When client-server connection is established, client connects to these four server ports. The port on the client side is not prescribed, it could be dynamic. For example 7110 phone's port 49998 connects to 9200 port of NACS. Or 6310 phone's port 6855 connects to port 9201 (exact phone's ports are just examples here)
If you have NACS installed, you can turn log level to maximum (Debug-7) and check error.log and access.log for server core - they reveal from wich phone ports to wich server port connection established.