Networking · foundation
Port and socket
A transport port is a 16-bit number used by protocols such as TCP or UDP to identify an endpoint within a host. A socket is an operating-system communication object; an internet socket endpoint combines a protocol, IP address, and port.
Why it matters
Diagnosing connection failures requires distinguishing address routing from port selection and from whether a process actually has a matching listening socket.
Mental model
How to reason about port and socket
The IP address gets a packet to a host or interface context; the transport protocol and destination port help the kernel deliver it to the right socket. TCP identifies each established connection with both local and remote endpoint information.
Analogy
An IP address is a building address, a port is a numbered service desk, and a socket is the actual staffed desk or conversation endpoint managed inside the building.
Examples
See the boundary, not just the happy path
Worked example · List listening TCP sockets
ss -ltnOn Linux, ss shows TCP sockets in the listening state with their bound local addresses and ports. A wildcard local address means the listener may accept connections addressed to multiple local interfaces.
Worked example · Test a TCP endpoint
nc -vz example.com 443Common netcat implementations attempt a TCP connection to port 443 and report whether connection establishment succeeded. This tests transport reachability, not whether valid HTTPS is served afterward.
Useful contrast · Same number, different transport namespace
UDP port 53 and TCP port 53TCP and UDP maintain distinct port spaces and socket semantics. DNS commonly uses both, so a UDP listener on 53 does not itself create a TCP listener on 53.
Common mistakes
Misconceptions to remove early
Assuming one port permanently belongs to one application
Service registries provide conventions, not ownership. Binding depends on the current host, address, protocol, permissions, and existing sockets; services can also use non-default ports.
Treating a successful TCP connect as an application health check
It proves that a TCP handshake reached a listener. The listener can still speak the wrong protocol, reject the request, or fail during application processing.
Quick check
Can you predict the result?
1. Which set best identifies one side of an internet transport conversation?
- • Transport protocol, IP address, and port
- • PID and filesystem inode only
- • Domain name and URL fragment only
2. Why can TCP and UDP both use port 53 on the same IP address?
Keep building