What a port identifies
A port is a 16-bit number, from 0 to 65535, that tells a host which program should receive incoming data. The IP address gets a packet to the right machine. The port, carried in the TCP or UDP header, gets it to the right program, such as a web server on port 443.
Every TCP or UDP packet carries a source port and a destination port. A server listens on a fixed, known port so clients can find it, while each client uses a temporary port that its operating system picks for the connection.
TCP and UDP have separate port spaces. TCP port 53 and UDP port 53 are different endpoints, even though DNS uses both.
Well-known, registered and ephemeral ports
IANA, which keeps the official port registry, divides the range into three parts (RFC 6335):
- 0 to 1023 are system or well-known ports, assigned to core services such as HTTP and SSH. On Unix-like systems, a program traditionally needs root privileges to listen on one.
- 1024 to 49151 are user or registered ports. IANA registers services in this range, such as 3306 for MySQL, but nothing stops another program from using a registered port.
- 49152 to 65535 are dynamic or private ports, meant for temporary client connections. Operating systems pick their own ephemeral range: Windows uses the IANA range, while Linux defaults to 32768 to 60999.
- Port 0 is reserved. A program that asks to listen on port 0 gets a free port chosen by the operating system, which is common in tests.
Common port numbers to know
These assignments are conventions. A service can run on any port, and something listening on 443 is not necessarily HTTPS.
- 22 (TCP): SSH, for remote shells and Git over SSH.
- 25 (TCP): SMTP between mail servers. Mail apps submit outgoing mail on 587, or 465 with TLS from the start, and many ISPs block outbound port 25 from home connections.
- 53 (UDP and TCP): DNS.
- 80 (TCP): HTTP. Many sites listen here only to redirect visitors to HTTPS.
- 443 (TCP): HTTPS. UDP port 443 carries HTTP/3 over QUIC.
- 853 (TCP): DNS over TLS. UDP port 853 is used by DNS over QUIC.
- 3306 (TCP): MySQL and MariaDB.
- 5432 (TCP): PostgreSQL.
How one server port handles many connections
A TCP connection is identified by five values: the protocol, the source address and port, and the destination address and port. Thousands of clients can use the same server port at once because each connection has a different client address or port.
When your browser connects to 203.0.113.10 on port 443, the connection might run from 192.168.1.20 port 54321. A second connection to the same server uses a different source port, so both machines can keep the two apart.
The word socket means either an address and port pair or the operating system object a program reads and writes. To see which programs are listening on a machine, use one of these commands:
# Linux: listening TCP sockets and the process that owns each
ss -tlnp
# macOS or Linux: what is listening on port 5432
lsof -nP -iTCP:5432 -sTCP:LISTENHow firewalls use ports
Firewalls filter traffic by protocol, address and port. A typical web server allows inbound TCP 443, perhaps 80, and SSH only from known addresses, and blocks everything else. Database ports such as 3306 and 5432 should not be reachable from the internet at all.
Stateful firewalls track connections that start inside. Replies to those connections are allowed back in automatically, so the ephemeral range never needs to be opened for outbound traffic to work.
Port scanners usually report three states. Open means a program accepted the connection. Closed means the host answered, with a TCP reset for example, because nothing is listening. Filtered means no answer came back, usually because a firewall dropped the packets.
The same split helps when debugging. "Connection refused" usually means you reached the host and nothing is listening, while a timeout points to a firewall or routing problem. Closing a port blocks a service, but moving SSH to an unusual port only reduces log noise and does not stop a determined attacker.