Internet Services and Port Numbers

Every time you browse a website, send an email, or SSH into a server, your computer is using a port number to tell the destination machine exactly which service it wants to talk to. IP addresses get your data to the right machine; port numbers get it to the right application on that machine. This article explains ports from the ground up, walks through the most important well-known services, and shows practical examples of inspecting and managing ports on Linux and Cisco devices.

What Is a Port Number?

A port is a 16-bit number (0–65535) used by the Transport Layer (TCP or UDP) to distinguish between different services or connections running on the same IP address. Think of an IP address as a building’s street address, and a port number as the specific apartment number inside that building.

A network connection is fully identified by a socket, made up of:

(Source IP, Source Port, Destination IP, Destination Port, Protocol)

This 5-tuple is what allows a single server to handle thousands of simultaneous connections without confusing them.

graph TD
    Client[Client 203.0.113.5:52344] -->|TCP SYN to port 443| Server[Web Server 198.51.100.10:443]
    Server -->|TCP SYN-ACK| Client
    Client -->|TCP ACK| Server
    Client -->|HTTPS Request| Server

Port Ranges

Common Internet Services and Their Ports

TCP vs UDP Ports

The same port number can be used independently by TCP and UDP, since they are separate protocols with separate port spaces. DNS is a good example — it primarily uses UDP port 53 for quick lookups but falls back to TCP port 53 for larger responses like zone transfers.

Inspecting Ports on Linux

Viewing Listening Ports

# Modern method (recommended)
sudo ss -tulnp

# Legacy method (still widely used)
sudo netstat -tulnp

# Modern method (recommended)
sudo ss -tulnp

# Legacy method (still widely used)
sudo netstat -tulnp

Example output:

Netid  State   Local Address:Port   Process
tcp    LISTEN  0.0.0.0:22           sshd
tcp    LISTEN  0.0.0.0:80           nginx
tcp    LISTEN  127.0.0.1:3306       mysqld

Netid  State   Local Address:Port   Process
tcp    LISTEN  0.0.0.0:22           sshd
tcp    LISTEN  0.0.0.0:80           nginx
tcp    LISTEN  127.0.0.1:3306       mysqld

• -t TCP, -u UDP, -l listening sockets only, -n numeric (don’t resolve names), -p show the owning process.

Scanning Open Ports on a Remote Host

# Using nmap to scan the most common 1000 ports
nmap 192.168.1.10

# Scanning a specific range
nmap -p 1-1000 192.168.1.10

# Version detection
nmap -sV 192.168.1.10

# Using nmap to scan the most common 1000 ports
nmap 192.168.1.10

# Scanning a specific range
nmap -p 1-1000 192.168.1.10

# Version detection
nmap -sV 192.168.1.10

Opening a Port in the Firewall (UFW example)

sudo ufw allow 443/tcp
sudo ufw allow 53/udp
sudo ufw status verbose

sudo ufw allow 443/tcp
sudo ufw allow 53/udp
sudo ufw status verbose

Opening a Port with firewalld (RHEL/CentOS)

sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --reload
sudo firewall-cmd --list-ports

sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --reload
sudo firewall-cmd --list-ports

Managing Ports on Cisco Devices

Cisco routers and switches use access control lists (ACLs) to permit or deny traffic based on port numbers.

Router(config)# access-list 101 permit tcp any any eq 443
Router(config)# access-list 101 permit tcp any any eq 80
Router(config)# access-list 101 deny tcp any any eq 23
Router(config)# access-list 101 permit ip any any

Router(config)# interface gigabitEthernet 0/0
Router(config-if)# ip access-group 101 in

Router(config)# access-list 101 permit tcp any any eq 443
Router(config)# access-list 101 permit tcp any any eq 80
Router(config)# access-list 101 deny tcp any any eq 23
Router(config)# access-list 101 permit ip any any

Router(config)# interface gigabitEthernet 0/0
Router(config-if)# ip access-group 101 in

This example permits HTTPS and HTTP, explicitly blocks Telnet (port 23) as a security best practice, and allows all other IP traffic.

Checking Ports Programmatically with Python

import socket

def scan_port(host, port, timeout=1):
    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
        sock.settimeout(timeout)
        result = sock.connect_ex((host, port))
        return result == 0

host = "192.168.1.10"
common_ports = {21: "FTP", 22: "SSH", 80: "HTTP", 443: "HTTPS", 3306: "MySQL"}

for port, name in common_ports.items():
    status = "OPEN" if scan_port(host, port) else "CLOSED"
    print(f"Port {port} ({name}): {status}")

import socket

def scan_port(host, port, timeout=1):
    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
        sock.settimeout(timeout)
        result = sock.connect_ex((host, port))
        return result == 0

host = "192.168.1.10"
common_ports = {21: "FTP", 22: "SSH", 80: "HTTP", 443: "HTTPS", 3306: "MySQL"}

for port, name in common_ports.items():
    status = "OPEN" if scan_port(host, port) else "CLOSED"
    print(f"Port {port} ({name}): {status}")

This kind of script is useful for quick service-availability checks, but for real audits, dedicated tools like nmap are far more capable and efficient.

Best Practices

• Close or firewall any port not actively used by a required service.
• Never expose Telnet (23), FTP (21), or unencrypted management ports to the internet — use SSH, SFTP, and HTTPS equivalents instead.
• Use non-standard ports only as a minor deterrent, never as your primary security control (“security through obscurity” is not real security).
• Log connection attempts to sensitive ports (SSH, RDP) and use fail2ban or equivalent to block brute-force attempts.
• Regularly audit listening ports on servers with ss -tulnp.
• Segment services onto separate VLANs/subnets so a compromised host on one port doesn’t expose everything else.

Troubleshooting

Further Reading

• IANA Service Name and Port Number Registry
• RFC 793 — Transmission Control Protocol
• RFC 768 — User Datagram Protocol
• Nmap Official Documentation
• Cisco ACL Configuration Guide

Conclusion

Port numbers are the addressing system that lets a single IP handle dozens of simultaneous services. Understanding well-known ports, how to inspect them on Linux, and how to control them with ACLs and firewalls is essential groundwork for anything from basic troubleshooting to serious network security work.