Common Ports and Application Protocols

Why ports appear on every exam form

After you know TCP versus UDP, the next skill is recognizing which service rides on which port. ACL questions, NAT examples, security hardening items, and WLAN CAPWAP scenarios all assume instant recall. Build a mental table, then practice explaining what breaks if that port is filtered.

Ports are per transport: TCP 53 and UDP 53 are different listeners. Always state protocol + port when documenting firewall rules on Huawei devices (tcp destination-port 443, udp destination-port 53, and so on).

Core well-known ports for HCIA-Datacom

Commit this table to memory. The remainder of the section explains behaviors that exam writers twist into scenario questions.

File transfer: FTP (20/21)

FTP separates control and data:

• Control connection: client connects to server TCP 21.
• Active mode data: server initiates data to the client from TCP 20 (classic model).
• Passive mode data: server tells the client another server-side port to connect to for data (firewall-friendlier).

Exam implications:

• Blocking only port 21 may leave residual confusion; data ports differ by mode.
• Prefer SFTP over SSH (22) or other encrypted methods for credentials and content.
• Huawei devices may act as FTP clients or servers for image/license transfer in lab scenarios—still know the ports even if production favors SFTP.

Remote management: SSH (22) vs Telnet (23)

Both provide remote virtual terminal access to VRP, but security differs sharply:

On Huawei gear you will later configure stelnet server enable, user interfaces, and AAA. For this fundamentals chapter, remember: destination TCP 22 = SSH, 23 = Telnet, and clear-text Telnet is a liability on untrusted networks.

Console (serial) access has no IP port—it is out-of-band physical management. Do not list console as “port 22.”

Name resolution: DNS (53)

DNS maps hostnames to addresses (and more). Clients typically send queries to a recursive resolver using UDP 53. TCP 53 is used when responses exceed typical UDP limits or for zone transfers between authoritative servers.

Related exam contrast:

• DNS answers “what IP is www.example.com?”
• ARP answers “what MAC is 10.1.1.1 on this VLAN?”
• DHCP answers “what IP may this client use?”

A failure to browse by name with successful ping-by-IP points to DNS, not routing.

Address assignment: DHCP (67/68)

DHCP automates IPv4 parameters: address, mask, gateway, DNS, and options.

DORA overview (detail expands in the services chapter): Discover → Offer → Request → Ack. When server and client sit in different subnets, a DHCP relay on the Huawei gateway forwards the broadcast as a unicast to the real server—ports remain 67/68 in the classic model, with the relay inserting helper information.

Security note preview: DHCP snooping on switches mitigates rogue servers by trusting only authorized ports—again, recognition of the UDP ports helps you read ACL and snooping designs.

Web services: HTTP (80) and HTTPS (443)

• HTTP TCP 80: clear-text web; still seen internally or on redirects.
• HTTPS TCP 443: HTTP over TLS; default for modern web UIs, including many device GUIs and cloud portals.

From a networking perspective, both are TCP applications needing successful handshake, routing, and often DNS. ACLs that permit only 443 still break plain HTTP management URLs on port 80—match the service you actually use.

Monitoring: SNMP (161/162)

SNMP manages and monitors network nodes.

Versions matter for security (community strings in v2c vs user-based security in v3), but port numbers stay foundational. On Huawei devices, SNMP is part of traditional O&M; newer designs also push telemetry, yet HCIA still expects SNMP port literacy.

Huawei WLAN: CAPWAP (5246/5247)

Fit APs in Huawei campus WLAN solutions establish CAPWAP tunnels to an Access Controller (AC):

Why learn them now?

• Firewall paths between AP VLANs and the AC must allow these UDP ports.
• Later WLAN chapters discuss split-MAC, local vs centralized forwarding, and AC discovery—those designs still depend on CAPWAP reachability.
• Exam items may contrast CAPWAP UDP ports with HTTPS or SSH management ports.

If CAPWAP control cannot form, fit APs will not join the AC even when ping to the AC succeeds—another reminder that ICMP success ≠ required UDP/TCP service success.

Quick memory aids

• 20/21 FTP — “data/control” pair.
• 22 secure shell, 23 telnet — encrypted vs clear.
• 53 DNS — “names.”
• 67 server, 68 client — DHCP (server port is the lower of the two; easy mnemonic: server speaks first in many diagrams on 67).
• 80/443 web — open vs locked (TLS).
• 161 query, 162 trap — SNMP.
• 5246 control, 5247 data — CAPWAP (control number is lower).

ACL and troubleshooting patterns on Huawei networks

When a service fails end-to-end:

1. Confirm IP reachability (ping) and path (tracert).
2. Confirm the correct transport and port are permitted on intermediate ACLs and firewalls.
3. Confirm the server process listens (service enabled on VRP or host).
4. For DHCP across subnets, confirm relay configuration, not only ports on the client VLAN.
5. For WLAN, confirm CAPWAP UDP 5246/5247 between AP and AC, plus related DHCP option or DNS discovery pieces covered later.

Example ACL thinking (conceptual): permitting established TCP to high ports while allowing inbound TCP 22/443 to a management address is a common hardening pattern; blindly blocking all UDP breaks DNS, DHCP, SNMP, and CAPWAP.

Exam traps

• Swapping DHCP 67/68 roles.
• Listing DNS as TCP-only or forgetting TCP 53 exists.
• Claiming HTTPS uses UDP 443.
• Confusing ARP (no port) with application services.
• Mixing SNMP 161/162 directions.
• Using Telnet port for SSH questions or vice versa.
• Forgetting CAPWAP when a scenario mentions fit AP and AC across a Layer 3 boundary.

Putting the chapter together

Chapter 2 stacked the essentials of host-to-host communication above Ethernet:

1. IPv4 addressing/subnetting places devices in the correct networks.
2. ARP maps next-hop IPs to MACs; ICMP tests and traces paths.
3. TCP/UDP deliver application data with different reliability trade-offs.
4. Ports identify the applications themselves.

With this foundation, you can configure Huawei interfaces confidently, verify with display commands, and reason about why a given service works or fails before you tackle VLANs, routing, and WLAN deep dives.