Ports, TCP and UDP for Beginners (Networking 101)

1 explain

Which program is this for?

One address, lots of programs

A block of flats has one street address, but dozens of people live there. A parcel needs the street address and a flat number, or it sits in the hall.

A computer is the same. Its IP address (lesson 3.1) gets a message to the right computer. But on that computer a web browser, an email app and a video call are all running at once, and the message is for one of them. The flat number is the port number: a number from 0 to 65535 that says which program.

You met ports in lesson 1.2: they’re layer 4, transport. And in lesson 4.1, DHCP’s messages went to port 67 on the server and back to port 68 on the laptop.

in one sentence The IP address finds the computer; the port number finds the program on it.

Listening, and source and destination ports

A program that offers a service, like a web server, listens on a port: it tells the computer anything that arrives for port 443 is mine. Everyone knows the number in advance, so nobody has to ask.

Every message carries two ports, like it carries two IP addresses:

	Who picks it	Example, laptop to web server
destination port	the service’s well-known number	`443`: the secure web server
source port	the computer that starts the conversation picks a spare one, for this conversation only	`51000`

That temporary source port is called an ephemeral port (ephemeral means short-lived). When the server answers, it swaps them round: the answer comes from 443 and goes to 51000, so the laptop knows which program, and which conversation, it’s for.

Which numbers count as spare depends on the system. Windows and macOS pick from 49152 to 65535; Linux, by default, from 32768 to 60999.

in one sentence The destination port is the service’s well-known number; the source port is a temporary one the asking computer picks.

Sockets

An IP address and a port together are called a socket, written with a colon: 192.168.1.10:51000. A conversation between two programs is two sockets, one at each end:

192.168.1.10:51000  ⇄  192.168.2.10:443
   the laptop            the web server

Open a second tab to the same site and you get a second conversation, 192.168.1.10:51001 ⇄ 192.168.2.10:443. The server’s side is the same; the laptop’s port is different. That’s how one computer keeps dozens of conversations apart.

in one sentence A socket is an IP address plus a port; a conversation is a pair of sockets.

Two ways to send: TCP and UDP

Layer 4 has two main protocols, and every port number belongs to one of them (or to both, separately: TCP port 53 and UDP port 53 are two different doors).

	TCP	UDP
stands for	Transmission Control Protocol	User Datagram Protocol
like	a phone call: you say hello first, and you know if the other side hung up	a postcard: you write it and post it
before sending	a three-way handshake sets up a connection	nothing: it just sends
lost pieces	noticed and sent again; pieces arrive in order	lost is lost; the program has to ask again if it cares
cost	slower to start, more to keep track of	quick and light
used for	web pages, email, file copies, logging in to a router: anything that must arrive whole	DNS questions, DHCP, the time (NTP), monitoring (SNMP), voice and video calls

Voice and video use UDP for a reason: a bit of sound that arrives late is no use, so there’s no point sending it again. Better to skip it and carry on.

in one sentence TCP sets up a connection and makes sure everything arrives; UDP just sends, and is quicker for it.

The three-way handshake

Before TCP sends any data, the two sides agree to talk. Three messages, named after the flags they carry (a flag is a switch in the TCP header, on or off):

SYN (synchronise): the laptop says I’d like to talk, and I’ll number my pieces starting here.
SYN-ACK: the server says OK (ACK, acknowledge) and here’s where my numbering starts (SYN).
ACK: the laptop says got it.

Now the connection is established, and data flows both ways. Every piece is numbered, and the other side acknowledges what it got, so anything missing is noticed and sent again. When they’re done, each side sends a FIN (finish) to close it.

in one sentence SYN, SYN-ACK, ACK: TCP’s hello, before any data.

Three ranges

The numbers 0 to 65535 are split into three ranges. IANA, the Internet Assigned Numbers Authority, the organisation that keeps the official list, writes down who each number is for.

Range	Name	What’s in it
`0`–`1023`	well-known (system) ports	the core services: web, email, DNS, SSH. On Linux, only an administrator’s program may listen on these
`1024`–`49151`	registered (user) ports	services a company or project asked IANA for, like RDP on `3389`
`49152`–`65535`	dynamic (private) ports	never given to anyone: free for ephemeral ports

2 show

The common ports

You don’t need all 65,536. These are the ones network engineers see every day, from IANA’s list and the RFC (the standard) for each protocol:

Port	Protocol	Name	What it’s for
`20`, `21`	TCP	FTP	File Transfer Protocol: copying files. 21 carries the commands; 20 carries the files in FTP’s older active mode. Sends passwords as plain text
`22`	TCP	SSH	Secure Shell: logging in to a switch, router or server and typing commands, encrypted. Also carries file copies (SCP, SFTP)
`23`	TCP	Telnet	the same job as SSH, but not encrypted: anyone who can see the traffic can read the password. Turned off on modern kit
`25`	TCP	SMTP	Simple Mail Transfer Protocol: email servers passing mail to each other. Your mail app usually sends on `587` instead (submission)
`53`	UDP and TCP	DNS	Domain Name System: names to addresses. Questions go over UDP; big answers and copies of whole zones go over TCP
`67`, `68`	UDP	DHCP	`67` is the server, `68` the client: lesson 4.1
`69`	UDP	TFTP	Trivial File Transfer Protocol: a very simple file copy, no password at all. Often used to load software onto network kit
`80`	TCP	HTTP	web pages, not encrypted
`110`, `143`	TCP	POP3, IMAP	collecting email from a mail server (encrypted versions: `995`, `993`)
`123`	UDP	NTP	Network Time Protocol: keeps every device’s clock right, which matters when you compare their logs
`161`, `162`	UDP	SNMP	Simple Network Management Protocol: monitoring. The monitoring server asks devices on `161`; devices send alerts (traps) to it on `162`
`179`	TCP	BGP	Border Gateway Protocol: routers telling each other which networks they can reach, across the internet
`389`, `636`	TCP	LDAP, LDAPS	looking up users and passwords in a directory. `636` is the encrypted one
`443`	TCP (and UDP)	HTTPS	web pages, encrypted with TLS. The newest version, HTTP/3, usually runs on UDP `443`
`514`	UDP	syslog	devices sending their log messages to a log server (over TLS, it’s TCP `6514`)
`3389`	TCP	RDP	Remote Desktop Protocol: using a Windows computer’s screen from somewhere else

Notice the pairs: plain and encrypted versions of the same service usually have different ports (80 and 443, 143 and 993, 389 and 636). The port tells you which one you’re talking to.

A port number is an agreement, not a law. You can run a web server on port 8080, and people often do. The well-known numbers are just where everyone looks first.

in one sentence A handful of numbers cover most of what you’ll see: 22, 53, 80, 443, and the rest of this table.

3 follow along

Watch the ports

A laptop at 192.168.1.10 looks up a name, then opens a secure web page, twice. Press Play, or step with →. In each step, look at layer 4 in the box under the diagram: the protocol, and the two ports.

What to notice:

The destination port on the way out is always the service’s well-known number: 53, 443.
The source port is one the laptop picks, a new one for each conversation.
On the way back, the two ports swap places.
UDP: one message each way. TCP: three messages of handshake before any data.

in one sentence Out to the service’s port from a temporary one; back with the two swapped.

Why firewalls care about ports

A firewall sits between networks and decides which messages may pass. A router can do a simpler version of the same job with an ACL (access control list): a list of permit and deny lines it checks, top to bottom. Both decide mostly on four things in each message: the protocol (TCP or UDP), the source and destination IP address, and the destination port.

The destination port is what says which service. So let people reach the web server, and nothing else on it becomes allow TCP to 192.168.2.10 port 443. Here it is as a router’s ACL line:

permit tcp any host 192.168.2.10 eq 443

Permit TCP from any address to the one host 192.168.2.10, when the destination port equals 443. At the end of every list is an unwritten deny everything else, so SSH, Telnet and the rest are blocked without anyone writing a line for them.

What about the answers coming back? They’re from port 443 to some ephemeral port, which nobody can know in advance. A stateful firewall solves that: it remembers each conversation it let out, and lets that conversation’s answers back in. That’s what the established in the table above is for.

in one sentence Firewalls and ACLs pick which services to allow by protocol and destination port; a stateful firewall lets the answers back in.

Try it on your own computer (optional)

You can list your own computer’s conversations, with both sockets for each.

On Windows, open Command Prompt and type:

netstat -an

On a Mac, open Terminal and type:

netstat -an -p tcp

Each line is one conversation: your socket on the left (Local Address), the other end’s on the right (Foreign Address), and its state. ESTABLISHED is a connection that finished its handshake; LISTEN (Windows says LISTENING) is a program waiting for one. Look for a :443 on the right: that’s a secure website, and your side of it has a high, temporary port. (On a Mac, the port comes after a dot instead of a colon: 192.168.1.10.51000.)

4 challenge

Get past the firewall

A small office has this firewall in front of its servers:

#	protocol	to	port	action
1	TCP	`10.1.1.20`	`22`	allow
2	TCP	`10.1.1.30`	`443`	allow
3	UDP	`10.1.1.53`	`53`	allow
4	any	any	any	deny

For each attempt below, say which rule it matches and whether it gets through:

an engineer logs in to 10.1.1.20 with SSH;
the same engineer tries Telnet to 10.1.1.20;
a browser opens https://10.1.1.30;
a browser opens http://10.1.1.30 (no s);
a laptop asks 10.1.1.53 for a name, in a normal small DNS question;
the same laptop asks 10.1.1.53 for a name whose answer is too big for one UDP message.

hint

Turn each attempt into protocol and destination port first, from the common-ports table. Then go down the rules from the top: the first one that matches wins.

hint

http:// and https:// are different ports. And when a DNS answer doesn’t fit, the computer asks again over the other protocol, on the same port number.

show the solution

	Attempt	Protocol and port	Rule	Result
1	SSH to `10.1.1.20`	TCP `22`	1	allowed
2	Telnet to `10.1.1.20`	TCP `23`	4	blocked: the right server, but the wrong port
3	HTTPS to `10.1.1.30`	TCP `443`	2	allowed
4	HTTP to `10.1.1.30`	TCP `80`	4	blocked: plain HTTP is a different port
5	DNS question to `10.1.1.53`	UDP `53`	3	allowed
6	big DNS answer from `10.1.1.53`	TCP `53`	4	blocked: rule 3 only allows UDP

Number 6 is a real fault: everyday names work, and the odd one with a big answer fails, which is confusing until you remember DNS uses both UDP and TCP on port 53. The fix is a fifth rule, above the deny: allow TCP to 10.1.1.53 port 53.

Ports: TCP, UDP and the common numbers

objective