Port and Socket

Computer Network & Network Security System — Transport Layer, NEC licence examination syllabus (Nepal Engineering Council).

Port and Socket: how one IP address serves a thousand conversations

Your laptop has ONE IP address but is probably running fifty network conversations right now.

An IP address gets data to the right MACHINE. A port number gets it to the right PROCESS on that machine — like an apartment building's street address (IP) plus an individual apartment number (port).

🔢 Port Number Ranges

Well-known0–1023. Reserved for standard services (HTTP=80, HTTPS=443, FTP=21).

Registered1024–49151. Assigned to specific applications by IANA, but not as strictly controlled.

Dynamic/Ephemeral49152–65535. Temporarily assigned to client applications for the duration of one connection.

A socket address is simply the combination of an IP address + a port number — this exact pair is what uniquely identifies one specific connection, out of potentially thousands happening at once on the same machine.

💡 One-liner: "What uniquely identifies a single TCP connection?" → The combination of (source IP, source port, destination IP, destination port) — all four together, not just one.

Why the well-known ports must be fixed

The ranges look like bureaucracy until you ask how a client finds a server it has never contacted.

A browser opening example.com has no prior arrangement with that machine. DNS gives it the IP address, but nothing tells it which port the web server is listening on — so the port number must be a convention known in advance. Port 80 for HTTP and 443 for HTTPS are fixed precisely so no negotiation is needed before the first message.

💡 That is also why the well-known range is privileged on most systems: binding below 1024 requires administrator rights, so an ordinary user cannot start a program on port 443 and impersonate the site's real server to other users of the same machine.

Why clients get ephemeral ports

A client's port number does not need to be predictable — nobody initiates a connection to it. It only needs to be unique on that machine, so replies can be matched to the right conversation.

So the OS allocates one from the ephemeral range automatically and reclaims it when the connection closes. Two browser tabs contacting the same server get different ephemeral ports, which is exactly what makes their 4-tuples distinct.

💡 A useful consequence to be able to state: the ephemeral range bounds how many simultaneous outbound connections one machine can make to a single destination. With roughly 16,000 ephemeral ports, a machine cannot hold more than that many connections to the same server IP and port — a real limit on busy proxies and load balancers, and a good answer to "why would a client run out of ports?"

Socket versus port

The terms are used loosely and questions test the difference.

🔌 Three related things

PortA 16-bit number identifying a process endpoint on a host.

Socket addressThe pair (IP address, port) — enough to identify an endpoint on the whole internet.

SocketThe programming object the OS gives an application to read and write through, described in the Socket Programming topic.

💡 A TCP connection is identified by two socket addresses — one at each end — which together form the 4-tuple used for demultiplexing. A single socket address is a doorway; a pair of them is a conversation.

Syllabus points

Port numbers: well-known, registered, dynamic
Socket address (IP + port)

Create a free account to tick topics off, take notes as you read, watch the video lessons and get a day-by-day study plan built around your exam date.