Lesson 3.5: Ports and sockets: which program gets the data
An IP address finds the machine; a port finds the program inside it. Port numbers and their ranges (well-known, registered, ephemeral), sockets, listening services, the difference between listening on all addresses and only on the machine itself, and why every listening port is part of the attack surface. In the lab you list what your laptop listens on and which programs own those ports, name them from the services file, read your open connections, and see an open and a closed port answer differently.
17 min
You will learn to
- Explain ports and the three port ranges
- Define a socket
- List listening TCP and UDP ports and their programs
- Tell a service listening on all addresses from one listening only locally
- Tell an open port from a closed one
Key terms
- Port number
- A 16-bit number (0 to 65535) in every TCP or UDP header that picks the program or service on a host.
- Socket
- One end of a network conversation: an IP address, a port and a protocol together.
- Listening port
- A port on which a program waits for incoming connections.
- Ephemeral port
- A short-lived port the operating system picks for the client side of a connection.
- Bind address
- The address a service listens on: 0.0.0.0 (or [::]) means every address of the machine; 127.0.0.1 means only the machine itself.
- Open, closed, filtered
- Open: a program accepts connections. Closed: the host answers but nothing listens. Filtered: no answer, usually because a firewall drops it.
← Absolute and relative paths · All lessons · Common attacks: phishing, malware, password attacks, denial of service →