Section 7: Ports and Sockets

The Big Picture: Many Programs, One Address

Your PC has one IP address (per network), but it runs many programs that use the network at once: a browser with ten tabs, an email program, a game, Windows Update. When a packet arrives for 192.168.1.25, how does Windows know which program should get it?

Think of an apartment building. The building has one street address (the IP address). Each flat has a number (the port). The postal worker needs both, "12 Oak Street, flat 443", to deliver the letter to the right person.

7.1 Port Numbers (Identifying Services and Applications)

What it is: A port is a 16-bit number that identifies one program or service on a computer. With 16 bits there are 2¹⁶ = 65,536 ports, numbered 0 to 65535. TCP and UDP each have their own separate set of ports. (So TCP port 53 and UDP port 53 are two different things.)

Every TCP or UDP header has two ports: the source port (the sender's flat number) and the destination port (the receiver's flat number).

Three groups of ports:

(Windows uses the dynamic range 49152 to 65535 for temporary ports. Some other systems use slightly different ranges.)

Well-known ports to remember:

Other common ones: 25 and 587 (sending email), 110 and 143 (reading email, older), 21 (FTP, old), 123 (UDP, time sync).

Client and server roles. A server program listens on a fixed, well-known port and waits. A client program picks a random temporary (ephemeral) port for itself and connects to the server's port.

 Your browser                                    A web server
 192.168.1.25 : 50123  ──────────────────────►  93.184.216.34 : 443
  (random ephemeral port)                         (well-known HTTPS port)

 The server's reply goes back the other way:
 93.184.216.34 : 443   ──────────────────────►  192.168.1.25 : 50123

Why this lets you open many tabs. Each connection gets a different ephemeral source port. So the browser can talk to the same server twice (two tabs) and replies still go to the right connection.

Ports are not security by themselves. A port number is only a label. A program can use any port, and port 80 does not guarantee that the traffic is a real web page. Firewalls (Section 10) use ports as one of their rules, but ports are not a protection on their own.

Is a port open? A port is "open" when a program is listening on it and the firewall lets traffic through. A port is "closed" when nothing listens (the computer answers with a reset). A port is "filtered" when a firewall drops traffic silently.

7.2 The Socket Concept (IP + Port + Protocol)

What it is: A socket is one end of a network conversation. It is the combination of three things:

   Socket  =  IP address  +  port number  +  protocol (TCP or UDP)

   example:   192.168.1.25 : 50123 / TCP

Programs do not talk to the network card directly. They ask Windows for a socket, then send and receive through it, a lot like reading and writing a file. (On Windows this programming interface is called Winsock.)

A connection is identified by five numbers. Two sockets joined together make a connection. It is uniquely named by the 5-tuple (a "tuple" is just a list of values):

Change any one of the five and it is a different connection. That is how a web server can hold thousands of connections to port 443 at the same time: each client has a different source IP or source port.

Listening versus connected sockets.

The special addresses in netstat:

A program that listens on 127.0.0.1 is only for this PC. A program that listens on 0.0.0.0 can be reached from the network, if the firewall allows it. This is an important difference when you check what your PC exposes.

See the sockets on your own PC (read-only):

netstat -ano

The flags: -a shows all (listening and connected), -n shows numbers instead of names (faster), -o adds the owning PID.

From PID to program name. Take the PID and look it up in Task Manager → Details tab (the PID column; right-click a column header and choose Select columns if it is hidden). Now you can see which program talks to which address. The Resource Monitor (press Win + R, type resmon) does the same with a friendly view: its Network tab has Processes with Network Activity, Network Activity, TCP Connections and Listening Ports.

A short example of the output (yours will differ):

  Proto  Local Address          Foreign Address        State           PID
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       1092
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
  TCP    127.0.0.1:5040         0.0.0.0:0              LISTENING       7352
  TCP    192.168.1.25:50123     93.184.216.34:443      ESTABLISHED     9816
  UDP    0.0.0.0:5353           *:*                                    2210

Read the 4th line: the program with PID 9816 (say, a browser) has an open connection from your ephemeral port 50123 to a server's port 443 (HTTPS).

Ask about one port on a remote machine (only your own or a public service):

Test-NetConnection 192.168.1.1 -Port 80

Warning. Do not use this to probe other people's networks. Scanning many ports on machines you do not own can be treated as an attack and may be illegal.

Common questions:

Summary