Ports and sockets
An IP address gets a message to the right machine, but a machine runs many programs at once. Follow two browser tabs and a mail app on one laptop as they talk to one server: each gets its own port, each connection gets its own 5-tuple, and the reply finds its way back to the one program that asked.
5 quick questions
Pick an answer to see why. Your score saves with your progress.
01The laptop has one IP address. How does a reply reach browser tab 2 and not tab 1?
The IP address finds the machine; the destination port (with the rest of the 5-tuple) finds the program's socket.
02Which range does port 443 belong to?
443 (HTTPS) is a well-known port, like 53 (DNS), 80 (HTTP), 22 (SSH) and 25 (SMTP). Ports are 16-bit, so they go up to 65535.
03Tab 1 and tab 2 both connect to 203.0.113.10:443 over TCP. What keeps their two connections apart?
Protocol, both IPs and the destination port are the same. One different value, the source port, is enough to make a different 5-tuple and so a separate connection.
04Where does the browser's source port, 51514, come from?
Ephemeral ports are short-lived: the OS picks an unused one when a connection opens and gets it back when the connection closes.
05What is a socket?
A program reads and writes its socket; the operating system adds the addresses and delivers incoming data by 5-tuple.
Glossary
- Port
- A 16-bit number, 0 to 65535, in every TCP and UDP header. It tells the machine which program a message is for.
- Listening
- A program waiting for new connections on one port, like the web server on 443.
- Well-known port
- A port from 0 to 1023, kept by IANA for standard services: 53 DNS, 80 HTTP, 443 HTTPS, 22 SSH, 25 SMTP.
- Ephemeral port
- A short-lived port the operating system lends a program for one connection, usually from the dynamic range 49152–65535.
- 5-tuple
- Protocol, source IP, source port, destination IP and destination port. Together they name one connection.
- Socket
- A program's end of a connection: an IP address plus a port, which the program reads from and writes to.
- Demultiplexing
- Sorting arriving data to the right program by its port and 5-tuple.
Notes and sources
- 192.0.2.7 and 203.0.113.10 are RFC 5737 documentation addresses, the same pair as the HTTPS lesson; the ephemeral port numbers are illustrative.
- TCP and UDP count ports separately: TCP port 53 and UDP port 53 are different doors. DNS happens to use both.
- RFC 6335 sets aside 49152–65535 for dynamic ports, but each OS picks its own ephemeral range; Linux uses 32768–60999 by default.
- Mail apps hand in mail on port 587 (RFC 6409) or 465 with TLS from the start (RFC 8314). Port 25 is for mail servers passing mail to each other.
- A laptop on a home network has a private 192.168.x.x address; its router rewrites the source address and often the source port on the way out (NAT, a later lesson).
Quiz Unlocks after the last step.