Ports

A single machine that has one IP address, but runs many services simultaneously, how does it know which incoming packet goes to which service?

A port is a 16-bit unsigned integer used by the transport Layer (TCP/UDP) to uniquely identify a communication endpoint on a host, enabling multiple concurrent network connections over the same IP address.

Range from 0-65535 because 16-bits = $2^{16}$ = 65536 possible values

Divided by IANA standards into three main categories:

Well-Known Ports

This table covers some of the frequently used ports in networking and security contexts. For a full reference, IANA maintains a complete list of all assigned ports.

Registered ports

Dynamic / Private / Ephemeral Ports

When a client initiates a TCP connection, the OS assigns a source port (typically from the ephemeral port range) if you didn’t explicitly bind one.

Ephemeral ports are just the pool of ports the OS can automatically allocate.

So Ephemeral ports are used only for outbound connections where the client does not explicitly specify a source port.

Open vs Closed vs Filtered Ports

When a host receives network traffic targeting a specific TCP or UDP port, the OS or firewall can classify the port’s state as Open, Closed or Filtered

Open

A port is open if an application (process) on the host is actively listening on that port for incoming connections or datagrams, and the host responds to incoming packets directed to this port according to the transport protocol.

Closed

A port is closed if there is no application listening on that port, but the host is reachable. The host responds to incoming packets with a protocol-specific port unreachable message.

Filtered

A filtered port is a port where incoming packets are dropped or blocked, preventing the scanner from determining whether the port is open or closed or even online.

4-Tuple / 5-Tuple

A 5-tuple consists of the following five elements:

1. Source IP address
2. Source port
3. Destination IP address
4. Destination port
5. Transport protocol (TCP or UDP)

the 5-tuple defines a unique socket connection on the network.

When a process opens a TCP or UDP socket and sends/receives data, the operating system kernel must manage and track active connections, so it can deliver incoming packets to the correct process or socket.

TCP Example

For TCP, which is connection-oriented, the kernel maintains a TCP control block (TCB) for each active connection.

No two active TCP connections can have the same 5-tuple.

For example: Two browser tabs can connect to the same server, but different source ports make the 5-tuples unique, and vice versa.

The kernel uses the 5-tuple to route incoming packets to the correct socket.

UDP Example

Unlike TCP, UDP does not need a TCB because there is no connection state. UDP is connectionless, the kernel just routes it to the correct socket based on the 5-tuple.

Same thing here, no two UDP connections can have the same 5-tuple. Multiple UDP flows can share the same source port, as long as destination IP or port differs, making the 5-tuple unique.