What Is a Port Number in Networking and Why It Decides Where Your Traffic Goes

You’ve seen port numbers everywhere. Here is what they actually are and why they matter more than most people realise

Photo by Leiada Krözjhen on Unsplash

Your computer is connected to the internet. Dozens of things are happening at once. A browser downloading a webpage. A Spotify stream playing music. An SSH session open to a remote server. An email client checking for new messages.

All of that traffic arrives at the same network interface on the same machine through the same IP address.

So how does your computer know which data belongs to which application?

The answer is a single number attached to every piece of network traffic. That number is a port.

What a port number actually is

A port is not a physical thing. It is a number between 0 and 65535 that the operating system uses to direct incoming and outgoing traffic to the right application.

Think of your IP address as the address of a building. The port number is the specific door inside that building. Mail arriving at the building still needs to go to the right room. The port number tells the system which room.

When your browser makes a request to a website, that request doesn’t just go to an IP address. It goes to an IP address and a port number. The web server on the other end is listening specifically on that port, waiting for exactly that kind of traffic.

The port numbers you already use every day

Some port numbers are so universally standardised that you use them constantly without thinking about them.

Port 80 is HTTP. Every time you visit a website without HTTPS, your browser connects to port 80 on the web server.

Port 443 is HTTPS. Every secure website connection goes through port 443. When you see the padlock in your browser, your traffic is going to port 443.

Port 22 is SSH. Every time you connect to a remote server with ssh user@hostname, the connection goes to port 22 by default.

Port 25 is SMTP, the protocol that sends email between mail servers.

Port 53 is DNS. Every time you type a domain name and your computer looks up its IP address, that lookup goes to port 53 on a DNS server.

Port 3306 is MySQL. If you run a database locally and connect to it, the connection goes to port 3306 by default.

Port 5432 is PostgreSQL.

Port 6379 is Redis.

These are called well-known ports. They exist in the range 0 to 1023 and are reserved for specific, widely recognised services.

The three ranges and what each one means

Ports are divided into three official ranges.

0 to 1023 are well-known ports. Reserved for standard protocols. You need root or administrator privileges to bind a service to one of these on Linux. That’s why running a web server on port 80 requires sudo.

1024 to 49151 are registered ports. Used by specific applications and services that have been registered with the IANA. Database servers, game servers, and application-specific services typically live here.

49152 to 65535 are dynamic or ephemeral ports. When your browser makes a request to a web server, the server responds to your machine. That response needs a destination port on your end. Your operating system picks a temporary port from this range automatically for the return traffic. Once the connection closes, that port is released and available again.

See which ports are currently open on your Linux machine

ss -tulpn

This lists every port your machine is currently listening on, which process owns it, and whether it’s TCP or UDP. Run it and you’ll likely find services listening on ports you never explicitly configured, because installed software registers itself automatically.

See which port a specific service is using

ss -tulpn | grep nginx

Replace nginx with whatever service you’re checking. The output shows the port and address it’s bound to.

Why two services can’t share a port

Each port on a machine can only be owned by one process at a time. If nginx is already running on port 80 and you try to start Apache on the same port, Apache fails immediately. The port is already taken.

This is one of the most common causes of service startup failures. The fix is either stopping the service already using the port or configuring one of them to use a different port number.

ss -tulpn | grep :80

This tells you exactly which process is holding port 80 before you start troubleshooting anything else.

Why attackers care about ports

Open ports are entry points. An open port with a service listening on it is an application that accepts connections from the outside. If that application has a vulnerability, the open port is how an attacker reaches it.

This is why servers running in production should only have ports open that are actively needed. Every unnecessary open port is an unnecessary risk. Checking what’s open on your own machine with ss -tulpn is a basic security habit worth building before anything else.

The number that moves everything

Every piece of internet traffic you send or receive has a source port and a destination port stamped on it. Your operating system reads those numbers and routes the traffic to the right place automatically, thousands of times per second, silently.

Port numbers are not an advanced concept. They are the foundation of how networked applications communicate. Once you understand what the number means, every networking error, every firewall rule, every service configuration becomes noticeably easier to read.

Most people learn Linux commands. Few learn how to think. Every Wednesday in Terminal to AI I share one practical terminal skill and one sharp lesson about information, decisions, and building a life that actually pays. Former smart contract auditor. Learning in public. Free to join. **Terminal to AI →**