Ports and sockets

Aisha has a browser, a music app and a chat window open at once. All three are downloading data. All three arrive at the same IP address. Nothing gets mixed up.

Why & what

Why ports exist. An IP address identifies a machine. That is all it does.

But a machine runs many programs at once. When a packet lands on 192.168.1.42, the operating system has to decide: is this for the browser, the music app, or the chat window?

The IP address cannot answer that. So a second number is added — one that identifies the program, not the machine.

What a port is. A port is a 16-bit number that identifies one program on a machine. Range: 0 to 65535.

They come in three groups.

• 0 – 1023, well-known ports. Fixed by agreement. Every web server in the world listens on 443, so your browser never has to ask.
• 1024 – 4G151, registered ports. Assigned to particular software.
• 4G152 – 65535, ephemeral ports. Your own machine picks one at random for each outgoing connection. Aisha's browser picked 51520 back in Module 5.

What a socket is. A socket is an IP address and port together: 203.0.113.10:443.

One socket alone does not identify a conversation. A conversation is identified by four things the source IP, source port, destination IP and destination port. This is called the 4-tuple.

That is why Aisha can open five tabs to the same website. Same destination socket every time, but a different source port for each tab, so all five stay separate.

Ports worth memorising: 20/21 FTP, 22 SSH, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS.

How it works

1. college.edu starts its web server, which binds to port 443 and waits.
2. Aisha's browser picks a free ephemeral port, 51520, for this connection.
3. It sends a segment to 203.0.113.10:443 with 192.168.1.42:51520 as the source.
4. The server's operating system sees port 443 in the header and hands the data to the web server, not the mail server.
5. The reply is addressed back to port 51520, so Aisha's OS hands it to the browser and not the music app.

Common confusion

Students think a port is something physical, like the socket you plug a cable into. Actually, a port is just a number in the segment header. Nothing physical exists.

The confusion is made worse by the word "socket", which in networking means an IP-and-port pair, not a hole in a wall. Nothing is opened or plugged in. The operating system simply keeps a list saying "port 443 belongs to this program", and reads the number off each arriving segment.

Interview angle

Asked as: "What is a port?" and "What is a socket?" Often followed by "which port does HTTPS use?"

Model answer:

A port is a 16-bit number in the transport header that identifies which program on a machine the data is for. The IP address gets the packet to the machine; the port gets it to the right process. Ports 0 to 1023 are well-known and fixed by convention, like 80 for HTTP, 443 for HTTPS, 22 for SSH and 53 for DNS. Clients use random high-numbered ephemeral ports for their side of a connection. A socket is an IP address and port together. A connection is actually identified by four values source IP, source port, destination IP and destination port which is how one machine can hold many simultaneous connections to the same server.