An IP address finds the device. A port finds the program on that device.
A port is a number from 0 to 65535. Every program that uses the network listens on a port.
A service is a program that waits for requests. For example, a web server is a service. It listens on a port and answers when someone connects.
๐ Ports work at the Transport Layer.
Simple meaning:
Your laptop ---> 93.184.216.34 : 443
(IP address) (port)
which device which program
Think of a big apartment building.
Building address = IP address
Apartment number = Port
Person inside = Service (program)
Delivery = Your data
The building address alone is not enough. The delivery person also needs the apartment number.
One device runs many network programs at the same time: a browser, email, a game, a remote login.
Without ports, the device would not know which program should get each packet.
The port number is the label that says: "This data is for the web server, not for email."
| Range | Name | Used for |
|---|---|---|
| 0 to 1023 | Well-known ports | Standard services (web, email, SSH) |
| 1024 to 49151 | Registered ports | Apps and databases |
| 49152 to 65535 | Dynamic ports | Temporary, picked by your device |
When you open a website, your device picks a random dynamic port for itself. The website's side uses 443.
| Port | Service | What it does |
|---|---|---|
| 20, 21 | FTP | Transfers files (not secure) |
| 22 | SSH | Secure remote login |
| 23 | Telnet | Remote login (not secure, avoid) |
| 25 | SMTP | Sends email |
| 53 | DNS | Turns names into IP addresses |
| 67, 68 | DHCP | Gives devices their IP address |
| 80 | HTTP | Websites (not encrypted) |
| 110 | POP3 | Downloads email |
| 143 | IMAP | Reads email on the server |
| 443 | HTTPS | Secure websites |
| 3306 | MySQL | Database |
| 3389 | RDP | Windows remote desktop |
๐ก These are standards, not laws. A service can be moved to another port, but most people keep the default.
| TCP | UDP | |
|---|---|---|
| Style | Reliable, checks delivery | Fast, no delivery check |
| Example | Web (443), SSH (22) | DNS (53), video calls |
Port 80 over TCP and port 80 over UDP are two different doors.
A port that is listening is open and waiting for connections.
Open Command Prompt and run:
netstat -ano
Expected output (sample, yours will differ):
Proto Local Address Foreign Address State PID
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 1048
TCP 192.168.1.10:50123 142.250.77.14:443 ESTABLISHED 8820
LISTENING = the port is open and waitingESTABLISHED = an active connectionPID = the ID of the program using itOpen Terminal and run:
ss -tuln
What the letters mean: t = TCP, u = UDP, l = listening only, n = show numbers.
Expected output (sample, yours will differ):
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
udp UNCONN 0 0 127.0.0.53%lo:53 0.0.0.0:*
Test-NetConnection google.com -Port 443
Expected output (sample):
ComputerName : google.com
RemotePort : 443
TcpTestSucceeded : True
True means the port is open and reachable.
nc -zv google.com 443
Expected output (sample):
Connection to google.com 443 port [tcp/https] succeeded!
If nc is missing, install it with sudo apt install netcat-openbsd.
| Error / Symptom | Cause | Fix |
|---|---|---|
Connection refused |
Nothing is listening on that port | Start the service, or check the port number |
TcpTestSucceeded : False or timeout |
Port is closed or a firewall is blocking it | Check the firewall rules and the service |
Address already in use |
Another program already uses that port | Find it with netstat -ano or ss -tuln, then stop it or pick another port |
nc: command not found |
netcat is not installed | Run sudo apt install netcat-openbsd |
| Thinking port 80 is always a website | Ports are only a convention | Check what is actually running on it |
Every open port is a possible way in for an attacker.
Close the ports you do not use. Fewer open ports means a smaller attack surface (the number of ways someone could attack you).
- IP address finds the device, port finds the program
- Ports are numbers from 0 to 65535
- 0-1023 well-known, 1024-49151 registered, 49152-65535 dynamic
- Common ports: 22 SSH, 53 DNS, 80 HTTP, 443 HTTPS, 3306 MySQL
- LISTENING = open and waiting for connections
- Windows: netstat -ano | Linux: ss -tuln
- Test a port: Test-NetConnection (Windows) | nc -zv (Linux)
- Best practice: close ports you do not use
NAT and Port Forwarding: how traffic from the internet reaches one device inside your home network.
TechWithJuned ยท Learn โ Execute โ Build
๐ฌ Questions & Discussion
Have a doubt? Ask below โ no login needed.
Loading comments...