Understanding Network Ports
A network port is a 16-bit number, from 0 to 65,535, that identifies a specific service or connection on a device that already has an IP address. The IP address routes traffic to the correct machine; the port number routes it to the correct program on that machine. A connection is uniquely identified not by the port alone but by a four-part tuple — source IP, source port, destination IP, destination port — which is why a single web server can hold thousands of open connections on the same port 443 at once. Ports come in three IANA-defined ranges (well-known 0-1023, registered 1024-49151, dynamic 49152-65535), and TCP and UDP each keep their own independent copy of that entire number space.
That is the summary an AI Overview would hand you — technically correct and instantly forgettable. What it can't show you is how the routing actually works packet by packet, which ports you should never expose, and how to read what a scanner tells you. So below you'll find an animated diagram of port multiplexing, a decision table for the three ranges, a copy-paste port-to-service map, and a troubleshooting table for the exact states nmap reports. The Port Reference tool in the sidebar lets you search all 5,900+ registered ports as you read.
<rect x="24" y="177" width="150" height="46" rx="8" fill="#ffffff" stroke="#e2e8f0"/>
<text x="99" y="197" text-anchor="middle" font-weight="700" fill="#0f172a">SSH client</text>
<text x="99" y="214" text-anchor="middle">wants :22</text>
<rect x="24" y="284" width="150" height="46" rx="8" fill="#ffffff" stroke="#e2e8f0"/>
<text x="99" y="304" text-anchor="middle" font-weight="700" fill="#0f172a">App server</text>
<text x="99" y="321" text-anchor="middle">wants :3306</text>
<rect x="492" y="166" width="182" height="52" rx="7" fill="#f8fafc" stroke="#e2e8f0"/>
<text x="583" y="187" text-anchor="middle" font-weight="700" fill="#15803d">:22 SSH</text>
<text x="583" y="205" text-anchor="middle" fill="#334155">shell daemon</text>
<rect x="492" y="228" width="182" height="52" rx="7" fill="#f8fafc" stroke="#e2e8f0"/>
<text x="583" y="249" text-anchor="middle" font-weight="700" fill="#15803d">:3306 MySQL</text>
<text x="583" y="267" text-anchor="middle" fill="#334155">database</text>
When your computer communicates with another computer over the network, the connection uses a specific port number. Your browser typically uses port 80 (HTTP) or 443 (HTTPS). Your email client might use port 143 (IMAP) or 110 (POP3). Without ports, only one service could use the network at a time.
The Three Port Ranges
IANA divides the full 0-65535 space into three bands. The difference that matters day to day is who is allowed to bind to them and who assigns the number.
| Range | Name | Assigned by | Privilege to bind | Typical use | Examples |
|---|---|---|---|---|---|
| 0-1023 | Well-known | IANA (fixed) | root / administrator | Core public services | 22 SSH, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS |
| 1024-49151 | Registered | IANA (on request) | any user | Vendor/app services | 3306 MySQL, 5432 PostgreSQL, 8080 HTTP-alt |
| 49152-65535 | Dynamic / ephemeral | Operating system | any user | Client side of outbound connections | Temporary source ports |
| Which do I pick? | — | — | — | Run a public standard service → well-known. Ship your own app → registered. Never hand-pick from dynamic — the OS owns that range for outbound sockets. | — |
How Ports Enable Multiple Services
Without ports, only one service could use network communication at a time. With ports, multiple services run independently:
- Your web server listens on port 80/443
- Your SSH server listens on port 22
- Your database listens on port 3306
- Your email server listens on port 25/143/110
All these services can run simultaneously on the same computer because they listen on different ports.
When a client connects, it specifies both the destination computer (IP address) and the destination port. The operating system routes the connection to the appropriate service listening on that port.
Port vs. Protocol
Ports and protocols are related but distinct:
Port: A number identifying the endpoint (port 80) Protocol: The communication method (HTTP, HTTPS, FTP)
While port 80 conventionally carries HTTP, protocols don't require specific ports. You can run HTTPS on port 8443 instead of 443. However, conventions exist to ease communication and default to standard ports.
One subtlety that trips people up: TCP and UDP each maintain their own completely separate 0-65535 port space. TCP port 53 and UDP port 53 are different endpoints handled by different code, which is exactly why DNS uses both — UDP 53 for fast single-packet queries and TCP 53 for larger zone transfers. When you write a firewall rule, you always specify the protocol and the port together, because "allow 53" is ambiguous.
Why Ports Matter for Security
Ports are critical security considerations:
Service Exposure: Every port you open exposes a service to potential attack. Each exposed service is a potential vulnerability.
Firewall Configuration: Firewalls control which ports are accessible from outside networks. Proper firewall configuration involves opening only necessary ports and blocking the rest.
Network Monitoring: Security teams monitor port activity to detect unauthorized services, intrusions, or data exfiltration.
Vulnerability Scanning: Security tools scan port ranges to identify open ports and potentially vulnerable services.
Lateral Movement: In network compromises, attackers use port scanning to discover services on internal networks and move through the network.
Service Identification: Open ports reveal what services are running. Port 3389 open suggests Windows systems. Port 22 open suggests SSH-accessible systems.
Port Numbers and Service Mapping
Common ports and their associated services. The "Expose publicly?" column is the one to internalize — it is the difference between a hardened host and a breach.
| Port | Protocol | Service | Encrypted? | Expose publicly? |
|---|---|---|---|---|
| 20/21 | TCP | FTP file transfer | No | No — use SFTP/FTPS |
| 22 | TCP | SSH secure shell | Yes | Only behind allowlist/VPN |
| 23 | TCP | Telnet | No | Never — block it |
| 25 | TCP | SMTP mail relay | Optional (STARTTLS) | Mail servers only |
| 53 | TCP/UDP | DNS resolution | Optional (DoT/DoH) | Resolvers only |
| 80 | TCP | HTTP web | No | Yes (redirect to 443) |
| 110 | TCP | POP3 mail retrieval | No | No — use 995 (POP3S) |
| 143 | TCP | IMAP mail retrieval | No | No — use 993 (IMAPS) |
| 443 | TCP | HTTPS secure web | Yes | Yes |
| 445 | TCP | SMB file sharing | No | Never — internal only |
| 3306 | TCP | MySQL database | Optional | Never — internal only |
| 3389 | TCP | RDP remote desktop | Yes | Only behind VPN |
| 5432 | TCP | PostgreSQL database | Optional | Never — internal only |
| 5900 | TCP | VNC remote desktop | No | Never — tunnel it |
| 8080 | TCP | HTTP alternate | No | App-dependent |
| 8443 | TCP | HTTPS alternate | Yes | App-dependent |
Understanding common ports helps you recognize what services are running based on port numbers. Search the full 5,900+ port database in the Port Reference tool.
Localhost and Loopback Ports
Port connections to localhost (127.0.0.1) don't traverse the network—they stay on the local computer. This is useful for local services like databases you access only from the same machine.
For example, a web application might connect to MySQL running on localhost:3306. The connection stays local and isn't exposed to the network.
Loopback connections are more secure than network-exposed connections because they can't be accessed from remote computers.
Port Forwarding and NAT
Network Address Translation (NAT) allows port forwarding, enabling external connections to internal services:
- External computer connects to your public IP on port 80
- Your router forwards the connection to internal computer on port 80
- The internal web server responds
This enables services on private networks to be accessible externally, though it increases security risk.
Dynamic Port Assignment
For client connections, ports are often dynamically assigned from the private range (49152-65535). When your browser connects to a web server, the operating system assigns a temporary port for the connection. Once the connection closes, the port is released for future use.
This dynamic assignment enables millions of simultaneous connections from a single computer without port conflicts.
Port Scanning and Discovery
Port scanning discovers which ports are open on a target computer:
nmap example.com
This scans common ports and reports a state for each. The three states people confuse most are open, closed, and filtered — and the distinction between closed and filtered is what tells you whether a firewall is in the path.
| Nmap state | What the host did | What it means | What to do |
|---|---|---|---|
open | A service accepted the connection | Something is listening and reachable | Confirm it should be exposed; patch it |
closed | Host actively refused (TCP RST) | Host is up, but no service on that port | Usually fine — no action needed |
filtered | No response at all (packet dropped) | A firewall is silently blocking | Working as intended if deliberate; investigate if not |
open|filtered | Ambiguous (common with UDP) | Nmap can't tell open from dropped | Re-scan with a service probe (-sV) |
Port scanning is valuable for network inventory and vulnerability assessment, but scanning hosts you do not own or have written authorization to test can be illegal in many jurisdictions and will trip intrusion-detection systems.
Privileged Ports and Security
Ports below 1024 (well-known ports) require administrator or root access to open. This restriction prevents non-privileged users from spoofing services:
- Only root can open port 80 (web)
- Only an administrator can open port 25 (SMTP)
This design prevents unprivileged users from running unauthorized services on standard ports.
Port Blocking and Filtering
Firewalls control port access:
Inbound filtering: Blocks incoming connections on specific ports Outbound filtering: Blocks outgoing connections on specific ports Stateful filtering: Tracks connection states, allowing responses to outbound connections
Proper firewall configuration blocks all unnecessary ports, exposing only required services.
Common Port Configuration Mistakes
Leaving unnecessary ports open: Every open port is a potential attack vector. Close all ports not actively used.
Using standard ports for non-standard services: Running a web server on port 22 confuses tools and people expecting SSH there.
Not documenting port usage: Without documentation, you won't remember why ports are open or which are essential.
Exposing services unnecessarily: Some services (databases, admin tools) should only be accessible from specific trusted networks.
Using insecure protocols on standard ports: Using unencrypted Telnet on port 23 is worse than blocking it entirely.
Port-Based Threat Indicators
Suspicious port activity often indicates security threats:
- Unexplained open ports (especially high-numbered ports)
- Services on non-standard ports
- Unusual outbound connections on high-numbered ports
- Scans of port ranges (potential intrusion)
Monitoring port changes helps detect intrusions and unauthorized services.
Tools for Port Management
Netstat: Shows open ports and connections
netstat -an
ss: Modern replacement for netstat
ss -tuln
nmap: Port scanning tool
nmap -p 1-65535 target.com
Lsof: Lists open files and network connections
lsof -i -P
These tools help inventory ports and troubleshoot connectivity issues.
Conclusion
Network ports are logical endpoints enabling multiple services to operate on a single computer. Understanding port numbers, their associations with services, and security implications is essential for network management and security. Ports enable the modern internet—without them, only one service could communicate at a time. For security, minimize exposed ports, firewall appropriately, and monitor for unexpected port activity. Understanding ports helps you configure networks securely, troubleshoot connectivity issues, and detect intrusions.