Card 02/ 09
Ports and Sockets: The Five Values That Name a Connection
Two browser tabs reach one server on port 443, and the server still tells them apart.
A connection is identified by five values together: the protocol, the source address and port, and the destination address and port. The combination is called the five-tuple. Each end of a connection is a socket, an address paired with a port, and no two live connections share all five values, which is how one server port carries thousands of connections at once.
Open the same site in two browser tabs. Both connect to the same server address on port 443, using TCP, from the same laptop address. The responses never cross, because the laptop chose a different source port for each connection.
| Value | Tab 1 | Tab 2 |
|---|---|---|
| Protocol | TCP | TCP |
| Source address | 192.168.1.20 | 192.168.1.20 |
| Source port | 51514 | 51530 |
| Destination address | 203.0.113.10 | 203.0.113.10 |
| Destination port | 443 | 443 |
The two kinds of port play different roles.
The server's port is well known. A service listens on a fixed, published number, so clients know where to find it without asking: 22 for SSH, 25 for SMTP between mail servers, 53 for DNS, 80 for HTTP, 443 for HTTPS, 5432 for PostgreSQL. IANA, the body that registers ports, reserves 0 to 1023 as system ports and registers more up to 49151.
The client's port is ephemeral. The operating system picks an unused number for each new outgoing connection and releases it when the connection closes. IANA suggests 49152 to 65535 for these; Linux uses 32768 to 60999 by default. The client never needs a fixed port, because the server replies to whatever source port the request came from.
The server tells connections apart by the whole five-tuple, not by its own port. A thousand clients on port 443 share the destination address and port, but every one has a different source address or port.
The limit follows from the same arithmetic. One client can hold only as many simultaneous connections to one server port as it has ephemeral ports, a few tens of thousands. A proxy or NAT device that sends every user's traffic from one address can run out, and new connections then fail even though nothing is down.
So to tell one connection from another in a log or a packet capture, read all five values; the server port alone says only which service was reached.
← → move through sections and cards