Unit

TCP and UDP Ports: How Network Services Use Port Numbers

Learn how TCP and UDP ports identify network services, how client-server connections use source and destination ports, and how to inspect, test, and secure ports.

An IP address identifies a host or network interface. A port identifies a transport-layer communication endpoint for an application or service on that host. Together, IP addresses and ports let many services use the same network interface without confusing their traffic.

For example, one server might use TCP port 22 for SSH, TCP port 443 for HTTPS, and UDP port 53 for DNS. The services can share one IP address because each service uses a different protocol-and-port combination.

What Is a Port?

A port is a numbered transport-layer endpoint used to direct traffic to an application or service. Port numbers are not physical connectors and they do not identify computers. The IP address identifies the host or interface; the port helps the operating system deliver received traffic to the correct process.

Ports make multiplexing possible. Multiplexing means combining traffic for multiple applications over the same network connection or interface. A web browser, mail client, and remote administration tool can all communicate through one computer's IP address because their flows use distinct transport endpoints.

Sockets

A socket is a communication endpoint commonly represented by an IP address, a transport protocol, and a port number. For example, 192.0.2.10, TCP, 443 describes a TCP endpoint on port 443. In programming, the word socket can also refer to the operating-system object an application uses to send and receive network data.

A complete TCP communication flow is commonly identified by five values:

• Transport protocol, such as TCP
• Source IP address
• Source port
• Destination IP address
• Destination port

This combination is often called a five-tuple. TCP and UDP have separate port namespaces, so TCP port 53 and UDP port 53 are different endpoints.

TCP and UDP

TCP means Transmission Control Protocol. It is connection-oriented: endpoints establish a logical connection before exchanging application data. TCP provides reliable, ordered delivery by tracking sequence numbers, acknowledgments, retransmissions, and other control information.

UDP means User Datagram Protocol. It is connectionless and sends independent datagrams with less protocol overhead. UDP does not, by itself, guarantee delivery, ordering, duplicate suppression, or retransmission. An application can add its own reliability features when needed.

TCP and UDP are both transport-layer protocols, but choosing a port does not choose the protocol. A firewall rule or test must normally specify both the port and whether traffic uses TCP or UDP.

Port Number Format and Ranges

A port number is an unsigned 16-bit value. The valid range is 0 through 65535. Port 0 is reserved and is not normally used as a service endpoint.

These ranges describe common conventions, not an enforcement mechanism. An administrator can configure a service to use a different port, and software can sometimes use ports outside the range normally associated with it.

Server Ports and Client Ports

A server usually listens on a known destination port. A client normally receives a temporary ephemeral port as its source port. The operating system chooses an available ephemeral port for the client application.

For example, a browser might connect as follows:

Client: 192.0.2.25:51544
Server: 198.51.100.20:443
Protocol: TCP

The browser's source port is 51544 in this example, while the server's HTTPS destination port is 443. The response reverses the directions: it travels from server port 443 to client port 51544.

Why One Server Port Supports Many Clients

Many clients can connect to the same server port at the same time. Their source IP addresses, source ports, or both are different, so each flow has a different five-tuple. A web server can therefore accept thousands of TCP connections on destination port 443 without requiring a separate listening port for every client.

Common TCP and UDP Service Ports

The following assignments are conventional defaults. They help administrators recognize traffic, but a port number alone does not prove which protocol or application is running. Always verify the service configuration when accuracy matters.

TCP-only examples in this table include HTTP and SSH. UDP-only examples include NTP and typical DHCP traffic. DNS and RDP demonstrate that an application can use both transport protocols, with TCP and UDP ports remaining separate.

Listening Ports and Local Services

A listening port is a local protocol-and-port endpoint on which a service waits for incoming traffic. A listening socket is not the same as an established connection. A web server can listen on TCP 443 even when no client is currently connected; each accepted client then appears as a separate established connection.

A service can bind to a specific local IP address or to all local interfaces. Binding to 127.0.0.1, for example, makes a service reachable only from the local host over IPv4 loopback. Binding to a server's LAN address limits access to that interface. Binding to all interfaces, often represented by 0.0.0.0 for IPv4, may expose the service through every available IPv4 interface, subject to firewall rules.

Only one compatible process can normally bind to the same protocol, local IP address, and port combination. Two services cannot ordinarily both listen on TCP port 443 on the same address. Some operating-system features allow controlled sharing, but this is not the normal case.

Inspecting Local Sockets

Use local inspection tools to identify listening ports, active connections, and the processes that own them. Run commands with appropriate privileges when process details are restricted.

# Windows
netstat -ano

# Windows PowerShell: TCP listeners
Get-NetTCPConnection -State Listen

# Linux: listening TCP and UDP sockets, numeric output
ss -tuln

# Linux: processes associated with network sockets
sudo lsof -i -P -n

• LISTEN generally indicates a TCP service waiting for incoming connections.
• UDP does not have a TCP-style connection state, but a UDP socket can still be bound to a local port.
• An active or established entry indicates an ongoing communication flow, not merely an available service port.

Ports in Client-Server Communication

When a client starts communication, it sends a packet or segment with a source port and destination port. The source port identifies the client's local application endpoint. The destination port identifies the service the client wants to reach.

For a DNS lookup, a client might send a UDP datagram from an ephemeral source port to UDP port 53 on a DNS server. The response normally returns from UDP port 53 to the client's original ephemeral port. DNS can also use TCP port 53 when a response is too large for the usual exchange or when performing a zone transfer.

For web browsing, the browser commonly selects a temporary TCP source port and connects to a web server's TCP port 443 for HTTPS. The server distinguishes that session from other browser sessions by the complete endpoint tuple.

Firewalls, NAT, and Port Forwarding

A firewall rule is a policy that permits or denies traffic based on criteria such as source address, destination address, direction, protocol, and port. A rule allowing TCP destination port 443 does not automatically allow UDP port 443.

• Inbound rules control traffic entering a host or network.
• Outbound rules control traffic leaving a host or network.
• A rule may allow, block, reject, or silently drop traffic depending on the firewall's behavior.

# Example UFW rule: allow inbound HTTPS
sudo ufw allow 443/tcp

At a policy level, a more restrictive rule might be expressed as:

Allow TCP destination port 443 from approved source networks

NAT, or Network Address Translation, changes address and sometimes port information as traffic crosses a router or firewall. A private internal host can use a private IP address while the router represents it externally with a public address.

Port forwarding is a NAT rule that sends traffic arriving at an external address and port to an internal host and port. For example, a router could forward external TCP port 443 to an internal web server at TCP port 443. The forwarding rule must be supported by the firewall policy, and the internal server must actually be listening.

Expose as few listening services as practical. Restrict source networks where possible, keep services patched, authenticate users, and prefer encrypted protocols such as HTTPS and SSH rather than unencrypted alternatives when appropriate.

Testing Port Connectivity

A connection test or port scan can indicate whether a reachable host appears to accept traffic on a specified port. Testing a port is not the same as proving that the intended application is healthy or that authentication will succeed.

• Open: a service appears to be accepting traffic on the tested protocol and port.
• Closed: the host is reachable, but no service appears to be accepting that port.
• Refused: the destination or a firewall actively rejects the connection, often producing an immediate error.
• Filtered: a firewall or filtering device prevents a clear determination.
• Timed out: no response arrived within the test period; filtering, routing failure, NAT problems, or an unreachable host may be responsible.

# Cross-platform where available: basic TCP test
nc -vz server.example 443

# Windows PowerShell: test TCP reachability
Test-NetConnection server.example -Port 443

Use scans and connection tests only on systems and networks you are authorized to assess. A successful TCP test does not test UDP behavior, and a failed UDP test can be difficult to interpret because UDP services may not respond to every probe.

Troubleshooting Port Problems

Connection Is Refused Immediately

• No service is listening on the destination protocol and port.
• The service is bound only to a different local interface.
• A host firewall is actively rejecting the traffic.

Inspect local listening sockets, confirm the service configuration and target IP address, and verify that the client is using the correct protocol, such as TCP rather than UDP.

Connection Attempt Times Out

• A firewall may be silently dropping traffic.
• A routing or NAT configuration may be missing or incorrect.
• The destination host may be unreachable.

Test basic network reachability separately from service reachability. Review host firewalls, network firewalls, cloud security policies, and port-forwarding rules when NAT is involved.

Port Is Already in Use

• Another process is already listening on the same IP address, protocol, and port.
• A previous service instance did not stop cleanly.

Use socket inspection tools to identify the owning process. Stop or reconfigure the conflicting service. Choose another port only when clients and firewall rules can be updated as well.

A Firewall Rule Looks Correct but Traffic Fails

• The rule may permit TCP while the application uses UDP, or the reverse.
• The service may listen only on loopback or another interface.
• An upstream firewall, NAT device, or cloud security policy may also block the traffic.

Verify the bind address and listening state, confirm the rule's protocol and direction, and check every policy layer between the client and server.

Key Points for Exams and Practice

• IP addresses identify hosts or interfaces; ports identify application-level endpoints on those hosts.
• A socket is commonly described by an IP address, transport protocol, and port.
• TCP is connection-oriented, reliable, and ordered; UDP is connectionless and lower overhead.
• TCP and UDP have separate port namespaces, so the same number can be used independently by both.
• Port numbers range from 0 through 65535.
• Well-known ports are 0-1023, registered ports are 1024-49151, and dynamic or ephemeral ports are 49152-65535.
• A server normally listens on a known port while a client uses a temporary source port.
• A port number alone does not prove which service or protocol is running.
• Firewalls must be evaluated by protocol, port, direction, addresses, and policy location.
• A listening socket is different from an established connection.

To continue, review HTTP, private IP addresses, tcpdump, and introductory Nmap usage.