Overview
A single host runs many network programs at once — a browser, email, file sync — all sharing one network connection. Ports are how a host keeps these conversations separate and directs incoming data to the right program. They are also central to how services are exposed and scanned.
Learning objectives
- Define a port and its purpose.
- Explain how ports identify services.
- Recognize well-known ports and their security relevance.
Core concept
A port is a numbered channel (0–65535) that identifies a specific application or service on a host. If an IP address is like a building's street address, a port is like the apartment number that gets the data to the right resident. Combined, an IP address + port uniquely identifies one endpoint of a connection.
Many services use standardized well-known ports so clients know where to connect:
- 80 — HTTP (web)
- 443 — HTTPS (secure web)
- 22 — SSH (secure remote access)
- 53 — DNS
- 25 — SMTP (email sending)
How it works
A server listens on a specific port for incoming connections (a web server on 443, for example). A client connecting to that service directs its packets to the server's IP address and that port. The server's operating system then hands the data to whichever program is listening there. This lets one host offer many services simultaneously, each on its own port, without confusion.
Practical example
A single server can run a website (listening on port 443), accept administrative logins (port 22 for SSH), and answer DNS queries (port 53) all at once. Incoming packets are sorted by destination port to the right service. If the admin closes SSH's port 22 to the internet, that service is no longer reachable externally — even though the website on 443 stays available.
Cybersecurity relevance
Ports define much of a host's attack surface: an open port with a listening service is a potential entry point. Port scanning — checking which ports are open — is one of the first things both attackers and penetration testers do during reconnaissance, and closing unneeded ports is a core hardening step (attack-surface reduction from the fundamentals path).
Common mistakes
- Confusing ports with IP addresses — the IP finds the host, the port finds the service on it.
- Leaving unneeded ports open, needlessly enlarging the attack surface.
- Assuming a "well-known" port always runs its usual service — services can be configured on non-standard ports.
Key takeaways
- A port is a numbered channel that identifies a specific service on a host; IP + port identifies an endpoint.
- Servers listen on ports (e.g. 80/443 web, 22 SSH, 53 DNS) so one host can offer many services.
- Open ports are attack surface; port scanning is a core recon activity and closing unused ports is basic hardening.
Check your understanding
- Using the address analogy, explain the difference between an IP address and a port.
- Why is an open port with a listening service considered part of a host's attack surface?