name and Transport Protocol Port Number Registry
- IANA: Assigned Internet Protocol Numbers
- IETF: Introduction to the IETF
- IEEE 802.1: 802.1X Port-Based Network Access Control
- Microsoft Open Specifications: Remote Desktop Protocol (MS-RDPBCGR)
- Microsoft Open Specifications: SMB Versions 2 and 3 (MS-SMB2)
- WireGuard: Next Generation Kernel Network Tunnel (whitepaper)