What are ports?
An IP address gets network traffic to the right device. A port helps that device send the traffic to the right service.
One device. Many services.
A computer or server can run several network services at the same time. They may all use the same IP address, so we need another way to tell them apart.
That's where ports come in.
Port: Which service?
For example:
In this example, 203.0.113.42 identifies the destination host and 443 identifies the destination port.
There are thousands of them.
TCP and UDP port numbers range from 0 to 65535.
Some ports are commonly associated with particular services. These conventions make it easier for clients to know where to connect.
SSH
DNS
HTTP
HTTPS
Ports exist in both TCP and UDP.
TCP
TCP establishes a connection and provides reliable, ordered delivery of data.
Common examples include HTTPS, SSH and many email services.
UDP
UDP sends datagrams without establishing the same type of connection and has much less protocol overhead.
It is commonly used where speed and low latency are important, and is also used by services such as DNS.
Some useful ones to recognise.
Your computer uses ports too.
When you visit a website, the server may be listening on TCP port 443, but your computer also needs a temporary local port for its side of the connection.
The temporary client-side port is often called an ephemeral port.
This allows your computer to keep track of many network connections at the same time.
Open, closed or filtered?
When security tools examine a host, you will often see ports described using terms such as open, closed or filtered.
A service appears to be listening and accepting connections on that port.
The host can be reached, but no service appears to be listening on that port.
A firewall or another network control may be preventing the scanner from determining the port's state.
Ports help control network access.
Firewalls can allow or block traffic using information including source and destination IP addresses, protocols and port numbers.
This is one reason exposing unnecessary services to the internet increases attack surface.
Why SOC analysts care about ports.
Port information can help an analyst understand what a network connection was trying to reach and whether the activity fits the expected behaviour of the system.
DST=203.0.113.42
PROTO=TCP
SPT=52144
DPT=443
ACTION=ALLOW
Here, SPT represents the source port and DPT represents the destination port.
Destination port 443 suggests HTTPS traffic, but an analyst should not assume that the traffic is safe simply because it uses a familiar port.
See which ports are listening.
On a Linux system, you can inspect listening TCP and UDP sockets with:
ss -tuln
From Windows PowerShell, you can test whether a remote TCP port can be reached:
Test-NetConnection example.com -Port 443
These are useful ways to connect the theory of ports with what is actually happening on a real system.
IP gets you to the machine. Port gets you to the service.
Protocol → TCP or UDP
Port → destination service
Once you understand those three pieces, firewall logs, network connections and port scans become much easier to read.
Routers & NAT.
Next we'll look at how routers move traffic between networks and how NAT allows many private devices to share a public internet connection.