What Is a Port? TCP and UDP Ports Explained

What Is a Network Port?

A port is a virtual communication endpoint — a numbered channel that allows a single device (with one [IP address](/learning-center/what-is-an-ip-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained)) to run many different network services simultaneously. If an IP address is like a building's street address, a port is like a specific flat number within that building.

IP Address: 192.168.1.10  (the building)
Port 80:    Web server    (flat 80)
Port 22:    SSH server    (flat 22)
Port 25:    Mail server   (flat 25)

Ports are defined in the transport layer (Layer 4) of both the OSI model and the [[TCP-the-internets-core-protocol)/IP](/learning-center/what-is-tcp-ip-the-internets-core-protocol) model](/learning-center/what-is-the-osi-model-all-7-layers-explained). Both TCP and UDP use ports.

How Ports Work

When an application sends data, the operating system assigns:

• A destination IP + port — where the data is going
• A source IP + port — where the response should come back to

Together, these form a socket — the unique combination that identifies a connection:

Socket = IP Address + Port Number
Example: 142.250.80.46:443  (Google's HTTPS server)

A full TCP-the-internets-core-protocol) connection is identified by a 4-tuple:

Source IP : Source Port ↔ Destination IP : Destination Port

Port Ranges

Ports are 16-bit numbers (0–65,535), divided into three ranges:

| Range | Name | Usage | |-------|------|-------| | 0–1023 | Well-known ports | Standard services (HTTP, HTTPS-how-https-keeps-your-data-safe)-tls-how-https-keeps-your-data-safe), SSH) | | 1024–49151 | Registered ports | Application-specific services | | 49152–65535 | Dynamic / Ephemeral | Temporary ports for client connections |

When your browser opens a connection to a web server, it uses an ephemeral port (e.g. 54321) as the source, connecting to port 443 at the destination.

Well-Known Ports Reference

| Port | protocol | Service | |------|----------|---------| | 20, 21 | TCP-the-internets-core-protocol) | FTP (File Transfer) | | 22 | TCP-the-internets-core-protocol) | SSH (Secure Shell) | | 23 | TCP-the-internets-core-protocol) | Telnet (unencrypted — avoid) | | 25 | TCP-the-internets-core-protocol) | SMTP (email sending) | | 53 | TCP-the-internets-core-protocol)/UDP | DNS (domain-kerberos-directory-services-explained) resolution) | | 67, 68 | UDP-the-internets-core-protocol) | DHCP (IP address-and-addressing-explained)-ipv6-and-addressing-explained) assignment) | | 80 | TCP-the-internets-core-protocol) | HTTP (unencrypted web) | | 110 | TCP-the-internets-core-protocol) | POP3 (email retrieval) | | 143 | TCP-the-internets-core-protocol) | IMAP (email retrieval) | | 389 | TCP-the-internets-core-protocol)/UDP | LDAP (directory services) | | 443 | TCP-the-internets-core-protocol) | HTTPS-how-https-keeps-your-data-safe)-tls-how-https-keeps-your-data-safe) (encrypted web) | | 445 | TCP-the-internets-core-protocol) | SMB (Windows file sharing) | | 3306 | TCP-the-internets-core-protocol) | MySQL database | | 3389 | TCP-the-internets-core-protocol) | RDP (Windows Remote Desktop) | | 5432 | TCP-the-internets-core-protocol) | PostgreSQL database | | 8080 | TCP-the-internets-core-protocol) | HTTP alternative (dev/proxy) |

TCP Ports vs UDP Ports

Both TCP-the-internets-core-protocol) and UDP use port numbers), but they operate differently:

| Feature | TCP-the-internets-core-protocol) | UDP | |---------|-----|-----| | Connection | Established before data sent | No connection setup | | Examples | HTTP, HTTPS-how-https-keeps-your-data-safe)-tls-how-https-keeps-your-data-safe), SSH, SMTP | DNS, DHCP, VoIP, streaming |

Note: Port 53 (DNS) uses both — UDP-the-internets-core-protocol) for standard queries, TCP for large responses and zone transfers.

Ports and Firewalls

Firewalls use ports to control traffic. Rules typically specify:

Allow:  TCP port 443 inbound   (HTTPS)
Allow:  TCP port 22 inbound    (SSH — restrict by source IP)
Block:  All other inbound ports

Port 23 (Telnet) should always be blocked — it transmits data in plaintext. Port 3389 (RDP) exposed to the internet is a major attack surface-cves-exploits-and-patch-management) — restrict with VPN or IP allowlisting.

Port Scanning — How Attackers Enumerate Services

Port scanning probes a target's ports to discover which services are running. Security professionals use it for assessments; attackers use it for reconnaissance.

# Scan common ports on a target
nmap -sV 192.168.1.1

# Scan all 65,535 ports
nmap -p- 192.168.1.1

# Scan specific ports
nmap -p 22,80,443,3389 192.168.1.1

Open ports are potential entry points. A well-secured server exposes only the minimum ports required.

Common Attacks Targeting Ports

| Attack | Port(s) | Description | |--------|---------|-------------| | RDP brute force-explained)) | 3389 | Guessing passwords on exposed RDP | | SMB exploits | 445 | EternalBlue (WannaCry), lateral movement | | SSH brute force-explained)) | 22 | Guessing SSH passwords | | SQL injection via DB port | 3306, 5432 | Direct database attacks | | HTTP attacks | 80, 443 | Web application exploits |

Quick Recap

• A port is a numbered endpoint that lets a device run multiple services on one [IP address](/learning-center/what-is-an-ip-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained)
• Ports 0–1023 are well-known (HTTP=80, HTTPS-how-https-keeps-your-data-safe)-tls-how-https-keeps-your-data-safe)=443, SSH=22, DNS=53)
• TCP-the-internets-core-protocol) ports are connection-oriented; UDP ports are connectionless
• Firewalls control access by allowing or blocking specific ports
• Port scanning (nmap) is a key tool for security assessments and attack reconnaissance