Quick Summary
- A port is a 16-bit number (0–65535) that names one application on a host, so a single IP can run many services at once
- A socket is an endpoint: an IP address plus a port (plus the protocol) -- and a TCP connection is uniquely identified by the 4-tuple of source IP, source port, destination IP, destination port
- Well-known ports (0–1023) host standard services like HTTP 80 and SSH 22, while clients borrow temporary ephemeral ports (49152–65535) for outgoing connections
The Apartment Building Analogy
Imagine a packet of data is a letter being delivered. The IP address is the street address of a big apartment building -- it gets the letter to the right building, but no further. Inside that building are hundreds of apartments. The port number is the apartment number: it tells the mail carrier exactly which unit (which application) should receive the letter.
This is why one server with a single IP address can host a website, an email service, and a remote-login service all at the same time. They each live in a different "apartment": the website answers on port 443, email on port 25, and SSH on port 22. The IP address gets you to the building; the port gets you to the right door.
A socket takes the analogy one step further. A socket is the specific mailbox where a conversation actually happens -- the full combination of IP address + port + protocol. When your laptop talks to a web server, both ends have a socket, and the pairing of the two is what makes the conversation unique. That pairing is called the 4-tuple, and it is the reason you can open twenty browser tabs to the same website without the replies getting jumbled.
Visualizing an IP, a Port, and a Socket
Here is how an IP address and a port combine into a socket, and how two sockets form one TCP connection:
Try It Yourself: Port Lookup & Socket Builder
Type a port number, or click a service, to see its standard assignment and IANA range category.
A client (your laptop) opens a connection to a server. Pick the destination service to watch the 4-tuple update live. The source port is a random ephemeral port.
Open a second tab and the client picks a different ephemeral source port, so the two connections never collide.
Notice what the widget shows: the same destination port (say 443) can serve thousands of simultaneous clients, because each client connection carries a different source port. The server keeps the conversations apart using the full 4-tuple, not the port alone.
Ports and Sockets, Step by Step
A Port Is a 16-Bit Number
A port is a number from 0 to 65535 -- that range exists because a port field is 16 bits wide (216 = 65536 possibilities). The port number identifies which application on a host a packet is for. This is how a single IP address can run many services at once: the operating system reads the destination port and hands the data to the right program. Ports exist independently for TCP and UDP, so TCP 53 and UDP 53 are two separate things.
The Three IANA Port Ranges
IANA divides the port space into three ranges. Well-known / system ports (0–1023) are reserved for standard services -- HTTP 80, HTTPS 443, SSH 22, DNS 53, FTP 21/20, SMTP 25, Telnet 23, DHCP 67/68, RDP 3389, NTP 123, SNMP 161. Registered ports (1024–49151) are assigned to specific applications -- MySQL 3306, PostgreSQL 5432, HTTP-alt 8080. Dynamic / ephemeral ports (49152–65535) are short-lived ports a client borrows as its temporary source port.
A Socket Is an Endpoint
A socket is the combination of an IP address and a port (plus the protocol, TCP or UDP). It is one endpoint of a communication channel. A server creates a listening socket on a well-known port and waits for clients to connect; a client creates its own socket using an ephemeral source port. When people talk about an "open port," they mean a socket that is listening and accepting connections -- exactly what a port scanner probes for.
The 4-Tuple Identifies a Connection
A single TCP connection is uniquely identified by a 4-tuple: (source IP, source port, destination IP, destination port). This is the secret to having many tabs open to the same server at once -- every connection shares the destination IP and port, but each one uses a different ephemeral source port, so the 4-tuples never collide. The operating system uses this 4-tuple to route each incoming packet back to the correct connection.
Ports and Sockets in the Real World
You touch ports and sockets every time you use the internet. Here are three everyday scenarios:
Loading a Web Page
Your browser opens a socket to the server's 443 (HTTPS) and picks a random source port like
52310. The connection is the 4-tuple of your socket and the server's socket. Load images,
scripts, and styles and the browser opens several connections at once -- each with its own ephemeral
source port.
SSH into a Server
When you run ssh user@host, your client connects to the server's listening socket on
TCP 22. The server has been waiting on that well-known port. Your laptop's end of the
conversation uses an ephemeral source port, so you can hold several SSH sessions to the same host
simultaneously.
One DNS Port, Two Protocols
DNS uses port 53 on both UDP and TCP. Most quick lookups go over
UDP 53; larger responses and zone transfers fall back to TCP 53. Because TCP
and UDP have separate port spaces, these never conflict -- they are genuinely different endpoints.
Common Mistakes
A few misunderstandings about ports trip up almost every beginner. Watch for these:
Confusing a Port with a Socket
A port is just a number; a socket is a full endpoint (IP + port + protocol). Saying "the connection uses port 443" is only half the story -- a connection is identified by the whole 4-tuple. Two clients can both talk to port 443 at the same time precisely because their sockets differ, even though the destination port is identical.
Assuming TCP and UDP Share a Port
TCP port 53 and UDP port 53 are not the same endpoint. They live in separate port
spaces. A firewall rule that allows UDP 53 does nothing for TCP 53, which is a
classic reason large DNS responses or zone transfers mysteriously fail while small lookups work fine.
Thinking the Client Uses the Well-Known Port
When you connect to a web server, your laptop does not send from port 443. The server
listens on 443; your client picks a temporary ephemeral source port
(49152–65535). Mixing up which side owns the well-known port leads to incorrect firewall rules and
confusion when reading netstat output.
Listening Sockets and "Open Ports"
A server program asks the operating system to bind to a port and listen for
incoming connections. That creates a listening socket -- for example, a web server listening
on 0.0.0.0:443 accepts HTTPS from any interface. When a port scanner reports an "open port," it
has found a socket that is listening and willing to accept a connection. A "closed port" means nothing is
listening there. This is why hardening a server is largely about closing ports you do not need: every
listening socket is a potential door, and you only want the doors you actually use to be open.
How One IP Handles Thousands of Connections
It can seem impossible that a busy server with one IP address and one listening port (say 443)
handles tens of thousands of simultaneous users. The 4-tuple is what makes it work. Every connection shares
the same destination IP and destination port, but each client contributes a unique combination of
source IP and source port. Because the full 4-tuple differs for every connection, the server's operating
system can keep every conversation perfectly separate and deliver each packet to the right session. Ports and
sockets, working together, are what let the internet scale.
The bottom line: the IP address finds the host, the port finds the application, and the socket -- IP plus port plus protocol -- is the endpoint where a conversation lives. Remember that a connection is a 4-tuple, not a single port, and the rest of networking gets much easier to reason about.
Frequently asked questions about ports and sockets
What is a network port?
A network port is a 16-bit number from 0 to 65535 that identifies a specific application or service on a host. Because each connection carries a port number alongside the IP address, a single IP can run many services at once, such as a web server on port 443 and an SSH server on port 22.
What is the difference between a port and a socket?
A port is just a number that names a service on a host. A socket is the full endpoint of communication: an IP address plus a port (plus the protocol, TCP or UDP). A complete TCP connection is uniquely identified by a 4-tuple of source IP, source port, destination IP, and destination port.
What are well-known ports?
Well-known or system ports are the range 0–1023, assigned by IANA to common services. Examples include HTTP on 80, HTTPS on 443, SSH on 22, DNS on 53, SMTP on 25, and FTP on 21. These standard numbers let clients connect to a service without being told which port to use.
What is an ephemeral port?
An ephemeral port is a temporary source port a client picks for an outgoing connection, drawn from the dynamic range 49152–65535. Each new connection gets its own ephemeral port, which is how your laptop can open many tabs to the same server at once without the replies getting confused.
Can TCP and UDP use the same port number?
Yes. TCP and UDP maintain separate port spaces, so TCP 53 and UDP 53 are completely independent. DNS is the classic example: it uses UDP 53 for most lookups and TCP 53 for larger responses and zone transfers, and the two never interfere.
Try the networking lab
You just learned how ports name applications and how sockets form connections. Now open services on a server's ports, trace connections to open and closed ports, and on a running lab list the listening sockets with ss -ltn. The socket builder above shows how the 4-tuple identifies each connection.