CompTIA Security+ Get Certified Get Ahead: SY0-501 Study Guide

by Darril Gibson

Ports and protocol numbers are not the same thing, though they are often confused. Well-known ports identify many services or protocols, as discussed previously. However, many protocols aren’t identified by the port, but instead by the protocol numbers. For example, within IPsec, protocol number 50 indicates the packet is an Encapsulating Security Payload (ESP) packet, and protocol number 51 indicates it’s an Authentication Header (AH) packet. Similarly, ICMP has a protocol number of 1, TCP is 6, and UDP is 17. You can use a protocol number to block or allow traffic on routers and firewalls just as you can block or allow traffic based on the port. Note that it is not accurate to say that you can allow IPsec ESP traffic by opening port 50. IANA lists port 50 as a Remote Mail Checking Protocol. However, you can allow IPsec traffic by allowing traffic using protocol number 50. Protocol analyzers can capture and examine IP headers to determine the protocol number and the port, as well as read any unencrypted data. Note that you might see the protocol number listed as the protocol ID or a protocol identifier.