What Are Network Ports?

What Are Network Ports?

A network port is a numbered logical endpoint that identifies a specific service or application running on a networked device. It is a 16-bit number, from 0 to 65535, that the transport layer reads to deliver incoming data to the right service on a device that runs many services at once. The defining traits of a network port are below:

• A 16-bit number ranges from 0 to 65535, giving 65536 possible ports for each transport protocol.
• A logical endpoint, not a physical connector, identifies a service rather than a piece of hardware.
• One IP address can host many services at once, each listening on its own distinct port.
• The transport layer reads the port number to deliver each packet to the correct application.

A network port operates at the transport layer of the suite described in the overview of TCP/IP, where TCP and UDP carry the port numbers. The port number is what lets a single device tell one network protocol from another, so a web request and an email both reach the right program.

How Do Ports Work With IP Addresses?

A port works with an IP address to form a socket, where the IP address identifies the device and the port number identifies the service on that device. An IP address alone reaches a device, but the port number specifies which application receives the data once it arrives. The relationship is below:

• The IP address finds the device. Routing carries the packet across the network to the right machine, but not yet to any program on it.
• The port finds the service. Once the packet arrives, the destination port number tells the device which listening application should receive it.
• Together they form a socket. The pair is written as address:port, for example 192.0.2.10:443, naming one exact endpoint.
• Two sockets make a connection. A link joins a socket on each device, so two services can exchange data in both directions.

A socket such as 192.0.2.10:443 names both the device and the service, so the machine hands the data to the web server listening on port 443. This split is why the same public IP address can serve a website, accept email, and answer a remote login at the same time without the requests colliding.

What Are the Port Number Ranges?

Port numbers divide into three ranges: well-known ports from 0 to 1023, registered ports from 1024 to 49151, and dynamic ports from 49152 to 65535. IANA assigns the lower two ranges and leaves the highest range for temporary connections. The three ranges, defined in RFC 6335, are below:

A server listens on a well-known or registered port, while a client opens a temporary dynamic port for the outgoing side of each connection. So when your browser loads a page, the server answers on port 443, but your own end uses a short-lived ephemeral port that the system reclaims as soon as the page finishes loading.

What Are the Common Port Numbers?

Common port numbers include 80 for HTTP, 443 for HTTPS, 22 for SSH, 53 for DNS, 25 for SMTP, and 3389 for RDP, each assigned to a standard service by IANA. A standard service listens on a fixed port so clients reach it without configuration. The most common port numbers are below:

• Port 80 carries Hypertext Transfer Protocol (HTTP) traffic for unencrypted web pages.
• Port 443 carries HTTPS, the encrypted form of HTTP secured by TLS, and now QUIC for HTTP/3.
• Port 22 carries Secure Shell (SSH) for encrypted remote command-line access.
• Port 53 carries Domain Name System (DNS) queries that resolve names into IP addresses.
• Port 25 carries Simple Mail Transfer Protocol (SMTP) traffic for sending email between servers.
• Port 3389 carries Remote Desktop Protocol (RDP) for remote graphical access to Windows.

Each common port maps to one protocol, so a firewall or an administrator can identify a service by its port number alone. These assignments stay consistent across operating systems, which is why any client reaches the matching service on any server without being told the port in advance.

Common Network Ports Table

The table lists the most common ports with their protocol, service, and transport. Note that HTTPS on port 443 now runs over UDP as well as TCP, because HTTP/3 uses the QUIC protocol:

How Do TCP Ports Differ From UDP Ports?

TCP ports and UDP ports use the same numbering range but belong to separate protocols, so port 53 on TCP and port 53 on UDP are two different endpoints. A port number is meaningful only together with its transport protocol, because TCP and UDP keep independent port spaces. The differences are below:

• TCP ports serve connection-oriented services that confirm delivery, such as HTTP, HTTPS, and SSH.
• UDP ports serve connectionless services that favor speed, such as DNS queries, DHCP, and live video.
• The same number can be open on TCP and UDP at once, identifying two distinct endpoints.
• Some services use both transports: DNS uses UDP 53 for most queries and TCP 53 for large transfers.

DNS using UDP port 53 for most lookups and TCP port 53 for larger transfers shows how one number serves two protocols. The reliable and fast transports behind these ports are explained in the overview of TCP/IP, where TCP and UDP both operate at the transport layer.

How Do Ports Relate to Firewalls and Port Forwarding?

Firewalls allow or block traffic by port number, and port forwarding sends traffic that arrives on a router port to a specific device and port on the internal network. A firewall uses ports to control which services accept connections, while port forwarding routes an external request to an internal service. The roles are below:

• A firewall rule permits or denies traffic based on the destination port number.
• An open port accepts incoming connections for the service that listens on it.
• A closed port rejects connections, hiding any service that might run behind it.
• Port forwarding maps a router port to an internal device and port so an external client can reach it.

Port forwarding lets a service on a private network accept connections from the internet. The router applies the address translation in the overview of NAT as it forwards traffic from its public port to the internal device, since the internal device has a private address the internet cannot reach directly.

Why Do Open Ports Matter for Security?

Every open port is a possible door into a system, so the fewer that are open to the internet, the smaller the attack surface. An open port itself is not a flaw, but the service behind it can be, and attackers scan for open ports to find a way in. The security points are below:

Administrators check which ports are open with tools such as netstat, ss, and nmap, which list the ports a device listens on or scan a device for reachable ports. A scan reports each port as open, closed, or filtered, which shows whether a firewall blocks the port before any service can answer.

Last Thoughts on Network Ports

A network port is the numbered logical endpoint that directs traffic to the correct service on a device, letting one IP address host many services at once. The port pairs with the IP address to form a socket, where the IP finds the device and the port finds the service, and the three ranges of well-known, registered, and dynamic ports separate standard services from temporary connections. Common ports such as 80, 443, 22, 53, 25, and 3389 carry the most used services, and TCP and UDP keep separate port spaces, which is why port 443 can now run over both as HTTP/3 adopts QUIC.

Ports are one layer of how data finds its destination, sitting above addressing and routing. The hub on what a computer network is connects ports to the wider set of pieces that move data from one machine to another.

Key Takeaways:

• A network port is a 16-bit number (0 to 65535) that identifies a service on a device, giving 65536 ports per protocol.
• A port and an IP address form a socket: the IP finds the device, the port finds the service.
• The three ranges are well-known (0 to 1023), registered (1024 to 49151), and dynamic (49152 to 65535).
• Common ports include 80 (HTTP), 443 (HTTPS), 22 (SSH), 53 (DNS), 25 (SMTP), and 3389 (RDP).
• TCP and UDP keep separate port spaces, so the same number is a different endpoint on each.
• Firewalls and port forwarding use port numbers to control and direct traffic, and every open port adds to the attack surface.

Frequently Asked Questions (FAQs)