Protocol Port Matching Game: Match Services, Ports, Transport, and Use Cases
Match networking protocols to ports, transport behavior, and practical use cases with explanations and troubleshooting clues.
Independent AP Networking resource • Updated 2026-09-14 • Built for students and teachers
How to play
Match the service role first. Then attach transport and port.
The strongest way to learn ports is to connect four things at once: protocol → transport → common port → operational use case. Once those are linked, port knowledge becomes useful for packet captures, listener output, firewall rules, troubleshooting, and AP-style scenario questions.
ROLE: What job is the protocol doing?
TRANSPORT: TCP, UDP, or both?
PORT: Which common destination port is associated with that service?
EVIDENCE: What artifact would confirm the service is actually reachable or listening?
Core match board
High-value service matches
HTTPTCP80Unencrypted web traffic
HTTPSTCP 443; HTTP/3 uses UDP 443443Protected web application traffic
SSH / SFTPTCP22Encrypted remote administration / SSH-based file transfer
TelnetTCP23Legacy plaintext remote terminal
DNSUDP/TCP53Name resolution
DHCPv4UDP67/68Dynamic IPv4 client configuration
FTPTCP21 controlClassic FTP control; separate data behavior
Interpretation: a TCP listener on 22 is consistent with SSH; TCP 443 is consistent with an HTTPS/TLS service; UDP 53 is consistent with DNS. But the owning process should be identified where possible.
What listener output supportsA local service socket exists on that transport/port.
What it does NOT proveRemote routing, firewall permission, TLS correctness, or application health.
Round 4 • Firewall match
Port knowledge should produce least-privilege rules
Requirement A:
Students may query InternalDNS.
Best rule concept:
ALLOW StudentNet → InternalDNS UDP/TCP 53
Requirement B:
Admins may manage switches securely.
Best rule concept:
ALLOW AdminNet → Switches TCP 22
Requirement C:
Users may access AppServer securely.
Best rule concept:
ALLOW UserNet → AppServer TCP 443
Trap: “The server is trusted, so allow ANY/ANY.” Port matching should narrow the rule, not justify broad access.
Round 5 • One user transaction
A browser action can depend on multiple protocols
User enters:
https://portal.example
Dependency chain:
1. DNS resolves portal.example using port 53
2. Client reaches returned server address
3. HTTPS service uses destination 443
4. TLS must succeed
5. HTTP application must respond
Correctly matching DNS to 53 does not prove 443 works. Correctly matching 443 does not prove TLS or HTTP succeeds. Strong students preserve each successful checkpoint and move to the next unresolved dependency.
Round 6 • DNS evidence
Same port, different outcome
DNS result
Interpretation
Timeout
No usable response arrived in time
NXDOMAIN
A DNS response arrived stating the queried name does not exist
SERVFAIL
The resolver responded but could not complete resolution
Expected A/AAAA
Name resolution succeeded for that query
Swipe horizontally to compare DNS outcomes.
The port match starts the analysis; the response type tells you what actually happened.
Round 7 • DHCP evidence
67/68 is more useful when you know the direction and role
DHCPv4 server: UDP 67
DHCPv4 client: UDP 68
Remote client subnet:
Client broadcast → local gateway/relay → DHCP server
If same-subnet clients receive leases but remote-subnet clients do not, the DHCP server may be healthy while the relay/helper or routed/policy path is the missing dependency.
Round 8 • Email roles
“Email” is not one protocol-port pair
SMTP 25
Server-to-server message transfer/relay.
★ Protocol Review • Protocol Port Matching Game: Match Services, Ports, Transport, and Use Cases
A five-minute warm-up for Protocol Port Matching Game: Match Services, Ports, Transport, and Use Cases
Tomorrow’s opening question can pick up where this page leaves off: ask students to read the packet evidence, spot the important clue and explain what happened. The 300 Bell Ringers give you short questions and teacher answers you can use without preparing a new starter each morning.
Exam trap: A scenario saying “send mail from a mail client” may be testing the submission role rather than raw SMTP relay on 25.
Round 9 • FTP vs SFTP
Similar names, different protocol families
FTPClassic FTP commonly uses TCP 21 for the control connection and separate data behavior.
SFTPSFTP is carried through SSH and is commonly associated with TCP 22.
Do not infer protocol behavior from the letters alone. “SFTP” is not just “FTP plus encryption” on the same port model.
Protocol & Service Lab • 120 Missions
Let students try Protocol Port Matching Game: Match Services, Ports, Transport, and Use Cases for themselves
Reading the explanation is a start. In the browser simulator, students work through a broken network, choose what to test and see whether their fix worked. It gives them another chance to use what they learned about Protocol Port Matching Game: Match Services, Ports, Transport, and Use Cases.
TCP/80 connects
HTTP response: 301 redirect to https://portal.example/
TCP/443 times out
The server is reachable on one web service. The secure-web path differs. DNS has already done enough to reach the hostname, and port 80 success proves only the HTTP-side checkpoint.
Changed fact: If TCP/443 establishes but TLS fails, stop calling it a simple port-blocking problem.
Round 11 • Packet clue
Read source and destination ports correctly
Protocol Exam Practice • Protocol Port Matching Game
Check whether Protocol Port Matching Game: Match Services, Ports, Transport, and Use Cases has really stuck
Once students have worked through this topic, give them questions mixed in with the rest of the course. The Exam Prep Vault includes practice exams, multiple-choice questions and artifact labs so they cannot rely on a chapter heading to tell them what to do.
The service-side clue is destination port 443. The client source port 53184 is ephemeral. Do not conclude the application “uses port 53184” as its well-known service.
Round 12 • Changed-fact challenge
One new fact changes the best answer
Initial clue
Changed fact
Reasoning shift
DNS fails
Direct DNS query now returns expected IP
Move to next dependency
SSH fails
Local listener on TCP 22 exists
Local service is listening; inspect route/firewall/return path
HTTPS times out
TCP/443 handshake now succeeds
Move upward to TLS/application
DHCP fails remotely
Local clients receive leases
Relay/routed boundary becomes stronger
DNS intermittent
UDP/53 works; TCP/53 is denied
Transport-specific filtering becomes strong
Swipe horizontally to practice changed-fact reasoning.
Capstone game
Match the complete scenario, not just the number
Premium Exam-Reasoning Feedback
Spend less time marking explanations about Protocol Port Matching Game: Match Services, Ports, Transport, and Use Cases
When students explain their answer, it takes more than a right-or-wrong check to see what they understand. The Grading Copilot helps you review how they used the clues, where their explanation falls short and what feedback to give next. You make the final grading decision.
A user opens https://portal.example. Match: DNS → port 53; HTTPS → port 443. Then preserve DNS success if the failure occurs later.
Scenario B
An administrator securely logs into a switch. Match: SSH → TCP 22. A Telnet answer is a security and port mismatch.
NEW • COMPLETE 180-DAY TEACHER CURRICULUM
Teach Protocol Port Matching Game: Match Services, Ports, Transport, and Use Cases as part of a planned school year
This page gives you one topic. The 180-Day Teacher Curriculum puts it into a full course plan, with daily teaching notes, student activities and checks for understanding. Use it when you need to know what comes before this lesson and what to teach next.