🔌 02-04: Ports, Sockets & Services¶
📌 What Is a Port Number?¶
An IP address gets a packet to the correct device on a network — but a single device can run dozens of network services simultaneously (a web server, an SSH daemon, a mail server, a game client, and more, all at once). A port number is a 16-bit number that identifies which specific application or service on that device a piece of traffic is meant for.
💡 Analogy: if the IP address is the street address of an apartment building, the port number is the specific apartment/unit number. The building (device) can house many tenants (services), and mail (packets) needs both pieces of information to reach the right one.
Because a port number is 16 bits, valid port numbers range from 0 to 65535 (2^16 = 65536 total values).
🔢 Port Number Ranges¶
Port numbers are divided into three ranges, standardized by IANA (the Internet Assigned Numbers Authority):
| Range | Name | Purpose |
|---|---|---|
| 0 – 1023 | Well-Known Ports | Reserved for standard, widely used services (HTTP, SSH, DNS, etc.); on most operating systems, binding to these requires elevated/admin privileges |
| 1024 – 49151 | Registered Ports | Assigned to specific applications by IANA on request, but usable by any unprivileged process |
| 49152 – 65535 | Ephemeral (Dynamic/Private) Ports | Temporary ports the OS assigns automatically to the client side of an outgoing connection |
💡 Ephemeral ports are why your browser can have 30 tabs open to different sites simultaneously — each outgoing connection gets its own randomly assigned source port from this range, so the OS can tell all 30 conversations apart even though they might all be going to port 443 on the destination side.
🧦 What Is a Socket?¶
A socket is the combination that uniquely identifies one specific network conversation:
This 5-tuple (sometimes described more casually as just "IP + port + protocol") is how an operating system's network stack distinguishes between many simultaneous connections that might otherwise look similar. Two connections from the same browser to the same web server, each in their own tab, differ at minimum in their source port — different sockets, tracked completely independently by the OS.
💡 This is also why a single server can handle thousands of simultaneous clients all connecting to the same destination port (e.g., 443) — each client connection has a different source IP and/or source port, so each one is a distinct socket from the server's point of view.
📋 Common Ports Reference Table¶
| Port | Protocol | Service | Security Note |
|---|---|---|---|
| 20 / 21 | TCP | FTP (data / control) | Unencrypted — credentials and files travel in plaintext; prefer SFTP/FTPS |
| 22 | TCP | SSH | Encrypted remote access — but a very common brute-force target; often moved to a non-standard port or protected with key-based auth |
| 23 | TCP | Telnet | Unencrypted remote login — credentials and all traffic sent in plaintext; considered obsolete/insecure, replaced by SSH |
| 25 | TCP | SMTP | Mail relay — historically abused for spam relay if left open/misconfigured |
| 53 | UDP/TCP | DNS | UDP by default (easy to spoof — see 02-06); TCP used for larger responses/zone transfers |
| 67 / 68 | UDP | DHCP | No built-in authentication — vulnerable to rogue DHCP servers handing out malicious configuration |
| 80 | TCP | HTTP | Unencrypted web traffic — content and any submitted data visible to anyone who can sniff it |
| 110 | TCP | POP3 | Unencrypted email retrieval by default; prefer POP3S |
| 143 | TCP | IMAP | Unencrypted email access by default; prefer IMAPS |
| 443 | TCP | HTTPS | Encrypted web traffic (TLS) — the secure default for modern web browsing |
| 445 | TCP | SMB | Windows file sharing — a frequent target for worms and ransomware (e.g., EternalBlue/WannaCry) when exposed to the internet |
| 3389 | TCP | RDP (Remote Desktop Protocol) | A extremely common brute-force and ransomware entry point when exposed directly to the internet without VPN/MFA protection |
💡 The pattern worth noticing: almost every "risky" port on this list is risky either because it transmits data unencrypted (FTP, Telnet, HTTP, POP3, IMAP) or because it exposes a powerful remote-access capability with a history of weak default protections (SSH, RDP, SMB). Knowing this table isn't about memorizing trivia — it's about recognizing why certain ports show up constantly in real breach reports.
🔍 Checking Open Ports and Active Connections¶
On Linux, you can inspect which ports are open and which sockets are active:
# Show listening ports and established connections
ss -tulnp
# Older/alternative tool with similar output
netstat -tulnp
-t→ TCP,-u→ UDP,-l→ listening sockets only,-n→ show numeric ports (skip name resolution),-p→ show the owning process
💡 Running this on any internet-facing server is a good habit — if you see a listening port you don't recognize or can't explain, that's exactly the kind of unnecessary attack surface discussed in 01-01: What Is Network Security? that should be closed.
🧩 Why Ports Matter for Security¶
- Firewalls filter primarily on ports. A basic firewall rule like "allow inbound TCP 443, deny everything else" is one of the most fundamental network security controls that exists (see Module 05).
- Port scanning is usually the very first step of any network attack — an attacker probes a range of ports to discover which services are running and might be exploitable.
- Unnecessary open ports are pure liability. Every open port is a live piece of software listening for input — if that software has a bug, an open port is how an attacker reaches it. Closing unused ports is one of the highest-value, lowest-cost security actions available.
📌 Key Takeaways¶
- A port number (0–65535) identifies which specific service on a device a packet is meant for; an IP address alone isn't enough.
- Ports fall into three ranges: well-known (0–1023), registered (1024–49151), and ephemeral (49152–65535, used for outgoing client connections).
- A socket is the full 5-tuple — protocol, source IP, source port, destination IP, destination port — that uniquely identifies one network conversation.
- Many classic "risky" ports are risky because they carry unencrypted traffic (Telnet, FTP, HTTP) or expose powerful remote access with a history of weak defaults (SSH, RDP, SMB).
- Tools like
ssandnetstatlet you audit which ports are actually listening on a system — an essential habit for reducing attack surface. - Port scanning is typically the reconnaissance step of an attack; firewalls that filter by port are one of the most basic and effective defenses against it.