Ports: the doors of a computer

An IP address gets you to the right building. But a computer runs many services at once — a website, an email server, a database, a remote-login service — so once your letter arrives, how does it reach the right department? Ports.

Understanding ports is the heart of scanning — one of the first things every pentester does on any target.

Ports are numbered doors

A port is a number (from 1 to 65,535) that identifies a specific service on a computer. Picture the building again: the IP gets you to the building, and the port is the specific door you knock on.

[IP + Port = full address]

Ports let one machine offer many services without messages getting mixed up. There are 65,535 possible ports on every machine.

The well-known ports

A small set of "well-known" ports are used again and again for the same jobs, everywhere in the world:

You don't need to memorise the whole table — but 22, 80, 443, and 53 should become second nature.

Ports 0–1023 are well-known ports (assigned by IANA). 1024–49151 are registered ports. 49152–65535 are dynamic/private ports used for short-lived client-side connections. The service you're scanning nearly always lives in the first range.

Open, closed, filtered

A port can be in one of three states you'll see constantly:

• Open — a service is listening; ready to talk. This is what attackers hunt for.
• Closed — nothing is listening; the port responds with a "no" but is reachable.
• Filtered — a firewall is silently blocking the port. You don't know if it's open or closed.

So the full address of a service is really two parts together:

192.168.1.20:443

That reads as "the secure-web door of the machine at 192.168.1.20." Every service on the internet has this shape.

Ephemeral ports — the other side of every connection

The well-known ports table above describes the server's side of a connection — but your own device also uses a port for every outgoing connection, typically a randomly chosen number from the dynamic/private range (49152–65535) mentioned in the tip above. This is called an ephemeral port, and it's genuinely temporary — used only for the duration of that one connection, then released for reuse. This is exactly why, when you open several browser tabs to the same website, each tab's connection uses a different ephemeral port on your side, even though they're all talking to the same server port 443 — it's how your device (and the server replying to it) keeps each individual connection distinct.

How firewalls relate to ports

A firewall (covered in full in Path 12) makes its allow/block decisions largely based on ports — a basic firewall rule might say "allow anything on port 443 (HTTPS), block everything on port 3389 (remote desktop) from outside the local network." This is exactly why an unnecessarily open port is a real security risk even before any vulnerability in the service behind it is considered: every open port is one more thing a firewall has to deliberately allow, and one more potential entry point an attacker can find during reconnaissance. The general security principle — close every port you don't genuinely need running — is a direct, practical application of the "attack surface" concept from Path 01.

Scanning = knocking on doors

When you hear a hacker "scanned" a machine, this is exactly what they did: they knocked on many doors to see which open.

Each open door is a service to investigate and a potential way in. In Path 12 you'll run Nmap to do this for real, legally, on scanme.nmap.org.

🧪 Lab — Match the ports (paper exercise)

Without looking back, write down what these ports are for:

• 22
• 80
• 443
• 53
• 3389

Then scroll up and check yourself. Repeat until you can do all five instantly — these five come up constantly.

On Linux/Mac, run ss -tulnp (or netstat -tulnp on older systems). On Windows, run netstat -ano. You'll see every port currently listening on your own computer. Notice how many services are quietly running — even a fresh laptop usually has several.

Secure websites (the padlock ones) listen on which port?

Key terms

• Port — a numbered door for a specific service (0–65535).
• Well-known ports — 0–1023, reserved for standard services.
• Open / closed / filtered — the three states a port scan reveals.
• Listening — a service is waiting for connections on a port.

Recap

• Ports are numbered doors that let one computer run many services at once.
• IP finds the building; port finds the right door.
• Key ports: 22 SSH, 53 DNS, 80 web, 443 secure web, 3389 remote desktop.
• Scanning means checking which doors are open — every open door is a possible way in.

References

• IANA Service Name and Port Number Registry — the official global list of every port assignment.
• Wikipedia: List of TCP and UDP port numbers — friendly reference.
• SANS common ports cheat sheet — printable pocket reference.
• Nmap Port States explained — the definitive doc.

Next up → Packets & the OSI layers