A port in networking is a numbered logical endpoint used by transport-layer protocols such as TCP and UDP to identify a particular application or network service on a device. An IP address identifies a network interface or host at the Internet Protocol layer, whereas a port number helps identify which process or service should receive traffic once it reaches that host.
A network endpoint is therefore commonly represented by an IP address together with a transport protocol and port number, such as TCP port 443 at a particular IP address. Port numbers are 16-bit values ranging from 0 through 65535. They do not represent physical sockets or hardware connectors; a networking port is a logical addressing mechanism. A single computer can simultaneously provide many services because different applications can listen on different ports. For example, a web server commonly accepts HTTPS connections on TCP port 443, while an email server may accept SMTP connections on TCP port 25 or submission connections on TCP port 587.
Port numbers belong to the transport layer and are used alongside IP addresses. TCP and UDP each maintain their own port-number namespace, meaning TCP port 53 and UDP port 53 are distinct endpoints even though they use the same numerical value. A TCP connection is identified by information including source IP address, source port, destination IP address and destination port, while UDP datagrams similarly contain source and destination port fields.
This allows thousands of simultaneous connections to the same server address and destination port because each connection can have a different client-side source port and address. Operating systems use these values to deliver received transport segments or datagrams to the appropriate socket and application process. The combination of IP addressing and port addressing therefore separates the question of which host should receive traffic from the question of which network service on that host should process it.
Port numbers are conventionally divided into three broad ranges. Ports 0 through 1023 are known as well-known or system ports and include assignments such as TCP 80 for HTTP, TCP 443 for HTTPS, TCP 21 for FTP control connections, TCP 22 for SSH and TCP 25 for SMTP.
Ports 1024 through 49151 are commonly described as registered ports, which can be associated with particular applications or services through IANA registration, while ports 49152 through 65535 are commonly designated dynamic or private ports and are frequently used for temporary client-side connections. These ranges describe conventions and allocation policy rather than a guarantee that only one application can ever use a number. An administrator can configure services on non-standard ports, and software can listen on many different ports according to its design. Consequently, port 443 does not inherently make a service HTTPS, although HTTPS commonly uses that port by convention.
A listening port is a port on which a server application waits for incoming connections or datagrams. A TCP server normally creates a socket, binds it to a local address and port, and enters a listening state so that incoming TCP connection attempts can be accepted. A UDP application can bind to a port and receive datagrams without establishing a connection in the TCP sense. Client applications commonly use ephemeral source ports that the operating system selects automatically.
When a browser connects to a web server, for example, the server might listen on TCP 443 while the browser uses an ephemeral local source port such as 51432. The resulting connection can be distinguished from another browser connection because the complete endpoint information differs. This arrangement allows one server process to handle many clients concurrently while other services on the same host use entirely different ports.
Ports are also important to firewalls, network address translation and security monitoring. A firewall can permit TCP traffic to port 443 while blocking unsolicited traffic to other ports, thereby limiting which services are externally reachable. NAT devices can translate source ports as well as IP addresses, allowing many private devices to share one public IPv4 address.
Port scanning tools exploit the fact that services often reveal whether a port is open, closed or filtered, allowing administrators and security professionals to discover exposed services. An open port is not itself evidence of a vulnerability; it simply indicates that some service is reachable or responding under the relevant conditions. Security depends on what application is listening, how it is configured, whether authentication is required, whether software is patched and what network controls are applied. Unnecessary exposed ports increase the attack surface because they provide additional reachable services.
Ports should not be confused with physical networking ports. An Ethernet connector, USB socket or fibre-optic interface is a physical or hardware interface, whereas TCP port 443 is a logical transport-layer identifier. A physical network interface can carry traffic for thousands of logical ports simultaneously. Similarly, a URL such as https://example.com:8443/ can explicitly specify a TCP destination port, while omitting the port causes the application to use the protocol's default port when applicable.
DNS does not generally map names to ports through ordinary A or AAAA records, although SRV records can publish service names together with ports for protocols that support service discovery. Ports therefore form one component of a multilayer addressing system involving names, IP addresses, transport protocols and application protocols.
Port numbers have practical limitations. They identify transport-layer endpoints, not necessarily individual applications in a permanent one-to-one manner. Several applications can share a port through a proxy, load balancer or operating-system mechanism, and a single application can use multiple ports. A service can deliberately operate on a non-standard port, and malicious software can use an ordinary port while communicating with a completely different protocol. Port-based filtering is therefore useful but insufficient as a security boundary on its own.
Modern applications can also tunnel different protocols through commonly permitted ports, while encrypted protocols can make traffic classification more difficult. Network administrators consequently combine port information with IP addresses, protocol metadata, application-layer inspection, authentication, encryption, endpoint controls and traffic behaviour when controlling or analysing network communication.
The concept of logical ports developed with connection-oriented and datagram transport protocols as computer networks evolved beyond simple host-to-host addressing. TCP and UDP formalised the use of 16-bit source and destination port fields, allowing multiple applications to communicate concurrently over the same network interfaces. IANA maintains registries for many service and port assignments, but port numbers remain conventions within the broader protocol architecture rather than physical resources.
The enduring purpose is multiplexing and demultiplexing: transport protocols use ports to distinguish different application endpoints, while operating systems use that information to deliver network traffic to the appropriate socket. Understanding ports therefore requires distinguishing them from IP addresses, physical connectors, protocols and applications, while recognising their central role in allowing a single networked computer to provide or consume many services simultaneously.
