How ports route you to the right program, what a socket is, and how to read live connection state.
Ports and State
In brief
Objectives
- Explain what a port and a socket are
- Name the common service ports
- Read live connection state with ss
An IP address gets you to a machine; a port gets you to the right program on it. A web server listens on port 80 or 443; SSH on 22. The combination of IP address and port is a socket.
| Port | Service |
|---|---|
| 22 | SSH |
| 53 | DNS |
| 80 / 443 | HTTP / HTTPS |
TCP keeps state for each connection — ESTABLISHED, TIME_WAIT, and so on. You can see it live:
$ ss -tn state established
Recv-Q Send-Q Local Address:Port Peer Address:Port
0 0 10.0.0.5:51514 93.184.216.34:443
Tip
Knowing which ports should be open is the whole basis of a port scan: an unexpected open port is often the first thread an attacker — or a defender doing an audit — pulls on.
Recap
- A port selects the program; IP + port is a socket
- 22 SSH, 53 DNS, 80/443 web
- Unexpected open ports are where audits and attacks begin