Port Numbers - TCP Header Format and Structure | OneNoughtOne

0/240

Computer NetworksTCP Header Format

TCP Header Format and Structure

LevelIntermediate

Duration75 mins

TopicTCP Header Format

1 / 5

Port Numbers

The Foundation of Process Identification

In the architecture of reliable data transport, the TCP header serves as the control center—a meticulously designed structure where every bit carries specific meaning. At the very beginning of this header, occupying the first 32 bits, lie two critical fields that enable one of TCP's most fundamental capabilities: source port and destination port.

Without port numbers, the transport layer would be incapable of its primary function: delivering data to the correct application process on a host. While IP addresses identify machines on a network, port numbers identify specific processes or services running on those machines. This distinction is not merely important—it is essential to the functioning of all networked applications.

What You Will Learn

By the end of this page, you will understand the complete mechanics of TCP port numbers: their position and size in the header, how they enable multiplexing and demultiplexing, the three official port number ranges and their purposes, how ports combine with IP addresses to form socket addresses, and the critical role port selection plays in connection establishment and security.

Position and Size in the TCP Header

The TCP header is a carefully structured sequence of fields, typically 20 bytes (160 bits) in its base form, though options can extend it up to 60 bytes. The source port and destination port fields occupy the very first positions in this structure—a deliberate design choice that reflects their fundamental importance.

Header Layout (First 32 Bits):

TCP Header: First 32 Bits
Bit Position	Field	Size	Description
0–15	Source Port	16 bits	Port number of the sending process
16–31	Destination Port	16 bits	Port number of the receiving process

Why 16 Bits Matter:

Each port field is 16 bits wide, providing a range of 0 to 65,535 (2^16 = 65,536 unique values). This seemingly simple design decision has profound implications:

Sufficient Capacity: 65,536 ports per host allows substantial concurrent connections. A server can handle tens of thousands of simultaneous client connections.
Compact Representation: 16 bits balances expressiveness with efficiency. Larger port fields would waste header space; smaller fields would severely limit concurrent connections.
Historical Context: The 16-bit size was established in the original TCP specification (RFC 793, 1981) and has proven remarkably durable, remaining unchanged across four decades of exponential Internet growth.

Header Byte Order

TCP header fields are transmitted in network byte order (big-endian). Port number 80 (HTTP) is transmitted as bytes 0x00 0x50, with the most significant byte first. This standardization ensures consistent interpretation across different processor architectures—essential for interoperability.

tcp_header_structure.c
C
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
/* TCP Header Structure - First 32 Bits */
struct tcp_header {
    uint16_t source_port;       /* Bits 0-15:  Source port number */
    uint16_t destination_port;  /* Bits 16-31: Destination port number */
    uint32_t sequence_number;   /* Bits 32-63: Sequence number */
    uint32_t ack_number;        /* Bits 64-95: Acknowledgment number */
    /* ... remaining fields ... */
};
 
/* Reading from network byte order */
uint16_t get_source_port(const uint8_t* packet) {
    /* Network byte order: most significant byte first */
    return (uint16_t)(packet[0] << 8) | packet[1];
}
 
/* Example: HTTP server port 80 */
/* In memory (network order): 0x00 0x50 */
/* After conversion: 0x0050 = 80 decimal */

The Role of Port Numbers in TCP Communication

Port numbers serve as the bridge between network communication and application processes. While IP routing delivers packets to a specific machine, port numbers ensure those packets reach the correct process running on that machine. This mechanism is called multiplexing/demultiplexing and is fundamental to how modern networking functions.

The Address Hierarchy:

Network communication operates through a layered addressing scheme:

Layer	Identifier	Scope	Example
Network Layer	IP Address	Host on the network	192.168.1.100
Transport Layer	Port Number	Process on the host	443 (HTTPS)
Application Layer	Application-Specific	Data within the process	HTTP request path

The combination of IP address and port number creates a socket address—a unique endpoint for network communication.

Core Functions of Port Numbers

•Process Identification — Port numbers uniquely identify specific application processes awaiting or initiating network connections. Web servers listen on port 80/443, SSH daemons on port 22, database servers on port 5432 (PostgreSQL) or 3306 (MySQL).
•Multiplexing at Sender — When multiple applications on a single host send data simultaneously, TCP encapsulates each application's data with a distinct source port, allowing multiple streams to share the network interface.
•Demultiplexing at Receiver — When data arrives at a host, TCP examines the destination port to route segments to the correct application process. Without this, all incoming data would be indistinguishable.
•Connection Uniqueness — TCP connections are identified by a 4-tuple: (source IP, source port, destination IP, destination port). This allows the same server process to simultaneously handle thousands of clients, each with a unique connection tuple.
•Service Discovery — Well-known ports enable clients to find services without prior knowledge. A browser connecting to port 443 knows it's reaching an HTTPS server—a universally understood convention.

The Four-Tuple Identity

A TCP connection is uniquely identified by: (Source IP, Source Port, Destination IP, Destination Port). This allows a server on port 80 to handle connections from 10,000 clients simultaneously—each client's unique IP and ephemeral port creates a distinct connection tuple.

Source Port versus Destination Port

While both fields are 16 bits and structurally identical, the source port and destination port serve fundamentally different purposes and are selected through different mechanisms.

Source Port:

The source port identifies the sending process and enables the receiver to respond to the correct process on the sender's machine.

Client-Side: Almost always an ephemeral port (dynamically assigned by the operating system from the high-numbered port range)
Server-Side: The server's well-known port when responding to client requests
Purpose: Enables responses to reach the correct originating process

Destination Port:

The destination port identifies the intended receiving process and guides demultiplexing at the receiver.

Client-Side: The well-known port of the service being accessed (e.g., 80 for HTTP, 443 for HTTPS)
Server-Side: The ephemeral port of the client when responding
Purpose: Directs incoming segments to the correct application

Client Initiating Connection

•Source Port: 52341 (ephemeral, OS-assigned)
•Destination Port: 443 (HTTPS server)
•Client process selected by OS-assigned source port
•Server process identified by well-known destination port
•Segment flows: Client → Server

Server Responding

•Source Port: 443 (HTTPS server)
•Destination Port: 52341 (client's ephemeral)
•Server process identified by its well-known port
•Client process identified by its ephemeral port
•Segment flows: Server → Client

Perspective Symmetry:

Notice the elegant symmetry: what is a source port in one direction becomes a destination port in the reverse direction. When the server responds, the ports swap roles. This symmetry enables bidirectional communication over a single connection.

Converting Mermaid diagram...

The Three Official Port Ranges

The Internet Assigned Numbers Authority (IANA) divides the 65,536 available port numbers into three distinct ranges, each with specific purposes and access restrictions. Understanding these ranges is essential for network administration, security configuration, and application development.

IANA Port Number Classifications
Range	Name	Number Count	Primary Usage
0–1023	Well-Known (System) Ports	1,024	Standard services (HTTP, SSH, SMTP, DNS)
1024–49151	Registered (User) Ports	48,128	Application-specific services
49152–65535	Dynamic (Ephemeral) Ports	16,384	Client-side temporary connections

Well-Known Ports (0–1023)

The well-known ports, also called system ports or privileged ports, are reserved for essential Internet services. Their standardization enables universal service discovery—any system worldwide understands that port 80 means HTTP.

Key Characteristics:

Require root/administrator privileges to bind on Unix-like systems (security mechanism)
Officially assigned by IANA to specific protocols
Changing them breaks global interoperability conventions
Represent battle-tested, critical infrastructure services

Common Well-Known TCP Ports
Port	Service	Protocol	Description
20, 21	FTP	File Transfer Protocol	20 for data, 21 for control
22	SSH	Secure Shell	Encrypted remote access
23	Telnet	Telnet	Unencrypted remote access (legacy)
25	SMTP	Simple Mail Transfer Protocol	Email transmission
53	DNS	Domain Name System	Name resolution (TCP for zone transfers)
80	HTTP	Hypertext Transfer Protocol	Web traffic (unencrypted)
110	POP3	Post Office Protocol 3	Email retrieval
143	IMAP	Internet Message Access Protocol	Email access
443	HTTPS	HTTP Secure	Encrypted web traffic (TLS)
993	IMAPS	IMAP Secure	Encrypted IMAP
995	POP3S	POP3 Secure	Encrypted POP3

Registered Ports (1024–49151)

The registered ports are available for applications and services that are significant but not part of the core Internet infrastructure. Software vendors and organizations register these ports with IANA to avoid conflicts.

Key Characteristics:

No administrative privileges required to bind on most systems
IANA registration recommended but not enforced
Used by databases, application servers, gaming services
Conflicts possible if registrations are ignored

Common Registered TCP Ports
Port	Service	Description
1433	MSSQL	Microsoft SQL Server
3306	MySQL	MySQL Database Server
3389	RDP	Remote Desktop Protocol
5432	PostgreSQL	PostgreSQL Database Server
5900	VNC	Virtual Network Computing
6379	Redis	Redis Key-Value Store
8080	HTTP-Alt	Alternative HTTP (proxies, development)
8443	HTTPS-Alt	Alternative HTTPS
27017	MongoDB	MongoDB Database Server

Dynamic/Ephemeral Ports (49152–65535)

The dynamic ports, also called ephemeral ports or private ports, are used for temporary, outgoing connections. When a client initiates a connection, the operating system automatically assigns a source port from this range.

Key Characteristics:

Automatically assigned by the OS; applications rarely specify them
Short-lived: allocated for a connection's duration, then recycled
Range varies by OS (Linux historically used 32768–61000)
Critical for handling many simultaneous outgoing connections

Port Exhaustion

High-traffic systems can exhaust ephemeral ports if connections are opened faster than they're closed. With only ~16,000 ephemeral ports and a default TIME_WAIT of 120 seconds, a server creating 1,000 connections/second exhausts ports in 16 seconds. Mitigation includes SO_REUSEADDR, connection pooling, or expanding the ephemeral range.

view_ephemeral_range.sh
Bash
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
# View ephemeral port range on Linux
cat /proc/sys/net/ipv4/ip_local_port_range
# Output example: 32768   60999
 
# Expand ephemeral range to reduce exhaustion risk
sudo sysctl -w net.ipv4.ip_local_port_range="1024 65535"
 
# Check current port usage statistics
ss -s
# Output shows total sockets in various states
 
# View active connections using ephemeral ports
ss -tn | awk 'NR>1 {split($4, a, ":"); print a[length(a)]}' | sort -n | uniq -c | sort -rn | head
 
# Windows: View ephemeral port range
netsh int ipv4 show dynamicport tcp

Socket Addresses and Connection Identity

A port number alone is insufficient to identify a network endpoint—it must be combined with an IP address to form a socket address. This combination uniquely identifies a process's endpoint in the global network space.

Socket Address Notation:

Socket addresses are commonly written in the format IP:Port:

192.168.1.100:8080 — IPv4 address with port 8080
[2001:db8::1]:443 — IPv6 address with port 443 (brackets required)

Connection Tuple (Four-Tuple):

A TCP connection is uniquely identified by combining two socket addresses:

(Source IP, Source Port, Destination IP, Destination Port)
(192.168.1.100, 52341, 93.184.216.34, 443)

This four-tuple is the connection identifier. No two active connections can share the same four-tuple—attempting to create a duplicate results in connection failure.

Why the Four-Tuple Matters

•Concurrent Connections: A server can accept thousands of connections to the same port. Each client's unique IP and ephemeral port creates a distinct four-tuple.
•Connection Lookup: When a segment arrives, TCP searches for a matching four-tuple in its connection table. This is typically implemented as a hash table for O(1) lookup.
•NAT Compatibility: Network Address Translation relies on the four-tuple to map internal addresses to external ones, maintaining connection identity across network boundaries.
•Security Filtering: Firewalls use four-tuples to permit or deny specific connections, enabling precise traffic control.
•Load Balancing: Hashing the four-tuple distributes connections across servers while ensuring all packets from one connection reach the same backend.

Connection Table Implications:

The kernel maintains a hash table mapping four-tuples to connection control blocks (TCBs). When a segment arrives, the kernel:

Extracts the four-tuple from IP and TCP headers
Computes a hash of the four-tuple
Looks up the corresponding connection in constant time
Delivers data to the associated socket buffer

This design enables modern servers to handle millions of concurrent connections efficiently.

socket_connection.py
Python
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
import socket
 
# Server: Create socket and bind to specific address
server_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
server_socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
server_socket.bind(('0.0.0.0', 8080))  # Bind to port 8080, all interfaces
server_socket.listen(100)  # Accept up to 100 pending connections
 
print(f"Server listening on {server_socket.getsockname()}")
# Output: Server listening on ('0.0.0.0', 8080)
 
# Accept connection - returns new socket for this specific connection
client_conn, client_addr = server_socket.accept()
 
# Each connection has unique identifiers
print(f"Server side: {client_conn.getsockname()}")  # ('192.168.1.10', 8080)
print(f"Client side: {client_conn.getpeername()}")  # ('192.168.1.20', 54321)
 
# The connection four-tuple:
# (192.168.1.20, 54321, 192.168.1.10, 8080)
 
# Server can accept more connections on same port
# Each has unique four-tuple due to different client IP/port
client_conn2, client_addr2 = server_socket.accept()
# Four-tuple: (192.168.1.21, 48732, 192.168.1.10, 8080)

Port Selection Mechanics

Understanding how ports are selected—both for servers and clients—reveals important details about system behavior, security considerations, and potential pitfalls.

Server-Side Port Selection:

Servers explicitly bind to a specific port, making themselves available for incoming connections:

Application calls bind() with desired port
Kernel checks if port is available (not already bound)
If well-known port (0–1023), checks for root/CAP_NET_BIND_SERVICE permission
Creates binding in the kernel's socket table
Port is now reserved for this socket until closed

Client-Side Port Selection:

Clients typically let the OS assign an ephemeral port automatically:

Application calls connect() without prior bind()
Kernel selects unused port from ephemeral range
Selection algorithm varies: random, sequential, or hash-based
Port is bound to socket for connection duration
After connection closes, port enters TIME_WAIT before reuse

Security Through Randomization

Modern operating systems randomize ephemeral port selection to mitigate certain attacks (like TCP sequence number prediction). Sequential port allocation made it easier for attackers to guess connection parameters; randomization significantly increases the attack surface.

Port Binding Options:

Several socket options affect port binding behavior:

Option	Purpose	Use Case
`SO_REUSEADDR`	Allow bind to port in TIME_WAIT	Fast server restart
`SO_REUSEPORT`	Allow multiple sockets on same port	Load balancing
`SO_BINDTODEVICE`	Bind to specific network interface	Multi-homed servers
`SO_EXCLUSIVEADDRUSE`	Prevent port hijacking (Windows)	Security

Time-Wait and Port Reuse:

When a connection closes, the port enters a TIME_WAIT state (typically 2 * Maximum Segment Lifetime ≈ 120 seconds). This prevents delayed packets from a previous connection from being misinterpreted as belonging to a new connection on the same port.

Without SO_REUSEADDR, a server that crashes cannot restart immediately—it must wait for TIME_WAIT to expire on its well-known port.

port_binding_options.c
C
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
#include <sys/socket.h>
#include <netinet/in.h>
 
int create_server_socket(int port) {
    int sock = socket(AF_INET, SOCK_STREAM, 0);
    
    /* Allow immediate reuse of port after server restart */
    int reuse = 1;
    setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &reuse, sizeof(reuse));
    
    /* Linux: Allow multiple processes to bind to same port */
    /* Kernel load-balances incoming connections */
    int reuseport = 1;
    setsockopt(sock, SOL_SOCKET, SO_REUSEPORT, &reuseport, sizeof(reuseport));
    
    struct sockaddr_in addr = {
        .sin_family = AF_INET,
        .sin_port = htons(port),        /* Convert to network byte order */
        .sin_addr.s_addr = INADDR_ANY   /* Bind to all interfaces */
    };
    
    /* Bind to specific port */
    bind(sock, (struct sockaddr*)&addr, sizeof(addr));
    
    /* Begin listening for connections */
    listen(sock, SOMAXCONN);  /* System maximum backlog */
    
    return sock;
}
 
/* Client: Let OS assign ephemeral port */
int create_client_socket(const char* server, int port) {
    int sock = socket(AF_INET, SOCK_STREAM, 0);
    
    struct sockaddr_in addr = {
        .sin_family = AF_INET,
        .sin_port = htons(port)
    };
    inet_pton(AF_INET, server, &addr.sin_addr);
    
    /* connect() implicitly binds to ephemeral port */
    connect(sock, (struct sockaddr*)&addr, sizeof(addr));
    
    /* Retrieve assigned ephemeral port */
    struct sockaddr_in local;
    socklen_t len = sizeof(local);
    getsockname(sock, (struct sockaddr*)&local, &len);
    printf("Ephemeral port: %d
", ntohs(local.sin_port));
    
    return sock;
}

Security Considerations for Port Numbers

Port numbers have significant security implications. Their proper understanding and configuration is essential for hardening networked systems against various attack vectors.

Port-Related Security Risks

•Port Scanning — Attackers probe port ranges to discover running services. Open ports reveal potential attack surfaces. Tools like Nmap can scan thousands of ports in seconds, identifying services, versions, and vulnerabilities.
•Port Hijacking — On systems without proper protections, malicious processes can bind to ports before legitimate services start, intercepting traffic or conducting man-in-the-middle attacks.
•Privileged Port Bypass — Exploiting vulnerabilities to bind to well-known ports (<1024) without privileges can impersonate critical services like SSH or HTTPS.
•Port Knocking Evasion — Attackers can detect and replay port-knocking sequences to bypass security measures that hide services behind unconventional ports.
•Ephemeral Port Prediction — Sequential ephemeral port allocation can help attackers predict connection parameters for TCP hijacking or reset attacks.

Defense Strategies:

Minimize Open Ports: Run only necessary services; close unused ports
Firewall Configuration: Implement strict ingress/egress filtering by port
Port Randomization: Enable OS-level ephemeral port randomization
Network Segmentation: Isolate services on different network segments
Intrusion Detection: Monitor for port scan activity and unusual connection patterns
Regular Auditing: Periodically verify which ports are listening

Security Through Obscurity

Running SSH on port 2222 instead of 22 reduces automated scans but provides no real security. Attackers with time will find non-standard ports. Always implement proper authentication and encryption rather than relying on port obscurity.

firewall_port_rules.sh
Bash
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
# iptables: Block all incoming except specific ports
iptables -P INPUT DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT   # SSH
iptables -A INPUT -p tcp --dport 80 -j ACCEPT   # HTTP
iptables -A INPUT -p tcp --dport 443 -j ACCEPT  # HTTPS
iptables -A INPUT -i lo -j ACCEPT               # Loopback
 
# List listening ports (security audit)
ss -tlnp
 
# Nmap: Scan for open ports (authorized testing only)
nmap -sS -p 1-1024 192.168.1.100  # SYN scan of well-known ports
nmap -sS -p- 192.168.1.100        # Full port scan (65535 ports)
 
# Check if specific port is open
nc -zv 192.168.1.100 443
# Connection to 192.168.1.100 443 port [tcp/https] succeeded!

Summary: TCP Port Numbers

We've conducted an exhaustive exploration of port numbers—the first 32 bits of the TCP header that enable the transport layer's fundamental function: process-to-process delivery.

Key Takeaways

•Structure: Source and destination ports each occupy 16 bits (0–65535), positioned at the start of the TCP header in network byte order.
•Purpose: Ports enable multiplexing (many applications sharing one network interface) and demultiplexing (directing incoming data to correct processes).
•Three Ranges: Well-known (0–1023) for standard services, registered (1024–49151) for applications, and ephemeral (49152–65535) for temporary client connections.
•Four-Tuple Identity: Connections are uniquely identified by (source IP, source port, destination IP, destination port), enabling thousands of simultaneous connections to the same server port.
•Socket Addresses: The combination of IP address and port (e.g., 192.168.1.100:8080) uniquely identifies a network endpoint.
•Security Implications: Port scanning, hijacking, and proper firewall configuration are critical considerations for network security.

What's Next:

With port numbers establishing which processes communicate, we now turn to how TCP tracks the data being exchanged. The next page explores sequence numbers—the mechanism that enables TCP to reassemble data in order, detect lost segments, and provide the reliable delivery guarantee that defines the protocol.

Page Complete

You now possess comprehensive understanding of TCP port numbers: their position in the header, how they enable process identification and multiplexing, the three official port ranges and their purposes, and critical security considerations. This foundation prepares you for understanding how sequence numbers enable TCP's reliable data transfer.

Computer NetworksTCP Header Format

TCP Header Format and Structure

LevelIntermediate

Duration75 mins

TopicTCP Header Format

1 / 5

Port Numbers

The Foundation of Process Identification

What You Will Learn

Position and Size in the TCP Header

Header Layout (First 32 Bits):

TCP Header: First 32 Bits
Bit Position	Field	Size	Description
0–15	Source Port	16 bits	Port number of the sending process
16–31	Destination Port	16 bits	Port number of the receiving process

Why 16 Bits Matter:

Each port field is 16 bits wide, providing a range of 0 to 65,535 (2^16 = 65,536 unique values). This seemingly simple design decision has profound implications:

Sufficient Capacity: 65,536 ports per host allows substantial concurrent connections. A server can handle tens of thousands of simultaneous client connections.
Compact Representation: 16 bits balances expressiveness with efficiency. Larger port fields would waste header space; smaller fields would severely limit concurrent connections.
Historical Context: The 16-bit size was established in the original TCP specification (RFC 793, 1981) and has proven remarkably durable, remaining unchanged across four decades of exponential Internet growth.

Header Byte Order

tcp_header_structure.c
C
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
/* TCP Header Structure - First 32 Bits */
struct tcp_header {
    uint16_t source_port;       /* Bits 0-15:  Source port number */
    uint16_t destination_port;  /* Bits 16-31: Destination port number */
    uint32_t sequence_number;   /* Bits 32-63: Sequence number */
    uint32_t ack_number;        /* Bits 64-95: Acknowledgment number */
    /* ... remaining fields ... */
};
 
/* Reading from network byte order */
uint16_t get_source_port(const uint8_t* packet) {
    /* Network byte order: most significant byte first */
    return (uint16_t)(packet[0] << 8) | packet[1];
}
 
/* Example: HTTP server port 80 */
/* In memory (network order): 0x00 0x50 */
/* After conversion: 0x0050 = 80 decimal */

The Role of Port Numbers in TCP Communication

The Address Hierarchy:

Network communication operates through a layered addressing scheme:

Layer	Identifier	Scope	Example
Network Layer	IP Address	Host on the network	192.168.1.100
Transport Layer	Port Number	Process on the host	443 (HTTPS)
Application Layer	Application-Specific	Data within the process	HTTP request path

The combination of IP address and port number creates a socket address—a unique endpoint for network communication.

Core Functions of Port Numbers

•Process Identification — Port numbers uniquely identify specific application processes awaiting or initiating network connections. Web servers listen on port 80/443, SSH daemons on port 22, database servers on port 5432 (PostgreSQL) or 3306 (MySQL).
•Multiplexing at Sender — When multiple applications on a single host send data simultaneously, TCP encapsulates each application's data with a distinct source port, allowing multiple streams to share the network interface.
•Demultiplexing at Receiver — When data arrives at a host, TCP examines the destination port to route segments to the correct application process. Without this, all incoming data would be indistinguishable.
•Connection Uniqueness — TCP connections are identified by a 4-tuple: (source IP, source port, destination IP, destination port). This allows the same server process to simultaneously handle thousands of clients, each with a unique connection tuple.
•Service Discovery — Well-known ports enable clients to find services without prior knowledge. A browser connecting to port 443 knows it's reaching an HTTPS server—a universally understood convention.

The Four-Tuple Identity

Source Port versus Destination Port

While both fields are 16 bits and structurally identical, the source port and destination port serve fundamentally different purposes and are selected through different mechanisms.

Source Port:

The source port identifies the sending process and enables the receiver to respond to the correct process on the sender's machine.

Client-Side: Almost always an ephemeral port (dynamically assigned by the operating system from the high-numbered port range)
Server-Side: The server's well-known port when responding to client requests
Purpose: Enables responses to reach the correct originating process

Destination Port:

The destination port identifies the intended receiving process and guides demultiplexing at the receiver.

Client-Side: The well-known port of the service being accessed (e.g., 80 for HTTP, 443 for HTTPS)
Server-Side: The ephemeral port of the client when responding
Purpose: Directs incoming segments to the correct application

Client Initiating Connection

•Source Port: 52341 (ephemeral, OS-assigned)
•Destination Port: 443 (HTTPS server)
•Client process selected by OS-assigned source port
•Server process identified by well-known destination port
•Segment flows: Client → Server

Server Responding

•Source Port: 443 (HTTPS server)
•Destination Port: 52341 (client's ephemeral)
•Server process identified by its well-known port
•Client process identified by its ephemeral port
•Segment flows: Server → Client

Perspective Symmetry:

Converting Mermaid diagram...

The Three Official Port Ranges

IANA Port Number Classifications
Range	Name	Number Count	Primary Usage
0–1023	Well-Known (System) Ports	1,024	Standard services (HTTP, SSH, SMTP, DNS)
1024–49151	Registered (User) Ports	48,128	Application-specific services
49152–65535	Dynamic (Ephemeral) Ports	16,384	Client-side temporary connections

Well-Known Ports (0–1023)

Key Characteristics:

Require root/administrator privileges to bind on Unix-like systems (security mechanism)
Officially assigned by IANA to specific protocols
Changing them breaks global interoperability conventions
Represent battle-tested, critical infrastructure services

Common Well-Known TCP Ports
Port	Service	Protocol	Description
20, 21	FTP	File Transfer Protocol	20 for data, 21 for control
22	SSH	Secure Shell	Encrypted remote access
23	Telnet	Telnet	Unencrypted remote access (legacy)
25	SMTP	Simple Mail Transfer Protocol	Email transmission
53	DNS	Domain Name System	Name resolution (TCP for zone transfers)
80	HTTP	Hypertext Transfer Protocol	Web traffic (unencrypted)
110	POP3	Post Office Protocol 3	Email retrieval
143	IMAP	Internet Message Access Protocol	Email access
443	HTTPS	HTTP Secure	Encrypted web traffic (TLS)
993	IMAPS	IMAP Secure	Encrypted IMAP
995	POP3S	POP3 Secure	Encrypted POP3

Registered Ports (1024–49151)

Key Characteristics:

No administrative privileges required to bind on most systems
IANA registration recommended but not enforced
Used by databases, application servers, gaming services
Conflicts possible if registrations are ignored

Common Registered TCP Ports
Port	Service	Description
1433	MSSQL	Microsoft SQL Server
3306	MySQL	MySQL Database Server
3389	RDP	Remote Desktop Protocol
5432	PostgreSQL	PostgreSQL Database Server
5900	VNC	Virtual Network Computing
6379	Redis	Redis Key-Value Store
8080	HTTP-Alt	Alternative HTTP (proxies, development)
8443	HTTPS-Alt	Alternative HTTPS
27017	MongoDB	MongoDB Database Server

Dynamic/Ephemeral Ports (49152–65535)

Key Characteristics:

Automatically assigned by the OS; applications rarely specify them
Short-lived: allocated for a connection's duration, then recycled
Range varies by OS (Linux historically used 32768–61000)
Critical for handling many simultaneous outgoing connections

Port Exhaustion

view_ephemeral_range.sh
Bash
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
# View ephemeral port range on Linux
cat /proc/sys/net/ipv4/ip_local_port_range
# Output example: 32768   60999
 
# Expand ephemeral range to reduce exhaustion risk
sudo sysctl -w net.ipv4.ip_local_port_range="1024 65535"
 
# Check current port usage statistics
ss -s
# Output shows total sockets in various states
 
# View active connections using ephemeral ports
ss -tn | awk 'NR>1 {split($4, a, ":"); print a[length(a)]}' | sort -n | uniq -c | sort -rn | head
 
# Windows: View ephemeral port range
netsh int ipv4 show dynamicport tcp

Socket Addresses and Connection Identity

Socket Address Notation:

Socket addresses are commonly written in the format IP:Port:

192.168.1.100:8080 — IPv4 address with port 8080
[2001:db8::1]:443 — IPv6 address with port 443 (brackets required)

Connection Tuple (Four-Tuple):

A TCP connection is uniquely identified by combining two socket addresses:

(Source IP, Source Port, Destination IP, Destination Port)
(192.168.1.100, 52341, 93.184.216.34, 443)

This four-tuple is the connection identifier. No two active connections can share the same four-tuple—attempting to create a duplicate results in connection failure.

Why the Four-Tuple Matters

•Concurrent Connections: A server can accept thousands of connections to the same port. Each client's unique IP and ephemeral port creates a distinct four-tuple.
•Connection Lookup: When a segment arrives, TCP searches for a matching four-tuple in its connection table. This is typically implemented as a hash table for O(1) lookup.
•NAT Compatibility: Network Address Translation relies on the four-tuple to map internal addresses to external ones, maintaining connection identity across network boundaries.
•Security Filtering: Firewalls use four-tuples to permit or deny specific connections, enabling precise traffic control.
•Load Balancing: Hashing the four-tuple distributes connections across servers while ensuring all packets from one connection reach the same backend.

Connection Table Implications:

The kernel maintains a hash table mapping four-tuples to connection control blocks (TCBs). When a segment arrives, the kernel:

Extracts the four-tuple from IP and TCP headers
Computes a hash of the four-tuple
Looks up the corresponding connection in constant time
Delivers data to the associated socket buffer

This design enables modern servers to handle millions of concurrent connections efficiently.

socket_connection.py
Python
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
import socket
 
# Server: Create socket and bind to specific address
server_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
server_socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
server_socket.bind(('0.0.0.0', 8080))  # Bind to port 8080, all interfaces
server_socket.listen(100)  # Accept up to 100 pending connections
 
print(f"Server listening on {server_socket.getsockname()}")
# Output: Server listening on ('0.0.0.0', 8080)
 
# Accept connection - returns new socket for this specific connection
client_conn, client_addr = server_socket.accept()
 
# Each connection has unique identifiers
print(f"Server side: {client_conn.getsockname()}")  # ('192.168.1.10', 8080)
print(f"Client side: {client_conn.getpeername()}")  # ('192.168.1.20', 54321)
 
# The connection four-tuple:
# (192.168.1.20, 54321, 192.168.1.10, 8080)
 
# Server can accept more connections on same port
# Each has unique four-tuple due to different client IP/port
client_conn2, client_addr2 = server_socket.accept()
# Four-tuple: (192.168.1.21, 48732, 192.168.1.10, 8080)

Port Selection Mechanics

Understanding how ports are selected—both for servers and clients—reveals important details about system behavior, security considerations, and potential pitfalls.

Server-Side Port Selection:

Servers explicitly bind to a specific port, making themselves available for incoming connections:

Application calls bind() with desired port
Kernel checks if port is available (not already bound)
If well-known port (0–1023), checks for root/CAP_NET_BIND_SERVICE permission
Creates binding in the kernel's socket table
Port is now reserved for this socket until closed

Client-Side Port Selection:

Clients typically let the OS assign an ephemeral port automatically:

Application calls connect() without prior bind()
Kernel selects unused port from ephemeral range
Selection algorithm varies: random, sequential, or hash-based
Port is bound to socket for connection duration
After connection closes, port enters TIME_WAIT before reuse

Security Through Randomization

Port Binding Options:

Several socket options affect port binding behavior:

Option	Purpose	Use Case
`SO_REUSEADDR`	Allow bind to port in TIME_WAIT	Fast server restart
`SO_REUSEPORT`	Allow multiple sockets on same port	Load balancing
`SO_BINDTODEVICE`	Bind to specific network interface	Multi-homed servers
`SO_EXCLUSIVEADDRUSE`	Prevent port hijacking (Windows)	Security

Time-Wait and Port Reuse:

Without SO_REUSEADDR, a server that crashes cannot restart immediately—it must wait for TIME_WAIT to expire on its well-known port.

port_binding_options.c
C
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
#include <sys/socket.h>
#include <netinet/in.h>
 
int create_server_socket(int port) {
    int sock = socket(AF_INET, SOCK_STREAM, 0);
    
    /* Allow immediate reuse of port after server restart */
    int reuse = 1;
    setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &reuse, sizeof(reuse));
    
    /* Linux: Allow multiple processes to bind to same port */
    /* Kernel load-balances incoming connections */
    int reuseport = 1;
    setsockopt(sock, SOL_SOCKET, SO_REUSEPORT, &reuseport, sizeof(reuseport));
    
    struct sockaddr_in addr = {
        .sin_family = AF_INET,
        .sin_port = htons(port),        /* Convert to network byte order */
        .sin_addr.s_addr = INADDR_ANY   /* Bind to all interfaces */
    };
    
    /* Bind to specific port */
    bind(sock, (struct sockaddr*)&addr, sizeof(addr));
    
    /* Begin listening for connections */
    listen(sock, SOMAXCONN);  /* System maximum backlog */
    
    return sock;
}
 
/* Client: Let OS assign ephemeral port */
int create_client_socket(const char* server, int port) {
    int sock = socket(AF_INET, SOCK_STREAM, 0);
    
    struct sockaddr_in addr = {
        .sin_family = AF_INET,
        .sin_port = htons(port)
    };
    inet_pton(AF_INET, server, &addr.sin_addr);
    
    /* connect() implicitly binds to ephemeral port */
    connect(sock, (struct sockaddr*)&addr, sizeof(addr));
    
    /* Retrieve assigned ephemeral port */
    struct sockaddr_in local;
    socklen_t len = sizeof(local);
    getsockname(sock, (struct sockaddr*)&local, &len);
    printf("Ephemeral port: %d
", ntohs(local.sin_port));
    
    return sock;
}

Security Considerations for Port Numbers

Port numbers have significant security implications. Their proper understanding and configuration is essential for hardening networked systems against various attack vectors.

Port-Related Security Risks

•Port Scanning — Attackers probe port ranges to discover running services. Open ports reveal potential attack surfaces. Tools like Nmap can scan thousands of ports in seconds, identifying services, versions, and vulnerabilities.
•Port Hijacking — On systems without proper protections, malicious processes can bind to ports before legitimate services start, intercepting traffic or conducting man-in-the-middle attacks.
•Privileged Port Bypass — Exploiting vulnerabilities to bind to well-known ports (<1024) without privileges can impersonate critical services like SSH or HTTPS.
•Port Knocking Evasion — Attackers can detect and replay port-knocking sequences to bypass security measures that hide services behind unconventional ports.
•Ephemeral Port Prediction — Sequential ephemeral port allocation can help attackers predict connection parameters for TCP hijacking or reset attacks.

Defense Strategies:

Minimize Open Ports: Run only necessary services; close unused ports
Firewall Configuration: Implement strict ingress/egress filtering by port
Port Randomization: Enable OS-level ephemeral port randomization
Network Segmentation: Isolate services on different network segments
Intrusion Detection: Monitor for port scan activity and unusual connection patterns
Regular Auditing: Periodically verify which ports are listening

Security Through Obscurity

firewall_port_rules.sh
Bash
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
# iptables: Block all incoming except specific ports
iptables -P INPUT DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT   # SSH
iptables -A INPUT -p tcp --dport 80 -j ACCEPT   # HTTP
iptables -A INPUT -p tcp --dport 443 -j ACCEPT  # HTTPS
iptables -A INPUT -i lo -j ACCEPT               # Loopback
 
# List listening ports (security audit)
ss -tlnp
 
# Nmap: Scan for open ports (authorized testing only)
nmap -sS -p 1-1024 192.168.1.100  # SYN scan of well-known ports
nmap -sS -p- 192.168.1.100        # Full port scan (65535 ports)
 
# Check if specific port is open
nc -zv 192.168.1.100 443
# Connection to 192.168.1.100 443 port [tcp/https] succeeded!

Summary: TCP Port Numbers

We've conducted an exhaustive exploration of port numbers—the first 32 bits of the TCP header that enable the transport layer's fundamental function: process-to-process delivery.

Key Takeaways

•Structure: Source and destination ports each occupy 16 bits (0–65535), positioned at the start of the TCP header in network byte order.
•Purpose: Ports enable multiplexing (many applications sharing one network interface) and demultiplexing (directing incoming data to correct processes).
•Three Ranges: Well-known (0–1023) for standard services, registered (1024–49151) for applications, and ephemeral (49152–65535) for temporary client connections.
•Four-Tuple Identity: Connections are uniquely identified by (source IP, source port, destination IP, destination port), enabling thousands of simultaneous connections to the same server port.
•Socket Addresses: The combination of IP address and port (e.g., 192.168.1.100:8080) uniquely identifies a network endpoint.
•Security Implications: Port scanning, hijacking, and proper firewall configuration are critical considerations for network security.

What's Next:

Page Complete