Overview
A single host runs many network programs at once — a web browser, an email client, a file sync tool — all sharing one IP address. Ports are the mechanism that lets a host keep those conversations separate, directing each incoming segment to the right application. This lesson explains what ports are and how they identify a service.
Learning objectives
- Define a port and its role in transport-layer addressing.
- Distinguish well-known, registered, and dynamic port ranges.
- Explain the concept of a socket (IP + port).
Core concept
A port is a 16-bit number (0–65535) that identifies a specific application or service endpoint on a host. Where an IP address gets a packet to the right machine, the port gets it to the right program on that machine. Both TCP and UDP use ports.
Port numbers fall into three ranges:
- Well-known ports (0–1023) — assigned to common services (e.g. 80 for HTTP, 443 for HTTPS, 22 for SSH, 53 for DNS).
- Registered ports (1024–49151) — used by specific applications and vendors.
- Dynamic / ephemeral ports (49152–65535) — assigned temporarily to client connections.
How it works
When a client connects to a server, it targets the server's destination port (e.g. 443 for a website) and uses a temporary source port of its own so replies can find their way back. The combination of an IP address and a port is called a socket (e.g. 93.184.216.34:443). A connection is uniquely identified by the pair of sockets at each end plus the protocol, which is how a server can hold thousands of simultaneous conversations on the same port.
Practical example
When you open https://example.com, your browser picks an unused ephemeral port (say 51200) as its source and connects to the server's port 443. The server sees traffic arriving on 443 and hands it to its web service; replies go back to your IP on port 51200, where your browser is listening. Two browser tabs get two different source ports, keeping the two page loads separate.
Cybersecurity relevance
Ports are central to reconnaissance and defense. Port scanning probes which ports are open to discover what services a host runs — a standard first step in both authorized penetration testing and attacker recon. Defenders close or firewall unused ports to reduce the attack surface, since every open port is a potential entry point. Knowing which service conventionally uses which port lets an analyst quickly interpret scan results and traffic.
Common mistakes
- Confusing ports with IP addresses — the IP identifies the host, the port identifies the service on it.
- Assuming a service always uses its default port — services can be moved to non-standard ports.
- Forgetting the source port — clients also use a (temporary) port, not just servers.
Key takeaways
- A port is a 16-bit number that identifies a specific service or application on a host.
- Ranges: well-known (0–1023), registered (1024–49151), dynamic/ephemeral (49152–65535).
- An IP address plus a port is a socket; a connection is identified by both endpoints' sockets and the protocol.
Check your understanding
- What does a port identify that an IP address does not?
- Which port range is used for temporary client-side connection endpoints, and why are they temporary?