What Is a Network Socket?

What a Socket Is

A socket is a communication endpoint. It combines an IP address and a port number into a single abstraction that applications use to send and receive data over a network. Every network connection - every web page load, every DNS query, every SSH session - uses sockets at both ends.

The concept is simple: an IP address identifies a machine, a port number identifies a service on that machine, and a socket ties them together into something a program can read from and write to. The operating system manages the underlying TCP/IP stack; the application just reads and writes to the socket.

IP Address + Port = Socket

A socket is defined by a tuple: (IP address, port number, protocol). For TCP, a connection is identified by a 5-tuple: (source IP, source port, destination IP, destination port, TCP). This 5-tuple is unique for every active connection on a machine.

When your browser connects to a web server, it creates a socket with your local IP and a random ephemeral port (e.g., 192.168.1.50:52847). The server has a socket at its IP and port 443 (e.g., 93.184.216.34:443). Data flows between these two sockets.

A server can handle thousands of simultaneous connections on the same port because each connection has a unique 5-tuple. Port 443 on the server is shared, but the combination of source IP + source port makes each connection distinguishable.

sequenceDiagram
    participant S as Server
    participant C as Client
    S->>S: socket() + bind() + listen()
    C->>S: connect() (SYN)
    S->>C: SYN-ACK
    C->>S: ACK
    S->>S: accept()
    C->>S: write(data)
    S->>C: write(response)
    C->>S: close()

TCP socket lifecycle: server listens, client connects via three-way handshake, data flows, connection closes.

Socket Types

Stream sockets (SOCK_STREAM) use TCP. They provide reliable, ordered, bidirectional byte streams. Data sent on one end arrives in the same order on the other end. If a packet is lost, TCP retransmits it. This is what web browsers, SSH clients, and most applications use.

Datagram sockets (SOCK_DGRAM) use UDP. They send discrete messages (datagrams) without connection setup, ordering guarantees, or delivery confirmation. Each send() produces one datagram; each recv() returns one datagram. DNS queries, VoIP, and online games typically use datagram sockets.

Raw sockets (SOCK_RAW) bypass the transport layer entirely. They give the application direct access to IP-level packets, allowing it to construct custom headers. Network monitoring tools, ping (ICMP), and packet crafting tools use raw sockets. On most systems, raw sockets require root/administrator privileges.

How Socket Connections Work

For TCP (stream sockets), the connection follows a pattern:

1. Server creates a socket and binds it to an address (IP + port)
2. Server calls listen() to start accepting connections
3. Client creates a socket and calls connect() to the server's address
4. TCP three-way handshake completes (SYN, SYN-ACK, ACK)
5. Server calls accept() which returns a new socket for this specific client
6. Both sides read() and write() on their sockets
7. Either side calls close() to terminate the connection

The server's original socket continues listening for new connections. Each accepted client gets its own socket. This is how a web server handles thousands of clients simultaneously on port 443 - one listening socket, thousands of accepted connection sockets.

Socket States

TCP sockets transition through states during their lifecycle: CLOSED, LISTEN, SYN_SENT, SYN_RECEIVED, ESTABLISHED, FIN_WAIT_1, FIN_WAIT_2, CLOSE_WAIT, LAST_ACK, TIME_WAIT. The ESTABLISHED state is where data transfer happens. TIME_WAIT lingers after close to catch any straggling packets.

On Linux, ss -tuln or netstat -tuln shows all sockets and their states. LISTEN sockets are services waiting for connections. ESTABLISHED sockets are active connections. A large number of TIME_WAIT sockets can indicate connection churn.

Why This Matters

Sockets are the interface between applications and the network. Every tool a security researcher uses - from Nmap to Wireshark to custom exploit code - operates through sockets. Understanding sockets means understanding how data actually enters and leaves a machine.

When the BLEShark Nano runs its captive portal web server, it creates a TCP socket on port 80, listens for incoming connections, and serves HTTP responses to each connected client through individual accepted sockets. The entire web portal interaction is socket-level communication.

Get the BLEShark Nano