4.3.1 Ports & Sockets

Understanding Ports and Sockets

In the context of networking, the transport layer must be able to deliver data not only to the right device, but also to the right application on that device. Ports and sockets are the key ideas that allow this to happen. They act as logical endpoints that let multiple applications share a single network connection at the same time without confusion.

This chapter focuses only on what ports and sockets are and how they relate to applications. Details of how TCP or UDP work internally are covered in later chapters of the transport layer section.

What Is a Port?

A port is a logical number that identifies a specific application or service on a device. If an IP address identifies the device, the port identifies the particular program that should receive the data on that device.

When a packet arrives at a host, the transport layer looks at the port number to decide which application should get the data. Without ports, your computer would not know whether incoming data is meant for your web browser, your email client, or a messaging app.

Ports are 16 bit numbers, so the range of possible port numbers is:

$$0 \le \text{port} \le 65535$$

Every transport layer segment for TCP or UDP contains a source port and a destination port. The destination port usually indicates the service being contacted, while the source port usually indicates the application that initiated the connection.

Port Ranges

Port numbers are divided into ranges that have different purposes. This helps operating systems and administrators know which ports are standard, which are reserved, and which are free for general use.

A common division of port ranges is:

Well known ports identify common network services. For example, web servers usually listen on a well known port so clients know where to connect.

Some widely used examples include:

A web server almost always listens on TCP port 80 or 443. A DNS server listens on port 53. Clients usually do not listen on well known ports. Instead, they use dynamic or ephemeral ports when they initiate connections.

Source Ports and Destination Ports

Every TCP or UDP segment contains two port values:

• A source port, representing the sending application on the source host.
• A destination port, representing the receiving application on the destination host.

On the client side, the operating system typically picks a random high numbered port from the dynamic range for the source port. The user application does not need to care about the exact number. On the server side, the application is configured to listen on a specific destination port so that clients know how to reach it.

For example, when you open a web page:

1. Your web browser asks the operating system to connect to the server on TCP port 443.
2. The operating system chooses an unused high port like 50432 as the source port.
3. The browser sends traffic from source port 50432 to destination port 443.
4. The server replies from source port 443 to destination port 50432.

From the server’s point of view, every client connection is identified by the client’s source port combined with the client’s IP address. This allows many clients to connect to the same server port at once without confusion.

What Is a Socket?

A socket is a combination of network information that uniquely identifies a single communication endpoint. In practice, a socket usually includes at least the IP address and the port number on one host. When describing a full connection between two hosts, you often deal with a pair of sockets.

In common usage:

• A socket refers to an endpoint defined by IP address plus port number on a single host.
• A connection or session is uniquely identified by the combination of both endpoints.

The standard way to write a socket is using an IP address and port together, often separated by a colon:

• IPv4 example: 192.0.2.10:443
• IPv6 example: [2001:db8::10]:443

In IPv4, a single TCP connection is identified by the 4 tuple:

$$ (\text{Source IP},\ \text{Source Port},\ \text{Destination IP},\ \text{Destination Port}) $$

This combination is unique for every active connection. Two different web browser tabs can connect to the same site at the same time, because each tab will typically use a different source port even though the destination IP and destination port are the same.

Sockets and Applications

From the perspective of a programmer or operating system, the socket is the handle that an application uses to send and receive data at the transport layer.

The general idea for a server application:

1. The server binds a socket to a specific local IP and port, for example 0.0.0.0:80 to listen on all local addresses on port 80.
2. The server listens on that socket for incoming connections or datagrams.
3. When a client connects, the server can create a new per connection socket that includes the client’s IP and port. This allows the server to handle many clients at once.

For client applications:

1. The client asks the operating system to open a socket and connect it to the server’s IP and port.
2. The OS assigns a suitable source port and associates the client application with this local socket.
3. The application then uses this socket to send data to and receive data from the server.

You will see that TCP and UDP treat sockets slightly differently, because one protocol is connection oriented and the other is connectionless. Those protocol specifics are covered in later chapters. Here, it is enough to understand that sockets represent the combination of addressing information that lets the operating system deliver data to the correct application.

Multiplexing and Demultiplexing

Ports and sockets enable multiplexing and demultiplexing at the transport layer.

Multiplexing is the process of taking data from multiple applications and combining them for transmission over a single network path using different port numbers. Your computer can browse the web, stream video, and check email at the same time. The transport layer tags each application’s data with its own source port so that the network can carry all of them together.

Demultiplexing is the reverse. When data arrives at your device, the transport layer looks at the destination port and sends each piece of data to the right socket, which then delivers it to the correct application.

The operating system keeps track of which sockets are open and which ports are in use. If a new server tries to bind to a port that is already in use, such as trying to start another web server on port 80, the OS will not allow it. Only one application can listen on a given IP and port combination at the same time.

Ports, Sockets, and Addressing Together

To see how everything fits together, consider a complete example of one HTTP request from a client to a server.

Suppose:

• Client IP: 198.51.100.50
• Server IP: 203.0.113.20
• Server port: 80 (HTTP)

The transport layer view of this communication is:

The connection is uniquely identified by:

$$(198.51.100.50,\ 51000,\ 203.0.113.20,\ 80)$$

If the client opens another tab to the same server at the same time, the client might then use port 51001. The second connection has a different 4 tuple, so the transport layer can tell the two conversations apart even though the server IP and port are identical.

Viewing Ports and Sockets in Practice

On most operating systems, you can see active ports and sockets using tools that inspect network state. For example, commands like netstat or similar tools show which ports are open, which processes are using them, and which connections exist to remote addresses.

These tools often display information in tables similar to the following style:

The first entry shows a server socket that is listening locally on port 80. The second entry shows an active established connection that uses a full 4 tuple.

The detailed interpretation of states such as LISTEN or ESTABLISHED belongs to the TCP specific topics, but even without that knowledge, you can see that every connection or listening service is tied to a specific IP and port combination.

Summary

Ports identify specific services or applications on a host, while sockets combine IP addresses and ports to create unique communication endpoints. Together they allow the transport layer to deliver data to the right application, support many simultaneous connections, and keep multiple conversations separate on shared network paths.