What Is a Port Number?

What Port Numbers Do

An IP address identifies a device on the network. A port number identifies a specific service or application on that device. Together, an IP address and port number form a socket - the unique endpoint for a network connection.

A single server with one IP address can run a web server (port 80/443), an SSH server (port 22), a mail server (port 25), and a DNS server (port 53) simultaneously. Port numbers are how the operating system knows which application should receive each incoming packet.

Port numbers are 16-bit unsigned integers, ranging from 0 to 65,535. Both TCP and UDP use port numbers independently - TCP port 80 and UDP port 80 are different endpoints. A packet's transport protocol (TCP or UDP) plus its port number together identify the destination application.

Port Ranges

The 65,536 available port numbers are divided into three ranges:

Well-known ports (0-1023) - assigned by IANA to common services. On Unix/Linux systems, binding to a port below 1024 requires root privileges, which provides a basic assurance that the service was started by a system administrator. Examples: HTTP (80), HTTPS (443), SSH (22), DNS (53), SMTP (25).

Registered ports (1024-49151) - assigned by IANA to specific applications upon request, but do not require elevated privileges. Examples: MySQL (3306), PostgreSQL (5432), RDP (3389), VNC (5900).

Dynamic/ephemeral ports (49152-65535) - used by the operating system for outbound connections. When your browser connects to a web server on port 443, the browser's side of the connection uses a random ephemeral port (e.g., 52847). The server's response comes back to that ephemeral port. Once the connection closes, the port is returned to the available pool.

Well-Known Ports

Security professionals memorize the most common port assignments because they appear constantly in traffic analysis and scanning results:

Port	Protocol	Service
20/21	TCP	FTP (data/control)
22	TCP	SSH (Secure Shell)
23	TCP	Telnet (unencrypted remote access)
25	TCP	SMTP (email sending)
53	TCP/UDP	DNS (domain name resolution)
67/68	UDP	DHCP (server/client)
80	TCP	HTTP (web traffic)
110	TCP	POP3 (email retrieval)
143	TCP	IMAP (email retrieval)
443	TCP	HTTPS (encrypted web traffic)
445	TCP	SMB (Windows file sharing)
993	TCP	IMAPS (encrypted IMAP)
1883	TCP	MQTT (IoT messaging, unencrypted)
3306	TCP	MySQL database
3389	TCP	RDP (Remote Desktop Protocol)
5900	TCP	VNC (remote display)
8080	TCP	HTTP alternate (proxies, dev servers)
8883	TCP	MQTT over TLS (encrypted IoT messaging)

Knowing these mappings lets you quickly interpret network traffic. Seeing traffic on port 3389 tells you someone is using Remote Desktop. Traffic on port 1883 suggests an unencrypted IoT device. Port 23 traffic means someone is using Telnet - which transmits everything, including passwords, in plaintext.

graph TD
    subgraph "One Server, Multiple Services"
        SRV["Server: 93.184.216.34"]
        P80["Port 80: HTTP"]
        P443["Port 443: HTTPS"]
        P22["Port 22: SSH"]
        P53["Port 53: DNS"]
        P25["Port 25: SMTP"]
    end
    SRV --- P80
    SRV --- P443
    SRV --- P22
    SRV --- P53
    SRV --- P25

How Ports Work in Practice

When you open https://example.com in your browser, the following happens at the port level:

1. Your browser opens a connection from your IP (e.g., 192.168.1.50) using an ephemeral port (e.g., 52847) to the server's IP on port 443
2. The connection is identified by the tuple: (source IP, source port, destination IP, destination port, protocol) - (192.168.1.50, 52847, 93.184.216.34, 443, TCP)
3. If you open a second tab to the same server, the browser uses a different ephemeral port (e.g., 52848), creating a second unique connection tuple
4. The server's operating system uses the destination port (443) to route incoming packets to the web server process, and uses the source port to distinguish between your two connections

A busy web server can have thousands of simultaneous connections, all on port 443. The connections are distinguished by the combination of source IP and source port, not by the destination port alone.

Port Scanning

Port scanning is the process of probing a host to discover which ports are open (have a service listening) and which are closed or filtered. It is one of the most fundamental reconnaissance techniques in security testing.

A TCP port scan works by attempting to complete the three-way handshake on each port. If the target responds with SYN-ACK, the port is open (a service is listening). If it responds with RST, the port is closed. If there is no response, the port may be filtered by a firewall.

A UDP port scan sends a UDP packet to each port. If the target responds with ICMP Port Unreachable, the port is closed. No response means the port might be open or filtered. UDP scanning is slower and less reliable than TCP scanning because of this ambiguity.

Nmap is the standard tool for port scanning. A typical scan tests 1,000 common ports, but a full scan covers all 65,535 TCP and 65,535 UDP ports.

Ports and Security

Every open port is a potential entry point. Reducing the number of open ports (by disabling unnecessary services) is a basic hardening practice. Firewalls enforce which ports are accessible from which networks.

Port numbers are conventions, not enforcements. A web server can run on port 8080 or 9999 instead of 80. An SSH server can listen on port 2222 instead of 22. Changing default ports is called "security through obscurity" - it slows down automated scanners but does not stop a determined attacker who scans all ports.

When the BLEShark Nano operates as a rogue access point, its captive portal runs an HTTP server that clients connect to. Understanding port numbers helps you interpret the traffic flowing through the Nano during an authorized assessment - DNS queries on port 53 being redirected, HTTP connections on port 80 being served the portal page, and all other traffic being either blocked or passed through depending on the configuration.

Get the BLEShark Nano