Ports: How Data Finds the Right Application

Ports: How Data Finds the Right Application

What you'll learn

• Explain what a port is, and how the three IANA port ranges divide the number space
• Define a socket, and explain how one machine keeps dozens of conversations separate
• Recognize the core port numbers every professional knows on sight — including the 2026 additions
• Explain why port 443 became the Internet's universal door
• List the listening programs on your own machine with ss (Linux) and netstat (Windows)

This lesson builds on Chapter 5 of Dr. Tahseen Al-Doori's Network Essentials — its port-number types and its catalog of TCP/IP services — with a sidelong glance at Chapter 13, where the book returns to ports from the security angle: the ports you expose are the doors an attacker will try first. The catalog needed the most modernization of anything in this module; the system of ports needed none at all.

The last address: getting data to the right program

Follow a packet's addressing one more time, because a piece has been missing. The MAC address delivered the frame across the local hop (Module 4). The IP address delivered the packet to the right machine across the world (Module 4). And then what? The machine that received it is running a browser, a mail client, a game, three chat apps and a dozen background services — which program gets the data?

That is the port's job. A port is a 16-bit number — 0 through 65,535 — carried in the transport header (TCP or UDP, both use the same scheme) that identifies a communication endpoint within a machine. Think of an office building: the street address gets the courier to the right building (the IP address); the suite number gets the envelope to the right office inside (the port). A machine has one street address per network connection, but 65,536 numbered suites — enough for every program to have its own mail slot.

Both ends of every conversation carry a port. The destination port names the service being contacted — 443 in last lesson's capture, "the web server's suite." The source port is a temporary number the sending machine invents for each conversation, so the reply can find its way back to the exact program — the exact browser tab — that asked. One of the book's own review questions asks how two browsers on one computer can run side by side without their incoming data colliding; you can now answer it in one word: source ports. Each conversation got a different one.

Three ranges, one registry

Port numbers are not assigned by chance. IANA — the Internet Assigned Numbers Authority, the same registry body you met behind IP addresses — maintains the official port registry, divided into three ranges:

Your capture from last lesson is this table in action: destination 443 (a system port — a famous service) and source 51742 (drawn from the dynamic pool, used once, thrown away).

One kind correction as we go. The book lists the well-known range as starting at 1; the registry actually defines it as 0–1023 — a one-number difference worth fixing because certification exams and the IANA registry both expect 0. (Port 0 itself is reserved and never used by a real service, which is presumably how the off-by-one crept into many a textbook. The range includes it anyway.)

Sockets: the full return address

Put the pieces together and you get the concept professionals actually work with. A socket is the complete address of one communication endpoint: IP address + transport protocol + port — for example, TCP on 192.168.10.57, port 51742. A connection is a pair of sockets, and that pair is what makes every conversation on the Internet unique. Two browser tabs talking to the same web server share three of the four values (both IPs and the server's 443) — but each tab's distinct source port makes each socket pair unique, and the machine's transport layer sorts arriving data flawlessly by consulting exactly that pair.

A program that offers a service does something slightly different: it opens a socket and listens — sits on a port waiting for strangers to connect. A web server listens on 443; a mail server listens on 25; the SSH service listens on 22. "Listening" is a real, inspectable state — the lab below will show you every listening socket on your own machine, each one a door standing open.

Chapter 13's security angle follows immediately: every listening port is attack surface. The first thing a network scanner (or an attacker) does to a machine is enumerate its open doors, because each open door has a program behind it, and programs have flaws. The professional habit you start today: know your own doors, and be able to name the program behind each one.

The ports you must know by heart

Every profession has its multiplication table. This is networking's — the numbers that turn a capture or a firewall rule from noise into a story. Learn them cold:

Two stories inside this table deserve a paragraph each.

The mail cluster is the table's best then-versus-now lesson. The book's era sent mail on 25 and fetched it on 110 or 143 — all cleartext, passwords included. The 2026 pattern splits the job: servers still exchange mail with each other on 25, but you submit outgoing mail on 587 or 465 (both encrypted) and fetch on 993 or 995 (both encrypted). Same protocols underneath — SMTP, IMAP, POP3 — wrapped in the TLS encryption Module 7 dissects. Five ports, one principle: cleartext died, the protocols survived in encrypted dress.

Port 443, the universal door. In the book's day, each service had its port and firewalls filtered accordingly. Then the world discovered that port 443 is the one door no network dares close — block it and the web stops — and everything moved in: video calls, chat, file sync, software updates, VPNs, even encrypted DNS (DoH, next lesson) all speak through 443, dressed as ordinary HTTPS. The port number now tells you far less than it used to; "it's on 443" describes most of the Internet. That is convenient for applications, and a genuine headache for the firewall craft you will meet in Module 7 — the door is open, so inspection had to move elsewhere.

The rest of the book's protocol catalog gets its honest 2026 disposition here, so nothing is silently dropped: Telnet (23) and cleartext FTP survive only in labs and legacy gear — SSH took both jobs; NNTP, the newsgroup protocol, is a historical footnote; SNMP (161) — the management protocol the book introduces alongside these — returns properly in Module 8; LDAP (389, directory logins) and IGMP (multicast group management, not a port user at all — it rides directly in IP like ICMP) remain real but beyond an essentials course's daily needs; and ICMP, as you proved in Module 2, has no ports because it is not a transport-layer protocol at all.

From the textbook to 2026

The port system — three ranges, sockets, listening services — is unchanged since the book, and its teaching still lands. What moved: the well-known range's true lower bound (0, not 1); the cleartext-to-encrypted migration that rewrote the mail and remote-admin rows; the arrival of 853 and the DoH-inside-443 pattern for DNS; QUIC putting HTTPS on UDP 443 alongside TCP 443; and the collapse of "port tells you the application" as everything crowded through 443. The book's Chapter 13 instinct — audit your open ports, because they are your attack surface — has aged in the opposite direction: it matters more now, and it is exactly what the lab does next.

Lab: Audit Your Own Open Doors

Objective. List every listening socket on your machine, identify the program behind three of them, and classify each port by IANA range.

Setup. Your own computer. Read-only — you will look, not change. You need an administrator/sudo-capable account to see which program owns each socket (both operating systems protect that information).

A safety note before you begin, and it is binding for this lab: identify, never terminate. You will meet unfamiliar program names; some belong to the operating system itself, and killing them can freeze or crash your machine. Investigating a name means reading about it, not stopping it. Nothing in this lab modifies anything.

Steps — Windows.

1. Open Command Prompt as administrator (right-click → "Run as administrator" — needed for the -b program names).

2. Run:

   codeCopy

   netstat -ab -p TCP
   

3. Read the output. Each LISTENING line is an open door; the bracketed name below it is the program holding it open. An authored excerpt of the kind you should expect:

   codeCopy

   Proto  Local Address        Foreign Address      State
   TCP    0.0.0.0:135          DESKTOP-K4:0         LISTENING
   RpcSs
   [svchost.exe]
   TCP    0.0.0.0:445          DESKTOP-K4:0         LISTENING
   [System]
   TCP    192.168.10.57:139    DESKTOP-K4:0         LISTENING
   [System]
   

4. Note the local address on each line: 0.0.0.0:port means "listening on every interface — reachable from the network"; 127.0.0.1:port means "listening to this machine only" (the loopback address from Module 4 — a door that opens onto an inside hallway).

5. Pick three listening lines and record: port number, IANA range, program name.

6. For each program name you don't recognize, search the web for "name + what is it" from a source you trust (the OS vendor's documentation is ideal). Windows' svchost.exe hosts many services at once — the indented service name above it (like RpcSs) is the real answer.

Steps — Linux.

1. Open a terminal and run:

   codeCopy

   sudo ss -tlnp
   

   Four switches, worth decoding once: t = TCP only, l = listening sockets only, n = show numbers rather than service names, p = show the owning process (the switch that needs sudo).

2. Read the output. An authored excerpt of the kind you should expect:

   codeCopy

   State    Recv-Q  Send-Q  Local Address:Port   Peer Address:Port  Process
   LISTEN   0       4096    127.0.0.53%lo:53     0.0.0.0:*          users:(("systemd-resolve",pid=612,fd=14))
   LISTEN   0       128     0.0.0.0:22           0.0.0.0:*          users:(("sshd",pid=890,fd=3))
   LISTEN   0       511     127.0.0.1:631        0.0.0.0:*          users:(("cupsd",pid=1044,fd=7))
   

   Reading the middle line: door 22, open on every interface (0.0.0.0), held by sshd — this machine accepts SSH logins from the network. The first line is the local DNS helper listening on loopback only; the last is the printing service, also loopback-only.

3. Apply the same address reading as Windows step 4: 0.0.0.0 = network-reachable, 127.0.0.1 (or 127.0.0.53) = this machine only.

4. Pick three listening lines and record: port number, IANA range, program name.

5. Optional: run sudo ss -ulnp — the same audit for UDP. Expect fewer, stranger doors (DHCP's 68 may appear; next-next lesson explains it).

Expected result. A handful to a few dozen listening sockets. A typical home machine shows mostly system services and loopback-only helpers; each line yields a port, a range classification, and a nameable program.

Verify. Your three recorded entries each answer all four questions: which port? which IANA range? which program? reachable from the network or loopback-only?

Questions.

1. One of your lines shows a listening port in the 49152–65535 range. The table said that range is "never assigned." Is something wrong?
2. Why does the program name column require administrator/sudo rights when the port numbers themselves do not?
3. Which is more urgent to investigate: an unknown program listening on 127.0.0.1:8080, or the same unknown program on 0.0.0.0:8080? Why?

(Answers: 1 — no; "never assigned" means IANA registers no service there, precisely so machines can use the range freely for temporary purposes — including short-lived listeners some programs open. Unregistered, not forbidden. 2 — mapping sockets to processes reveals what software a machine runs, which is reconnaissance gold; both OSes therefore restrict it to privileged users. 3 — the 0.0.0.0 one: it is reachable from the network, so it is real attack surface; the loopback one accepts connections only from the machine itself.)

If it goes wrong.

• Windows: netstat -ab prints "The requested operation requires elevation." The prompt is not elevated — reopen Command Prompt via right-click → Run as administrator.
• Linux: the Process column is empty. You ran ss without sudo — the sockets still list, but ownership is hidden. Rerun with sudo.
• Linux: ss not found. Very minimal installations may lack it; it ships in the iproute2 package. The legacy netstat -tlnp (package net-tools) shows the same story — ss is its modern replacement, as Module 8 details.
• The output is overwhelming. Filter to TCP listeners only as shown, and read 0.0.0.0 lines first — they are the doors that face the world.
• You found a genuinely suspicious listener. Do not kill it from this lab. Note the port and program, and hold on to it — Module 7 (security) and Module 8 (tools) give you the investigation method; a beginner's forced termination causes more outages than attackers do.

Reset/cleanup. Nothing to reset — the lab changed nothing. Keep your three-entry audit; the capstone's security review asks for exactly this habit at network scale.

Check yourself

1. A capture line shows source port 58201 and destination port 853. Using only the numbers, describe the conversation: what service, which range each port belongs to, and which side initiated.
2. A user reports "email sends fine at home but fails at a hotel." The hotel network blocks outbound port 25 but permits 587 and 465. Explain to the user, in two sentences, why their mail should still work — and what a failing setup is probably doing wrong.
3. Your web server hosts one site, yet ss -tlnp on it shows sshd on 22, nginx on 80 and 443, and an unknown program on 0.0.0.0 port 4444. Rank the four listeners from least to most concerning, with one reason each.
4. Two tabs in one browser load the same page from the same server simultaneously. List the four values of each tab's socket pair and mark which single value differs.
5. A junior colleague writes in documentation: "well-known ports run 1–1023." What correction do you make, and why does one number matter?
6. Why does the claim "we can tell what applications our staff use by looking at destination ports at the firewall" work far worse in 2026 than it did in the book's era? Name the port at the center of the story.

Answers

1. An encrypted DNS lookup: 853 is DNS over TLS (system range, 0–1023); 58201 is a temporary source port from the dynamic range (49152–65535). The client with the dynamic port initiated the conversation toward the listening service on 853.
2. Modern mail programs submit outgoing mail on 587 or 465 with encryption — exactly the ports the hotel permits; port 25 is for server-to-server transfer and is routinely blocked on guest networks to stop spam. A failing setup is almost certainly configured to submit on port 25 like it's 2007 — repoint it at the provider's 587/465 submission service.
3. Least concerning: 443 and 80 — the site's own doors, expected (80 ideally just redirecting). Next: 22 — legitimate administration, but a permanent target; it should be firewalled to admin locations. Most concerning: 4444 — an unregistered high port held by a program you cannot name, listening on every interface of an Internet-facing server; identify that program before anything else today.
4. Source IP, source port, destination IP, destination port. Both tabs share source IP, destination IP and destination port (443); only the source port differs — and that one difference keeps the streams separate.
5. The IANA system (well-known) range is 0–1023. The single number matters because registries, exams, firewall configurations and scanning tools all treat 0 as in-range; repeating the off-by-one propagates a small error into places where precision is assumed.
6. Because the Internet converged on 443: chat, video, file sync, updates, VPNs and even DNS (DoH) all present themselves as HTTPS on 443 to guarantee passage through firewalls. Destination ports once mapped neatly to applications; today most traffic shows the same door number, and identifying applications requires deeper inspection than a port column.

Key terms

• Port — a 16-bit transport-header number (0–65535) identifying a communication endpoint within a machine.
• Source / destination port — the temporary number identifying the asking program vs. the famous number identifying the service asked.
• System (well-known) ports — IANA range 0–1023; the famous services.
• User (registered) ports — IANA range 1024–49151; registered applications.
• Dynamic / private ports — IANA range 49152–65535; the unassigned pool source ports are drawn from.
• Socket — IP address + transport protocol + port: one endpoint's complete address. Connections are socket pairs.
• Listening — the state of a socket waiting for incoming connections; every listening port is an open door and attack surface.
• Loopback listener — a socket bound to 127.0.0.1, reachable only from the machine itself.
• Mail submission (587/465) — the modern encrypted client-to-provider mail ports; 25 remains server-to-server.
• Port 443 as universal door — the 2026 pattern of tunneling nearly everything through HTTPS to guarantee firewall passage.
• ss / netstat — the Linux and Windows commands that reveal sockets and the programs that own them.

Summary

• Ports finish the addressing story: MAC to the right hop, IP to the right machine, port to the right program — 65,536 numbered doors per machine.
• IANA divides the space into system (0–1023 — the book's 1–1023 kindly corrected), registered (1024–49151) and dynamic (49152–65535) ranges; services listen on famous ports, clients reply from disposable ones.
• A socket is IP + protocol + port; the uniqueness of socket pairs — usually via the source port — is how one machine keeps every conversation separate.
• The core table (22, 25, 53, 67/68, 80, 110→995, 143→993, 123, 443, 465, 587, 853) is professional vocabulary; the mail cluster and the encrypted-DNS ports carry the era's cleartext-to-TLS story.
• Port 443 became the universal door: most modern traffic dresses as HTTPS, weakening the old port-equals-application rule.
• Every listening port is attack surface — the book's Chapter 13 instinct, more relevant than ever; you audited your own machine's doors with ss / netstat and named the programs behind three of them.

Next lesson

Port 53 sat quietly in this lesson's table; the next lesson opens it. DNS — the system that turns names into addresses — is the most consulted database on Earth, and you will trace its hierarchy from the root down, then interrogate it by hand with nslookup and dig.

Sources and further study

• Al-Doori, T., Network Essentials, Chapters 5 and 13 — port ranges, the TCP/IP service catalog, and the ports-as-attack-surface instinct this lesson modernizes.
• IANA, "Service Name and Transport Protocol Port Number Registry" — https://www.iana.org/assignments/service-names-port-numbers/ — the authoritative registry behind this lesson's ranges and assignments.
• RFC 8314, "Cleartext Considered Obsolete: Use of TLS for Email Submission and Access" — https://www.rfc-editor.org/info/rfc8314/ — the standard behind the modern mail-port story, including 465's rehabilitation.
• Linux ss manual page — https://man7.org/linux/man-pages/man8/ss.8.html — every switch used in the lab, and many more for Module 8.
• Download: OSI and TCP/IP Model Reference (ports live in the transport layer — keep the map in reach).