Ports and Sockets

Ports

An IP address gets packets to a host; a port (0 to 65535) gets them to the right program on that host. A web server listens on port 443, a database on 5432, SSH on 22.

Ports below 1024 are well-known ports. When your program connects out, the operating system picks a temporary ephemeral port for your side (on Linux, 32768 to 60999 by default).

Sockets and the 5-tuple

A socket is one end of a connection. A TCP connection is identified by its 5-tuple: protocol, source IP, source port, destination IP and destination port. That is how a server on port 443 keeps thousands of clients apart: each has a different source IP and port.

import random

random.seed(7)
server = ("10.0.1.10", 443)
connections = set()
for client_ip in ["203.0.113.5", "203.0.113.5", "198.51.100.20"]:
    client_port = random.randint(32768, 60999)        # ephemeral port chosen by the client OS
    connections.add(("tcp", client_ip, client_port, *server))

for conn in sorted(connections):
    print(conn)
print(len(connections), "distinct connections to the same server port")

('tcp', '198.51.100.20', 45705, '10.0.1.10', 443)
('tcp', '203.0.113.5', 37711, '10.0.1.10', 443)
('tcp', '203.0.113.5', 43379, '10.0.1.10', 443)
3 distinct connections to the same server port

Seeing ports on your machine

$ ss -tlnp            # Linux: listening TCP sockets
State   Local Address:Port   Process
LISTEN  0.0.0.0:22           sshd
LISTEN  127.0.0.1:5432       postgres
$ lsof -iTCP -sTCP:LISTEN   # macOS

A server listening on 127.0.0.1 accepts only local connections; on 0.0.0.0 it accepts connections on every interface. "Works locally, refused in Docker or the cloud" is often a server bound to 127.0.0.1.