I just wanted to know what are ports. Can someone explain to me what a port is?
-
Hello Nithin Jose and welcome to security stackexchange. Please before posting read the FaQ and about page. As you will read the question you asked is not considered on topic and will most likely be closed.– Lucas KauffmanJul 7, 2013 at 11:37
-
4This question appears to be off-topic because it is about general computer principals.– Lucas KauffmanJul 7, 2013 at 11:38
3 Answers
In network computing, a port is a sub-address. It is like a room number in an hotel: the hotel has an address (e.g. 42 Washington Street, Austin, Texas) and is itself subdivided into rooms, each having its own number (e.g. room 317). If you want to reach a specific room, you have to know both the address (so that you may find the hotel at all) and then the room number (because the hotel has several rooms).
Similarly, when a machine A on the Internet wants to talk to another machine B on the Internet, it tries to open a TCP connection to B on a specific port: the connection is marked with both the IP address of B, and a port number. Ports allow such a "B" machine to maintain several distinct services simultaneously: for instance, B will be both a Web server, expecting connections on port 80, and an email server, expecting connections on port 25. When some client opens a connection to B, B will know to which service the connection is targeted thanks to the port: if the connection is for port 80, it is Web; if it is for port 25, it is Email.
-
2While you're in Austin, head to Jackalope on Trinity and 6th, order the pork-shoulder burger, thank me when you get back.– lynksJul 7, 2013 at 11:41
Ports are a concept, expressed as a number, that allow a service (program) on one computer to connect and exchange traffic with a particular service on another computer.
Many services conventionally use well defined port numbers, for example a web server would use and listen on port 80 for http traffic and port 443 for https traffic. Port numbers below 1024 are considered "special" in that a program requires elevated permissions to use them. Any port that a service is listening on is potentially vulnerable to attack if the service listening for traffic on the port is not designed with some care.
For example, the service may misbehave if receiving too many connections and/or traffic at a rate greater than it can handle. Services often expect traffic to conform to a restricted set of data, and may misbehave if sent data that they do not know how to handle. Flooding with traffic can result in a denial of service, where no further connections can be received, and potentially cause the machine to become unresponsive and require a reboot or power cycle.
Depending on what privileges the service enjoys, misbehaving may also mean that an attacker can perform operations on the computer that they should not be able to do, which could pose a security risk.
In an attempt at security, some services may be started to use non-conventional port numbers on the basis that a hacker would not immediately know what service was listening on the port, however as services often identify what they are when connected to, and others can be identified by behaviour when sent data, this is weak. Better security practice requires that access to ports is restricted only to those computers that need access to those services.
There are both Phyiscal and Virtual ports.
Physical network ports allow connecting cables to computers for instance:
- Serial
- Ethernet
- Fibre
- ...
There is also the concept of virtual ports,about which you are probably thinking. If found a nice tutorial here detailing the basic concepts of networking.
As you know every computer or device on the Internet must have a unique number assigned to it called the IP address. This IP address is used to recognize your particular computer out of the millions of other computers connected to the Internet. When information is sent over the Internet to your computer how does your computer accept that information? It accepts that information by using TCP or UDP ports.
An easy way to understand ports is to imagine your IP address is a cable box and the ports are the different channels on that cable box. The cable company knows how to send cable to your cable box based upon a unique serial number associated with that box (IP Address), and then you receive the individual shows on different channels (Ports).
Ports work the same way. You have an IP address, and then many ports on that IP address. When I say many, I mean many. You can have a total of 65,535 TCP Ports and another 65,535 UDP ports. When a program on your computer sends or receives data over the Internet it sends that data to an ip address and a specific port on the remote computer, and receives the data on a usually random port on its own computer. If it uses the TCP protocol to send and receive the data then it will connect and bind itself to a TCP port. If it uses the UDP protocol to send and receive data, it will use a UDP port. Figure 1, below, is a represenation of an IP address split into its many TCP and UDP ports. Note that once an application binds itself to a particular port, that port can not be used by any other application. It is first come, first served.
This all probably still feels confusing to you, and there is nothing wrong with that, as this is a complicated concept to grasp. Therefore, I will give you an example of how this works in real life so you can have a better understanding. We will use web servers in our example as you all know that a web server is a computer running an application that allows other computers to connect to it and retrieve the web pages stored there.
In order for a web server to accept connections from remote computers, such as yourself, it must bind the web server application to a local port. It will then use this port to listen for and accept connections from remote computers. Web servers typically bind to the TCP port 80, which is what the http protocol uses by default, and then will wait and listen for connections from remote devices. Once a device is connected, it will send the requested web pages to the remote device, and when done disconnect the connection.
On the other hand, if you are the remote user connecting to a web server it would work in reverse. Your web browser would pick a random TCP port from a certain range of port numbers, and attempt to connect to port 80 on the IP address of the web server. When the connection is established, the web browser will send the request for a particular web page and receive it from the web server. Then both computers will disconnect the connection.
Now, what if you wanted to run an FTP server, which is a server that allows you to transfer and receive files from remote computers, on the same web server. FTP servers use TCP ports 20 and 21 to send and receive information, so you won't have any conflicts with the web server running on TCP port 80. Therefore, the FTP server application when it starts will bind itself to TCP ports 20 and 21, and wait for connections in order to send and receive data.
Most major applications have a specific port that they listen on and they register this information with an organization called IANA. You can see a list of applications and the ports they use at the IANA Registry. With developers registering the ports their applications use with IANA, the chances of two programs attempting to use the same port, and therefore causing a conflict, will be diminished.