An IP address gets a packet to a machine. A port decides which program on that machine receives it. Together they form the address of a service, and every exposed service is a decision someone made.
This lesson covers the transport layer and the protocol your browser uses all day.
Ports
Ports are 16-bit numbers from 0 to 65535. The first 1024 are well-known and usually require privilege to bind:
| Port | Service |
|---|---|
| 22 | SSH |
| 25 / 465 / 587 | SMTP (mail submission) |
| 53 | DNS |
| 80 | HTTP |
| 443 | HTTPS |
| 3306 | MySQL |
| 3389 | RDP |
| 5432 | PostgreSQL |
A service can listen on any port; the numbers are conventions, not enforcement. Attackers know this, which is why "security by obscure port" is not a control.
TCP and UDP
TCP is connection-oriented. It performs a three-way handshake (SYN, SYN-ACK, ACK), numbers segments, acknowledges delivery and retransmits what is lost. Web traffic, SSH and email use it.
UDP is connectionless. It sends datagrams without a handshake or delivery guarantee. DNS, DHCP, video and many games use it because speed matters more than perfect delivery.
Neither is encrypted. Encryption is added by protocols such as TLS.
Continue this lesson in the player
A free account unlocks the full lesson, the five-question knowledge check, progress tracking, notes and the completion certificate.