Ports are virtual places within an operating system where network connections start and end. They help computers sort the network traffic they receive.
A port is a virtual point where network connections start and end. Ports are software-based and managed by a computer’s operating system. Each port is associated with a specific process or service. Ports allow computers to differentiate between different kinds of traffic easily: emails go to a different port than webpages, even though both reach a computer over the same Internet connection.
What is a port number?
Ports are standardized across all network-connected devices, with each port assigned a number. Most ports are reserved for specific protocols — for example, all Hypertext Transfer Protocol (HTTP) messages go to port 80. While IP addresses enable messages to go to and from specific devices, port numbers allow the targeting of specific services or applications within those devices.
How do ports make network connections more efficient?
Vastly different types of data flow to and from a computer over the same network connection. Using ports helps computers understand what to do with the data they receive.
Suppose Bob transfers an MP3 audio recording to Alice using the File Transfer Protocol (FTP). If Alice’s computer passed the MP3 file data to Alice’s email application, it would not know how to interpret it. But because Bob’s file transfer uses the port designated for FTP (port 21), Alice’s computer can receive and store the file.
Meanwhile, Alice’s computer can simultaneously load HTTP webpages using port 80, even though the webpage files and the MP3 sound file flow to Alice’s computer over the same WiFi connection.
Are ports part of the network layer?
The OSI model is a conceptual model of how the Internet works. It divides different Internet services and processes into 7 layers. These layers are:
Ports are a transport layer (layer 4) concept. A transport protocol such as the Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) can indicate which port a packet should go to. TCP and UDP headers have a section for indicating port numbers. Network layer protocols — for instance, the Internet Protocol (IP) — are unaware of the port used in a given network connection. In a standard IP header, there is no place to indicate which port the data packet should go to. IP headers only indicate the destination IP address, not the port number at that IP address.
Usually, the inability to indicate the port at the network layer has no impact on networking processes since network layer protocols are almost always used in conjunction with a transport layer protocol. However, this impacts the testing software’s functionality, which is software that “pings” IP addresses using Internet Control Message Protocol (ICMP) packets. ICMP is a network layer protocol that can ping networked devices — but without the ability to ping specific ports, network administrators cannot test specific services within those devices.
Some ping software, such as Zenmap, allows sending UDP packets. UDP is a transport layer protocol that can specify a particular port, unlike ICMP, which cannot specify a port. Network administrators can test specific ports within a networked device by adding a UDP header to ICMP packets.
Why do firewalls sometimes block specific ports?
A firewall is a security system that blocks or allows network traffic based on security rules. Firewalls usually sit between trusted and untrusted networks, often the Internet. For example, office networks often use a firewall to protect their network from online threats.
Some attackers try to send malicious traffic to random ports in the hopes that those ports have been left “open,” meaning they can receive traffic. This action is somewhat like a car thief walking down the street and trying the doors of parked vehicles, hoping one of them is unlocked. For this reason, firewalls should be configured to block network traffic directed at most available ports. There is no legitimate reason for the vast majority of the available ports to receive traffic.
Properly configured firewalls block traffic to all ports by default except for a few predetermined ports in everyday use. For instance, a corporate firewall could only leave open ports 25 (email), 80 (web traffic), 443 (web traffic), and a few others, allowing internal employees to use these essential services, then block the rest of the 65,000+ ports.
As a more specific example, attackers sometimes attempt to exploit vulnerabilities in the RDP protocol by sending attack traffic to port 3389. To stop these attacks, a firewall may block port 3389 by default. Since this port is only used for remote desktop connections, such a rule has little impact on day-to-day business operations unless employees need to work remotely.
What are the different port numbers?
There are 65,535 possible port numbers, although not all are commonly used. Some of the most commonly used ports, along with their associated networking protocol, are:
- Ports 20 and 21: File Transfer Protocol (FTP). FTP is for transferring files between a client and a server.
- Port 22: Secure Shell (SSH). SSH is one of many tunneling protocols that create secure network connections.
- Port 25: Historically, Simple Mail Transfer Protocol (SMTP). SMTP is used for email.
- Port 53: Domain Name System (DNS). DNS is an essential process for the modern Internet; it matches human-readable domain names to machine-readable IP addresses, enabling users to load websites and applications without memorizing a long list of IP addresses.
- Port 80: Hypertext Transfer Protocol (HTTP). HTTP is the protocol that makes the World Wide Web possible.
- Port 123: Network Time Protocol (NTP). NTP allows computer clocks to sync with each other, a process that is essential for encryption.
- Port 179: Border Gateway Protocol (BGP). BGP is essential for establishing efficient routes between the extensive networks that comprise the Internet (these large networks are called autonomous systems). Autonomous systems use BGP to broadcast which IP addresses they control.
- Port 443: HTTP Secure (HTTPS). HTTPS is the secure and encrypted version of HTTP. All HTTPS web traffic goes to port 443. Network services that use HTTPS for encryption, such as DNS over HTTPS, also connect at this port.
- Port 500: Internet Security Association and Key Management Protocol (ISAKMP), part of setting up secure IPsec connections.
- Port 587: Modern, secure SMTP that uses encryption.
- Port 3389: Remote Desktop Protocol (RDP). RDP enables users to connect to their desktop computers from another device remotely.
The Internet Assigned Numbers Authority (IANA) maintains the complete list of port numbers and protocols assigned to them.
