TCP port 990 is associated with the control channel for implicit FTPS.
A port is a transport layer number used together with an IP address and a protocol such as TCP or UDP to direct traffic to the correct service on a host.
A server process binds a socket to a port and listens, while a client typically chooses an ephemeral source port for outbound connections.
The combination of source and destination IP addresses, source and destination ports, and the transport protocol uniquely identifies a flow so the operating system can keep many conversations separate.
Firewalls, NAT, and scanners talk about ports because the destination port is the stable rendezvous point that exposes a service to the network.
With implicit FTPS, a server listens on 990 and the client expects to start a TLS handshake immediately after the TCP connection is established.
Once the secure tunnel is up, the client authenticates and sends FTP control commands inside the encrypted channel.
File contents and directory listings still travel over separate data connections, often using configured passive ranges rather than a single fixed port.
Because this two channel behavior is easy to misconfigure, many teams prefer SFTP or HTTPS based transfer flows.
If 990 is exposed, treat it like any internet facing authentication service: it can be brute forced, it needs strong TLS and account hygiene, and it should be restricted to known partners where possible.