Ports and Network Connections: Delivering Traffic to the Right Application

One server address can host a website, accept secure administration, receive email, and answer database connections at the same time.

The IP address gets packets to a host interface. The transport layer needs another identifier for the correct application endpoint.

A network port is a 16-bit number used by transport protocols such as TCP and UDP to identify communication endpoints.

Ports are logical numbers, not physical sockets on the computer case.

Port number range

TCP and UDP port fields contain 16 bits:

0 through 65535

Port ranges are commonly described as:

• Well-known: 0–1023
• Registered: 1024–49151
• Dynamic/private: 49152–65535

Operating systems use their own ephemeral-port range policies, which can differ.

Common service defaults include:

HTTP      TCP 80
HTTPS     TCP 443
SSH       TCP 22
DNS       UDP/TCP 53

These are conventions. A web server can listen on TCP 8080, and a program on port 443 is not automatically trustworthy or even necessarily HTTPS.

Sockets

A socket is an operating-system abstraction for a communication endpoint.

An application asks the OS to:

1. Create a socket.
2. Choose TCP or UDP.
3. Bind it to a local address and port.
4. Listen, connect, send, or receive.

The kernel tracks sockets and directs incoming transport data to the matching endpoint.

Permissions may restrict binding to low-numbered ports.

Listening services

A server binds a socket and listens.

For example:

0.0.0.0:443

can mean TCP port 443 on all IPv4 interfaces, depending on the API.

127.0.0.1:3000

means the service listens only on local IPv4 loopback and is not directly reachable from other machines.

The bind address is therefore a security and accessibility decision.

Client ephemeral ports

When a browser connects to a web server, the operating system selects a temporary ephemeral port for the client side.

Example:

client 192.168.1.42:53124
server 203.0.113.10:443

The server's port identifies the HTTPS service. The client's temporary port distinguishes this connection from others.

Opening another connection might use:

192.168.1.42:53125

The client does not normally use port 443 locally merely because the destination uses 443.

The connection tuple

A TCP connection is identified by protocol and endpoint pairs:

source IP
source port
destination IP
destination port
protocol

This allows one server port to handle thousands of clients simultaneously.

Each accepted connection has a distinct tuple even though all target the same listening port.

The operating system directs arriving segments to the correct connection state.

A concrete web connection

Suppose a browser opens https://example.com.

1. DNS resolves the server address.
2. The browser requests a TCP connection.
3. The OS chooses local port 53124.
4. TCP performs a handshake with server port 443.
5. TLS establishes encryption and authenticates the server.
6. HTTP requests travel inside the protected connection.
7. The kernel matches replies to the socket using endpoint information.

Port 443 only identifies the expected service endpoint. TLS provides the cryptographic identity and protection.

TCP ports and UDP ports are separate

TCP port 53 and UDP port 53 are distinct endpoints because transport protocol is part of the identity.

TCP is connection-oriented and maintains ordered reliable byte streams.

UDP sends independent datagrams without establishing TCP-style connection state.

An application can use the same number with both protocols for different or related purposes.

Firewall rules must specify protocol as well as port.

Port forwarding and NAT

A home router can forward an inbound public port to a private service:

public-address:8443
        ↓
192.168.1.50:443

The router rewrites destination information and tracks the translation.

This exposes the internal service to internet traffic. It should be:

• Necessary
• Patched
• Authenticated
• Encrypted
• Restricted where possible

Automatic port mapping protocols can let applications request forwarding. Disable or control them where the risk outweighs convenience.

Firewalls

A firewall evaluates traffic based on fields and state:

• Source and destination address
• Source and destination port
• Protocol
• Connection state
• Interface
• Application identity

A stateful firewall can allow replies to outbound connections while blocking unsolicited inbound attempts.

"Open port" can mean:

• A service is listening.
• A firewall permits traffic.
• A remote scanner successfully reached and received a response.

Clarify which meaning is intended.

Port scanning

A scanner sends probes to port numbers and observes responses.

Results may be described as:

• Open: a service responds
• Closed: host responds but no listener exists
• Filtered: firewall or path prevents a clear response

Scanning systems without authorization can violate policy or law.

Defenders use authorized scanning to find unexpected exposed services.

Changing a service to an unusual port can reduce random noise but does not replace authentication and patching.

Port conflicts

Two processes generally cannot listen on the same address, port, and protocol combination without specific sharing behavior.

If an application says "address already in use":

• Another process may be listening.
• A previous instance may still run.
• The service may be bound to all interfaces.
• A socket may be in a transitional state.

Diagnostic tools can list listeners and owning processes.

Choose another port or stop/reconfigure the conflict rather than killing unrelated processes blindly.

Proxies and load balancers

A public service may listen on one address and port while forwarding requests to many internal servers.

A reverse proxy or load balancer can:

• Terminate TLS
• Route by hostname or path
• Balance requests
• Apply security policy
• Hide backend ports

The client sees the proxy endpoint. Internal services may use different addresses and ports.

This is why the public port does not reveal the complete application architecture.

Common misunderstandings

"A port is a physical connector"

In networking, it is a numerical transport endpoint.

"Port 443 guarantees a secure website"

It is the conventional HTTPS port. Security depends on a valid TLS connection and trustworthy application.

"One port can serve only one user"

A listening TCP port can accept many simultaneous connections distinguished by their endpoint tuples.

"Changing the port makes a vulnerable service secure"

It may reduce casual discovery but does not fix vulnerabilities or weak authentication.

Knowledge check

The one idea to remember

IP routing reaches a host; transport ports and sockets direct communication to the correct application conversation.

A connection is identified by protocol and endpoint pairs, while listeners, firewalls, NAT, and proxies decide how those endpoints become reachable.

Next, the series moves up the stack to DNS, which maps human-friendly names to network information.