Network+ (N10-009) · ELI Explains Port Numbers (book)
Understanding Ports Before Using This Guide
On this page 3 sections
The college version
What Is a Network Port?
A network port is a number that helps a computer decide which program should receive incoming data. Think of an IP address as a building's street address and a port number as the apartment number inside that building. The IP address gets data to the right computer; the port number gets it to the right program on that computer.
Why Port Numbers Exist
Computers run many programs at once — web browsers, email clients, chat applications, file-sharing tools. When data arrives from the network, the operating system needs to know which program to deliver it to. Port numbers solve this problem. A web server listening on port 80 receives web requests; a mail server listening on port 25 receives email. Without port numbers, a computer couldn't run more than one network service at a time.
TCP vs. UDP
TCP and UDP are the two most familiar transport protocols that use port numbers. They provide different delivery behavior.
TCP (Transmission Control Protocol) is like a tracked package delivery. The endpoints establish a connection, and TCP provides an ordered byte stream with acknowledgments and retransmission. Applications use TCP when ordered, reliable transport matters, including web browsing, email, and file transfer.
UDP (User Datagram Protocol) is like sending postcards. It sends independent datagrams without first establishing a connection and provides no built-in acknowledgment, ordering, or retransmission. Applications may choose UDP for DNS, real-time media, games, and other traffic whose timing or message model fits that behavior.
TCP and UDP can use the same port number because they are separate protocols. Port 53 over UDP handles many DNS queries, while TCP port 53 is used for zone transfers and whenever a reliable stream is required, including some large or truncated responses. The operating system treats the TCP and UDP endpoints separately.
Listening, Open, Closed, and Filtered
A listening port means a program has bound a socket and asked the operating system to deliver matching traffic to it. A web server may listen on TCP port 80.
For TCP scanning, an open port normally means a service accepted the connection. A closed TCP port normally answers with a reset because no service is listening. A filtered result means a firewall or other control prevented a conclusive response. UDP results are less direct because UDP has no connection handshake.
Default vs. Configurable
A default port is what a service uses out of the box — SSH on port 22, HTTPS on port 443. But these are defaults, not requirements. A system administrator can configure SSH to listen on port 2222 instead. The port number alone never proves which application is running. You must verify the actual service directly.
Port Ranges
Port 0 is reserved and never used as a valid destination port. In some programming contexts, requesting port 0 tells the operating system to assign any available port.
Ports 1–1023 are the system, or well-known, range. Many Unix-like systems restrict binding to these ports to privileged processes, although the rule is operating-system and configuration dependent. Services such as HTTP (80), SSH (22), and DNS (53) are assigned here.
Ports 1024–49151 are the user, or registered, range. IANA may assign ports in this range to named services, and applications also commonly use it for databases, messaging, and development tools.
Ports 49152–65535 are "dynamic" or "private" ports. These are typically used as temporary source ports for outgoing client connections.
An Open Port Is Not Automatically Dangerous
An open port means a service is available. That service might be well-secured, properly patched, and restricted to authorized users — or it might not be. The port number itself tells you nothing about security. What matters is the service behind it, how it's configured, who can reach it, and whether it's kept up to date.
Eli explains
The same idea, in plain words
Explain it like I’m 10
Imagine a giant apartment building. The building's street address is like an IP address — it gets you to the right building. But once you're inside the lobby, you need to know which apartment to knock on. That's the port number.
Apartment 80 is where the web server lives. Apartment 22 is the SSH administrator's office with a heavy locked door. Apartment 25 sorts all the mail. Some apartments use a reliable courier service (TCP) that makes sure packages arrive. Others use a fast messenger on a bicycle (UDP) who might drop a letter but gets there quicker.
When your computer wants to visit a website, it sends a request to the building's address, knocks on door 443, and says "I'd like the homepage, please." The web server inside apartment 443 sends the page back. Your computer gave the web server a temporary return apartment number — maybe door 52143 — so the response comes back to the right place.
Not every apartment door that's unlocked is dangerous. It just means someone lives there. What matters is who has the key and what they're allowed to do inside.
Study tools & related lessonsRelated
Educational content only. It is not medical, legal or professional advice. Found an error? Tell us.