Ports & Sockets

Networking Fundamentals

Chapter 8 · Ports & Sockets

net1-7 covered TCP and UDP as the two ways to structure communication. This chapter answers a question left open since net1-1: how does one single IP address handle many different applications, and many simultaneous connections, all at once? Ports are the mechanism.

What a Port Actually Is

A port is a 16-bit number, 0 through 65535, that — combined with an IP address — identifies a specific endpoint for a specific connection on a device. It isn't a physical thing; it's a purely logical addressing concept the operating system's own networking stack manages.

The real addressable unit is a socket: IP address + port + protocol (TCP or UDP), together. 192.168.1.42:443 (TCP) is a distinct socket from 192.168.1.42:80 (TCP), which is distinct again from 192.168.1.42:53 (UDP).

Well-Known Ports — Formally Defining What's Been Used Unexplained

Ports 0–1023 are "well-known," assigned by IANA to specific standard services. This is the formal answer net1-1 promised for terms used without explanation across several site courses:

Port	Protocol	Service	Used unexplained in
22	TCP	SSH	ssh1
25	TCP	SMTP	—
53	TCP/UDP	DNS	host1, net1-9
80	TCP	HTTP	host1
443	TCP	HTTPS	https1

Ephemeral Ports — The Other Half of Every Connection

Every connection has two ports, not one: the well-known port on the server side (e.g. 443), and a temporary, dynamically assigned ephemeral port on the client side — typically somewhere in the 49152–65535 range.

This is the actual mechanism behind "how does one IP serve many simultaneous connections": a client can have many simultaneous connections to the same server on the same well-known port — many browser tabs all hitting the same website on port 443 — because each connection uses a different ephemeral port on the client side, making every full pairing unique even though the server-side port never changes.

The Full Picture — A Socket Pair

A single TCP connection is uniquely identified by four values together: source IP, source port, destination IP, and destination port. This four-value combination — not any single one of them — is what distinguishes one connection from every other connection happening at the same moment, even between the exact same two machines.

# Two browser tabs, same laptop, same website — two distinct connections
Tab 1: 192.168.1.42:51000  →  203.0.113.10:443
Tab 2: 192.168.1.42:51001  →  203.0.113.10:443

Identical source IP, identical destination IP, identical destination port — but two genuinely distinct connections, because the ephemeral source port differs.

Ports and Firewalls

A firewall rule like "allow inbound on port 22" is specifically about which well-known, listening ports are allowed to accept new incoming connections. It generally doesn't need to, and shouldn't try to, restrict ephemeral/outbound ports individually — those are dynamically assigned per-connection and would be impractical to enumerate ahead of time.

Range	Name	Typical use
0–1023	Well-known	Standard services (SSH, HTTP, HTTPS, DNS)
1024–49151	Registered	Application-specific services (e.g. 3306 MySQL)
49152–65535	Ephemeral / dynamic	Temporary client-side ports, one per outgoing connection

Seeing real listening ports and their owners

ss -tulpn on Linux shows every port actively listening for connections, and which process owns it — a direct, practical view of the sockets this chapter describes. net1-10 covers this alongside other diagnostic tools.

The same port number can mean two different things at once

TCP and UDP each maintain their own completely independent port space — DNS genuinely uses port 53 for both TCP and UDP simultaneously, and they don't conflict, because protocol is part of a socket's own identity, per this chapter's own definition. Seeing "port 53" alone doesn't tell you which protocol is meant — a genuinely common point of confusion.

Hands-On Exercises

Exercise 1

A laptop opens three separate SSH sessions to the same server. Using this chapter's own four-value model, explain how the server tells these three connections apart, given that the destination IP and destination port are identical for all three.

📄 View solution

Exercise 2

A junior admin proposes a firewall rule blocking all outbound traffic except from a specific hardcoded list of source ports, believing this improves security. Using this chapter's own ephemeral-port material, explain why this approach doesn't make practical sense.

📄 View solution

Exercise 3

A colleague says "port 53 is open" without specifying TCP or UDP, and assumes this is a complete statement. Using this chapter's own warn-box, explain what's actually still ambiguous about that claim.

📄 View solution

Chapter 8 Quick Reference

A port is a 16-bit number (0-65535); a socket is IP + port + protocol combined
Well-known ports (0-1023): SSH=22, SMTP=25, DNS=53, HTTP=80, HTTPS=443
Ephemeral ports (typically 49152-65535): temporary, client-side, one per outgoing connection
A connection's real identity is the full 4-tuple: source IP, source port, destination IP, destination port
Firewalls typically restrict inbound listening ports, not outbound ephemeral ports
TCP and UDP maintain entirely separate port spaces — the same number can mean two different things