Master Network Ports, OSI Model, Security Concepts, and Tools with Interactive Visualizations
Network ports are virtual endpoints for communication in an operating system. They allow multiple network services to operate simultaneously on a single IP address by using different port numbers.
Think of ports as doors in a building (the IP address). Each door leads to a different room (service/application) inside the building. When data arrives at a device, the operating system uses the port number to determine which application should receive that data.
Port numbers range from 0 to 65535, divided into three main categories:
Ports work in conjunction with IP addresses to enable communication:
IP Address → Identifies the device on the network
Port Number → Identifies the service/application on that device
Together, they form a socket - a unique communication endpoint.
The TCP three-way handshake establishes a reliable connection between client and server before data transmission begins. This process ensures both devices are ready to communicate and agree on initial sequence numbers.
As data moves down the OSI model, each layer adds its own header (encapsulation):
As data moves up the OSI model, each layer removes its header (decapsulation):
The TCP/IP model is a more practical implementation used on the internet, with 4 layers instead of 7:
| TCP/IP Model | OSI Model |
|---|---|
| Application | Application, Presentation, Session |
| Transport | Transport |
| Internet | Network |
| Network Interface | Data Link, Physical |
These ports are assigned by IANA for specific services and protocols. They are standardized across all systems and typically require administrator privileges to use.
Examples: HTTP (80), HTTPS (443), SSH (22), FTP (21), DNS (53), SMTP (25)
These ports can be registered with IANA for specific services but are not as strictly controlled as well-known ports. Many database and middleware applications use these ports.
Examples: MySQL (3306), PostgreSQL (5432), Redis (6379), MongoDB (27017), Jenkins (8080)
Also known as ephemeral ports, these are used for temporary connections, typically as source ports for client applications. The operating system assigns these automatically when a client initiates a connection to a server.
| Port | Service | Protocol | Description |
|---|---|---|---|
| 20/21 | FTP | TCP | File Transfer Protocol (Data/Control) |
| 22 | SSH | TCP | Secure Shell |
| 23 | Telnet | TCP | Telecommunication Network |
| 25 | SMTP | TCP | Simple Mail Transfer Protocol |
| 53 | DNS | TCPUDP | Domain Name System |
| 67/68 | DHCP | UDP | Dynamic Host Configuration Protocol |
| 80 | HTTP | TCP | Hypertext Transfer Protocol |
| 110 | POP3 | TCP | Post Office Protocol v3 |
| 123 | NTP | UDP | Network Time Protocol |
| 143 | IMAP | TCP | Internet Message Access Protocol |
| 443 | HTTPS | TCP | HTTP Secure |
| 993 | IMAPS | TCP | IMAP over SSL |
| 995 | POP3S | TCP | POP3 over SSL |
Traffic coming into a network or device from external sources. This includes:
Traffic leaving a network or device to external destinations. This includes:
A service is actively waiting for connections on this port. The port is open and ready to accept incoming connections.
An active connection exists between source and destination. Data can flow bidirectionally between the endpoints.
The connection is being closed, waiting to ensure all packets are received and to handle any delayed packets.
No application is listening on this port. The port is not associated with any active service.
Port exhaustion occurs when a system runs out of available ephemeral ports. This can happen when:
Solutions: Increase the ephemeral port range, reduce connection timeout, use connection pooling, or implement connection reuse.
Controls traffic based on security rules
Protects data in transit
Detects and prevents intrusions
Secure remote access
Firewalls control traffic based on port numbers:
Attackers use port scanning to discover open ports on target systems:
Telnet transmits all data in plaintext, including passwords. It should be replaced with SSH (port 22) which encrypts all communication. Telnet is considered insecure and should be disabled on all systems.
Running unnecessary services increases the attack surface. Disable any services that aren't required for your system's function. Regularly audit running services and close any that are not needed.
Many services have default credentials that are well-known. Always change default passwords on network services. Use strong, unique passwords and consider implementing multi-factor authentication.
When a system runs out of available ephemeral ports, it can't establish new connections. This can be exploited in DoS attacks. Monitor port usage and consider increasing the ephemeral port range if needed.
Netstat (Network Statistics) is a command-line tool that displays network connections, routing tables, and interface statistics. It's available on Windows, Linux, and macOS.
SS is a modern replacement for netstat that provides more information and faster performance. It's the preferred tool on modern Linux systems.
Nmap (Network Mapper) is a powerful network scanning tool used for security auditing and network discovery. It can detect open ports, running services, operating systems, and more.
The /etc/services file on Unix-like systems contains a list of network services and their associated port numbers and protocols. This file is used by various network utilities to map port numbers to service names.
Linux firewall tool for packet filtering and NAT:
Command-line packet analyzer:
Graphical network protocol analyzer for deep packet inspection. Provides detailed analysis of network traffic with powerful filtering capabilities.
List open files and the processes that opened them (including network connections):