Port

A port is a 16-bit field in the TCP and UDP headers (and in SCTP and DCCP), giving values from 0 to 65535, with port 0 reserved. It is a transport-layer concept: IP and ICMP have no ports, and the word has nothing to do with the physical ports on a switch. A listening socket is identified by address and port, and a TCP connection by the full tuple of protocol, source address, source port, destination address and destination port. TCP and UDP have separate port spaces, so TCP 53 and UDP 53 are different endpoints that just happen to be used by the same service.

IANA maintains the service name and port number registry under RFC 6335, which divides the space into system or well-known ports (0-1023), user or registered ports (1024-49151) and dynamic or private ports (49152-65535). On Unix-like systems binding below 1024 traditionally requires root privileges (on Linux, the CAP_NET_BIND_SERVICE capability). Clients use ephemeral source ports from a local range: Windows has used the IANA range 49152-65535 since Vista, while Linux defaults to 32768-60999, configurable in net.ipv4.ip_local_port_range. Registration is only convention; any program can listen on any port, so traffic on 443 is not necessarily HTTPS, and firewalls that decide by port number alone can be bypassed by tunnelling over an allowed port.

Some ports recur in incident reports: 22 (SSH), 23 (Telnet, cleartext), 25 (SMTP), 53 (DNS), 80 and 443 (HTTP and HTTPS), 445 (SMB), 3389 (RDP) and database ports such as 1433 (Microsoft SQL Server), 3306 (MySQL), 5432 (PostgreSQL) and 6379 (Redis). Internet-exposed RDP is a common ransomware entry point, and SMB on 445 was the propagation channel for WannaCry in 2017 via the EternalBlue exploit.

Port scanners such as Nmap classify ports as open (the target answers a SYN with SYN/ACK), closed (it answers with RST) or filtered (no reply, or an ICMP unreachable message, usually because a firewall drops the probe). A SYN or "half-open" scan never completes the handshake; UDP scanning is slower and more ambiguous because silence can mean open or filtered. Moving a service to a non-standard port reduces log noise from automated scans but is not a control, since a full scan finds it within minutes. Unexpected exposures often come from NAT port forwarding or UPnP on routers opening ports automatically. Practical controls are disabling unneeded services (CIS Controls v8 Safeguard 4.8), comparing listening ports (ss -tulpn or netstat -ano) against an approved baseline, and scanning the external address space regularly, as in the municipality example.