Overview
If an IP address tells the network which machine to reach, a port tells it which service on that machine to talk to. A single server at one IP address can run a web server, an SSH service, and a database at the same time — ports are what keep those conversations separate. In CTFs, "finding open ports" is almost always the first move after you learn the target's IP, because each open port is a potential door into the box.
This lesson explains what ports are, how they combine with IPs to form sockets, and how port knowledge drives safe, authorized enumeration.
Learning objectives
- Define a port and explain how it multiplexes multiple services on one host.
- Describe the port number ranges (well-known, registered, ephemeral).
- Recall common service ports you will meet in CTFs.
- Explain the difference between open, closed, and filtered ports.
- Connect port enumeration to the recon phase of a challenge.
Core concept
A port is a 16-bit number (0–65535) that identifies a specific communication endpoint on a host. Both TCP and UDP (next lesson) use ports. Together, an IP address + port + protocol form a socket — the fully specified endpoint of a network conversation, e.g. 10.10.10.5:80 (TCP).
Ports let a host multiplex: run many services over the same network interface at once. When a packet arrives, the operating system looks at the destination port to decide which program (which listening service) should receive it. A web server listens on port 80, so packets to 10.10.10.5:80 go to it; an SSH daemon listening on 22 receives packets to 10.10.10.5:22.
Port numbers fall into three ranges defined by IANA:
- Well-known ports (0–1023) — reserved for common, standardized services (HTTP, SSH, DNS, etc.). Binding to them typically requires elevated privilege.
- Registered ports (1024–49151) — assigned to specific applications by registration.
- Dynamic / ephemeral ports (49152–65535) — used temporarily as the source port for outbound client connections.
How it works
When a service starts, it binds to a port and listens for incoming connections or datagrams. A client picks an ephemeral source port and sends to the server's known destination port. The four values — source IP, source port, destination IP, destination port — plus the protocol identify the flow uniquely, so many clients can talk to the same server port simultaneously without confusion.
When you scan, each probed port can be in one of three states:
- Open — a service is listening and accepting connections. This is what you hunt for.
- Closed — nothing is listening; the host actively refuses (e.g. a TCP RST).
- Filtered — a firewall silently drops or blocks the probe, so you get no clear answer. Filtered ports look like silence and require different reasoning.
Some common ports to recognize on sight (defaults, not guarantees):
20/21FTP,22SSH,23Telnet,25SMTP53DNS,80HTTP,110POP3,143IMAP443HTTPS,445SMB,3306MySQL,3389RDP,8080HTTP-alt
Practical example
You have authorized access to a CTF box at 10.10.10.5. Your first recon step is to discover which ports are open. Using a port scanner against the provided target only:
# Illustrative scan output against an authorized CTF target
$ nmap -sV 10.10.10.5
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH (example)
80/tcp open http nginx (example)
443/tcp open https nginx (example)
3306/tcp filtered mysql
Reading this:
- Ports 22, 80, 443 are open — the box exposes SSH and a web server. The web ports are usually where a Jeopardy-style challenge lives, so you would browse to
http://10.10.10.5next. - Port 3306 is filtered — a firewall is blocking your probe. The database might exist but is not reachable from your position; you would not waste time forcing it and instead look at the reachable services.
- Ports not listed responded as closed or were not scanned.
The open web port tells you where to focus. Enumerating ports first, then services, is the disciplined recon workflow — and it stays entirely within the single authorized address.
Cybersecurity relevance
- Enumeration: port scanning is one of the earliest and most important recon activities. The set of open ports defines the box's attack surface — you can only interact with services that are actually listening.
- Service fingerprinting: knowing a port is open leads naturally to identifying the service and version behind it, which shapes the rest of your approach.
- Scope and stealth: scans generate noticeable traffic and must stay within the authorized target list. In real engagements, unauthorized or overly aggressive scanning can be illegal or disruptive; in CTFs, scan only the provided boxes.
- Defense: defenders minimize attack surface by closing unused ports, firewalling services (creating that "filtered" state), and monitoring for scan patterns. Understanding port states is essential to reading both offensive and defensive activity.
Common mistakes
- Assuming a default port means a default service. A web server can run on 8080 or 2222; a scanner reports what is listening, not what "should" be there. Verify with service detection.
- Ignoring filtered ports vs closed ports. Filtered means something is actively blocking you; that is information, not a dead end.
- Scanning only the top few common ports and missing a service on an unusual high port that holds the challenge.
- Confusing source and destination ports. The ephemeral source port your client picks is not the service you are targeting.
- Scanning out-of-scope hosts. Only the provided CTF targets are authorized.
Key takeaways
- A port is a 16-bit number identifying a service endpoint; IP + port + protocol form a socket.
- Ranges: well-known (0–1023), registered (1024–49151), ephemeral (49152–65535).
- Ports can be open (service listening), closed (refused), or filtered (blocked/dropped).
- Open ports define the target's attack surface and drive the recon workflow; scan only authorized targets.
Check your understanding
- Why can one server at a single IP address run a web server, SSH, and a database at the same time?
- What is the practical difference between a "closed" port and a "filtered" port when you are enumerating a target?
- If a scan shows port 8080 open with an HTTP service, why should you not assume the "real" web server is on port 80?