Port Lookup and Checker Guide: Open Ports, Testing Methods and Internet Diagnostics

You set up a web server, launched a game server, or you are trying to reach the home security camera from outside; but the connection just refuses to come up. The first question that hits you at this point is always the same: is the port open or closed? Port lookup is the foundational skill of modern internet diagnostics, and it is critical not only for system administrators but for anyone who works remotely, runs their own server, or uses cameras, game servers, or IoT devices. This guide walks port lookup end-to-end starting from the definition, covering nmap, telnet, netcat, PowerShell Test-NetConnection, netstat, ss and online port checker tools; it also explains the technical foundations of CGN/NAT, ISP filtering and internet infrastructure querying.

Most users think of port lookup as nothing more than "opening a closed port." Yet behind the topic sits TCP/IP itself, the IANA-managed list of well-known ports, the ephemeral port strategy defined in RFC 6056, NAT traversal techniques, and the increasingly widespread CGN (Carrier Grade NAT) infrastructure in Turkey. Without grasping all of these properly, port forwarding ends in either a setup that doesn't work or a security hole. Searches for data query, which port is open and internet info lookup usually share the same intent: to see the network's current state in concrete numbers.

Related guides: What is DNS and how to change settings · Domain lookup tools · Nginx configuration guide · VPS security hardening · Linux server administration basics · SSH protection with Fail2ban

What Is a Port? Logical Addressing Over TCP/UDP

When a packet reaches a destination host on the TCP/IP stack, that host may be running dozens of services concurrently: a web server, a mail server, an SSH daemon, a database, a VPN gateway. The IP address alone doesn't tell which service the packet is destined for; an IP address only finds the machine. The port number is the logical addressing layer that routes the packet to the correct process inside the machine. RFC 793 (TCP) and RFC 768 (UDP) headers define a 16-bit port field, which means 65,536 distinct ports in the range 0-65535.

IANA splits this range into three sections: well-known ports (0-1023), registered ports (1024-49151) and dynamic / ephemeral ports (49152-65535). The Linux kernel's default ephemeral range is 32768-60999 and can be tuned via /proc/sys/net/ipv4/ip_local_port_range. On high-traffic proxies or services that open lots of outbound connections, narrowing this range is a common source of EADDRNOTAVAIL errors.

Do TCP and UDP Ports Share the Same Number?

Yes — TCP 53 and UDP 53 are two completely independent ports. DNS uses both UDP 53 (for short queries) and TCP 53 (for zone transfers and large responses); on the same host, different processes can listen on each at the same time. When you run a port lookup you must always specify the protocol; otherwise the phrase "port is open" is misleading.

• TCP: Connection-oriented, three-way handshake (SYN, SYN-ACK, ACK), guaranteed delivery. Port lookup checks whether all three packets complete.
• UDP: Connectionless, no handshake, best-effort delivery. The question "is the port open or closed" doesn't get a clean answer over UDP — if no ICMP "port unreachable" comes back, the port is either open or filtered.
• SCTP: Used in the telecom world, supports multi-streaming and multi-homing. Most port lookup tools don't cover SCTP by default; nmap -sY measures it.

Common Ports and Which Service Uses Them

In practice, port lookups return the same 20-25 ports most of the time. A sysadmin who memorizes them diagnoses most problems within seconds. The table below is compiled from IANA records and common operational practice.

• 20/21 (TCP) — FTP data and control channel. Modern deployments have moved on to SFTP.
• 22 (TCP) — SSH. The most heavily targeted port on a server; Fail2ban is a must against brute-force attacks.
• 23 (TCP) — Telnet. Unencrypted, never expose it to the internet.
• 25 (TCP) — SMTP. Most ISPs block outbound 25; use 587 for mail relay.
• 53 (TCP/UDP) — DNS. UDP for short queries, TCP for zone transfers.
• 80 (TCP) — HTTP. Kept open for HTTPS redirects.
• 110 / 143 / 993 / 995 (TCP) — POP3, IMAP, IMAPS, POP3S.
• 123 (UDP) — NTP. Misconfiguration leads to DDoS amplification.
• 143 / 587 / 465 (TCP) — IMAP / SMTP submission / SMTPS.
• 389 / 636 (TCP) — LDAP / LDAPS.
• 443 (TCP) — HTTPS. The same port also opens UDP for HTTP/3 (QUIC).
• 445 (TCP) — SMB. Should never be exposed to the internet, especially after WannaCry.
• 1433 (TCP) — Microsoft SQL Server.
• 3306 (TCP) — MySQL / MariaDB.
• 3389 (TCP) — RDP. The main entry point for brute-force and ransomware attacks.
• 5432 (TCP) — PostgreSQL.
• 5900 (TCP) — VNC.
• 6379 (TCP) — Redis. With auth disabled and exposed to the internet, you'll be attacked within five minutes.
• 8080 / 8443 (TCP) — Alternative HTTP/HTTPS, frequently used for reverse proxies.
• 27017 (TCP) — MongoDB.
• 3478 / 5349 (UDP/TCP) — STUN / TURN, NAT traversal for WebRTC.

There is a Turkey-specific quirk: many home users see their ISP filtering ports such as 25, 80, 443, 445, 139, 137 and 1900 on inbound or outbound. The intent is abuse prevention, but it is the most common reason home-hosted servers report "port closed." We will revisit this in the CGN section.

Which Port Is Open? How Online Port Checkers Work

Online port checker tools (the many "port lookup" pages in Turkish or international yfrog-style tools) hide a great deal of complexity behind a single line. The logic is this: the tool sends a TCP SYN packet from its remote server to your publicly visible IP address on the port you specify. Three outcomes are possible: SYN-ACK returns (port open), RST returns (port closed, no process listening), no answer at all (port filtered, most likely a firewall is dropping the packet).

For that reason an online tool's result never reflects the LAN-internal state. Even if your server is listening on 192.168.1.10:8080 inside the LAN, an online tool will show "closed" unless the modem has a port-forwarding rule. Conversely, with a cloud firewall accept rule in place, the tool may report "open" while the server is actually down.

• Open: SYN-ACK received; a service is listening and reachable from outside.
• Closed: RST received; no service, but the packet reached the host without being filtered.
• Filtered: No response; firewall, ISP or cloud SG silently dropping the packet.
• Open|Filtered: Common with UDP; even ICMP unreachable doesn't come back.

Professional Port Scanning with nmap

nmap is the gold standard of port lookup. It offers TCP and UDP, stealth and service detection, OS fingerprinting and a script engine (NSE). The official reference at nmap.org/book/man.html is updated continuously. The examples below work with the 2026 release.

Timing templates from -T0 to -T5 set the aggressiveness. Using -T2 or -T3 before scanning a production server keeps IDS/IPS systems from blocking you. If the server isn't yours, you must have authorization to scan — under articles 243 and 244 of Turkish Penal Code (TCK) No. 5237, unauthorized access carries criminal liability.

Detailed Lookups with the nmap NSE Script Engine

NSE (Nmap Scripting Engine) is Lua-based and ships with more than 600 ready-made scripts for vulnerability discovery, brute-force attacks, service enumeration, even exploitation. nmap.org/nsedoc catalogs them all. The most commonly used:

• http-headers: Lists security headers from HTTP responses.
• http-title: Pulls the title from open HTTP services for quick CMS detection.
• ssh-hostkey: Shows the SSH server's host key fingerprint.
• ssl-cert: Detailed TLS certificate information.
• smb-os-discovery: OS, hostname and domain over SMB.
• vulners: Looks for matches in the CVE database.
• banner: Reads the first 1024 bytes of the service banner, often revealing the service version.

Quick Port Test with Telnet

Telnet is an ancient protocol from 1969, yet it is still handy for port lookup. It asks one question: "Can I complete a TCP handshake to this IP on this port?" Yes means open, no means closed or filtered. On systems where it isn't installed, run apt install telnet or enable it on Windows under "Optional Features → Telnet Client."

Telnet has two big drawbacks: it only supports TCP, and although it is useful for sending manual commands to text-based protocols like SMTP, HTTP, IMAP, it cannot speak properly to a service behind TLS. For HTTPS testing, use openssl s_client.

netcat (nc): The Swiss Army Knife

netcat goes well beyond port lookups; it bundles port listening, file transfer and banner grabbing into one tool. The most common variants are ncat (part of the nmap project), OpenBSD nc and GNU netcat; flags can differ between them.

Because it is also useful to attackers, netcat does not ship by default on many distros. ncat is the more modern alternative: it offers SSL support, broker mode and command-execution restrictions and other production-friendly features.

Windows: PowerShell Test-NetConnection

On Windows, the fastest way to do a port lookup is the Test-NetConnection cmdlet. It works without installing the Telnet client or any third-party tool and is built in to PowerShell 5.1 and above. The Microsoft Learn reference details every parameter.

A caveat: Test-NetConnection sends ICMP echo + TCP SYN under the hood. If the target doesn't answer ICMP, you will see PingSucceeded: False, but that doesn't mean the port is closed; check the TcpTestSucceeded field instead.

netstat and ss on Linux: Which Port Is Listening?

"Which port is open?" has two meanings: can it be reached from outside (covered above) and which process is listening internally. For the latter, Linux provides netstat and its modern successor ss. ss works through netlink, runs 10x faster than netstat, and should be the default choice on busy production servers.

The lsof -i alternative is also powerful and shows which file/socket a process holds. In production, running ss -tlnp alongside systemctl list-units --type=service to identify services that are listening but shouldn't be is the first step of VPS hardening.

Firewall: The Layer That Actually Opens or Closes Ports

If a service is listening but unreachable from outside, the firewall is almost always the culprit. There are three main building blocks on Linux: iptables (older but still widespread), nftables (its modern successor), and the user-friendly managers ufw (Ubuntu/Debian) and firewalld (RHEL/CentOS/Rocky) sitting on top of them.

Cloud providers (Hetzner, AWS, DigitalOcean, Azure) add another cloud-side firewall layer: Security Group on AWS, NSG on Azure, Firewall on Hetzner. Even if UFW inside the host is open, the port shows as closed when the cloud firewall blocks it. Our infrastructure as code with Terraform guide explains how to manage these rules as code.

Port Forwarding: From Home Modem to Server

The leading reason home users see "closed" in port lookups is NAT. Your modem usually has a single public IP on the WAN side; devices on the LAN (laptop, camera, console) use private addresses such as 192.168.x.x or 10.x.x.x. To reach the LAN from outside, you must define port forwarding (a NAT pinhole) on the modem.

• Step 1: Assign a static LAN IP to your device (DHCP reservation). If the IP changes after a modem reboot, forwarding breaks.
• Step 2: Open the modem admin UI (often 192.168.1.1 or 192.168.0.1). Find the "Port Forwarding", "NAT" or "Virtual Server" tab.
• Step 3: Enter external port (WAN), internal port (LAN), internal IP, protocol (TCP/UDP/Both). Example: WAN 8080 → LAN 192.168.1.10:80 TCP.
• Step 4: Allow inbound on the device's firewall too (Windows Defender Firewall, ufw, etc.).
• Step 5: Verify with an online port checker against your public IP. Important: test from outside the LAN — over mobile data or another external host — not from inside.

Many modems ship with UPnP (Universal Plug and Play) enabled, allowing apps to set up port forwarding automatically. While convenient, it is a security risk — malware can punch holes in your firewall through UPnP. A security-aware user disables UPnP and configures port forwarding by hand.

CGN and Turkey: Why Won't My Port Open?

The IPv4 address pool ran out in 2011. Unable to issue new IPs, ISPs began deploying Carrier Grade NAT (CGN, RFC 6598): a way to share the same public IP across dozens of subscribers. In Turkey, the overwhelming majority of mobile lines, some fiber plans and nearly every 4G/5G operator use CGN. The result: even on the WAN side you don't have a real public IP — you sit behind your ISP's NAT.

In that case, port forwarding will not work no matter what you try, because external requests reach the ISP's CGN and can't be forwarded back to you. If data query and port-test tools come back "filtered" while everything is correct on the modem side, you need to ask your ISP for a real (static, public) IP. In Turkey this service typically runs around 30-150 TRY/month (roughly $1-5 USD/month, 2026 figures), depending on the provider.

• CGN detection: If the IP shown by whatismyipaddress.com differs from your modem's WAN IP, you're behind CGN.
• Mobile 4G/5G: Almost always CGN. A static public IP is usually offered only on enterprise plans.
• FTTH fiber: Most providers default to CGN; a public IP is available for an extra fee.
• VDSL/ADSL: Usually gets a real IP, but some promo plans ship CGN by default.
• Workaround — alternative tunnels: Reverse-tunnel tools like Cloudflare Tunnel, Tailscale, ngrok and frp bypass CGN entirely.

Internet Info Lookup: Infrastructure, Speed, Port

Searches around internet info lookup usually express two intents: the user wants to see the technical state of their own connection (infrastructure, speed, ports), or wants to know which internet services are available at an address. In Turkey, the local providers running these queries include Turk Telekom, TurkNet, Superonline, NetSpeed, WorldNet, KabloNet and Vodafone. They all expose an address-based infrastructure lookup page; given province, district, neighborhood and building, they report which infrastructure (Fiber, GPON, VDSL, ADSL) reaches that address and the maximum speed available.

• ADSL: Copper telephone line, theoretical max 24 Mbit/s download, asymmetric upload (1-2 Mbit/s). Inversely related to line length.
• VDSL2: Up to 100 Mbit/s on the same copper; vectoring + bonding can reach 200 Mbit/s.
• GPON / Fiber: Optical fiber, asymmetric 1 Gbit/s download / 100-300 Mbit/s upload is common. Distance-independent.
• XGS-PON / 10G: Next-gen PON with 10 Gbit/s symmetric capacity. Available in pilot regions in Turkey.
• 5G FWA: Fixed wireless access over 5G. An alternative where fiber isn't available.

BTK's internet.btk.gov.tr portal offers an independent infrastructure/site lookup service — used to obtain operator-neutral information. The same portal also handles BTK number portability, SIM blocking and site-blocking queries.

Port Lookup vs Port Scanning: The Legal and Ethical Boundary

Connecting to a single port on a server (telnet, web browser) is everyday diagnostics. Systematically scanning all 65535 ports on the same IP is a different category. In Turkey, articles 243-244 of the Turkish Penal Code No. 5237 cover "unauthorized access to information systems" and "obstructing, disrupting systems and destroying data." Unauthorized scanning shows up in logs even when no harm is intended, and may be the basis of a complaint.

• Your own server: Scan as you wish. Periodic security audits are even recommended.
• A client's server: Get written authorization (a penetration testing contract). Define scope and time window.
• Bug bounty program: Touch only the hosts inside the program's scope. Platforms like HackerOne or Intigriti have explicit rules.
• Public/training scans: scanme.nmap.org is the nmap team's public training target.
• Off-limits: Government bodies, financial systems, anyone else's server. Even as a certified pentester, unauthorized scanning is not legal.

Data Query: SQL-Style Data Lookup Logic

Although data query shares the same word group as port lookup, it lives in a different domain — running SQL-style queries against structured datasets. Cloud analytics services like Google Ads Data Hub, BigQuery, Snowflake and Athena all expose a SQL-like query language. On these platforms start_date, end_date and time_zone ship as reserved parameters; custom parameters are referenced with the @parameter_name syntax.

For deep query optimization, see our SQL query optimization guide. Trading platforms (iDeal Data, Matriks, FOREX) use the same logic for technical-analysis filtering — symbol screens with conditions like RSI 14 below 30 / above 70, or a moving-average difference under 1%. All of these systems share the same paradigm: structured data + parameterized query + bounded result set.

Port Lookups in Cloud and VPS Practice

The first thing to do after buying a VPS is to check the listening ports. Most providers' default images expose nothing but SSH (22) — but some distros may leave 25, 111 (rpcbind) or 5355 (LLMNR) open unnecessarily. Our VPS guide covers this hardening topic in depth.

Always run the cloud firewall and the host firewall together — defense in depth. If one is misconfigured, the other contains the blast radius. Restricting SSH on the cloud firewall to your own static IP (whitelist) drives brute-force attacks close to zero.

Port Management with Docker and Containers

When Docker runs a container, it can publish ports on the host. This adds NAT rules to iptables independently of the host firewall, and UFW may not see them. This Docker behavior surprises many users: "5432 is denied in UFW yet reachable from outside" is exactly this scenario.

In our Docker Compose guide we walk through this with production examples: which services should publish ports and which should live exclusively on internal networks.

NAT Traversal and VPN: STUN, TURN, WireGuard

In WebRTC, P2P file sharing and online gaming, port forwarding for every user isn't practical. STUN (RFC 5389) lets a client discover its public IP+port mapping. TURN (RFC 5766) relays all traffic when NAT can't be punched. ICE (RFC 8445) tries the two automatically. Coturn is an open-source STUN/TURN server using UDP 3478 (STUN) and 5349 (TURN over TLS). The cleanest way to bypass CGN is to set up a VPN tunnel through your own VPS: the cloud VPS has a real public IP, your home server connects to it over VPN, and traffic that hits a VPS port is forwarded through the tunnel. WireGuard has been part of the Linux kernel officially since 2018, runs 5-10x faster than OpenVPN, and is simple to configure.

With this setup, traffic arriving on port 8080 of the VPS is forwarded through the WireGuard tunnel to port 80 of your home server. It works whether or not CGN is involved. Cloudflare Tunnel and Tailscale are friendlier alternatives; Cloudflare Tunnel is production-ready even on the free tier.

DNS, IP and Port Resolution Together

When you open a connection, three steps happen in order: DNS A/AAAA records resolve, a TCP/UDP connection opens to the IP, and the application protocol speaks over the port. Failure can hit any of these. To diagnose, you must test each one separately.

If the failure is in the DNS step, see our DNS guide. To check domain ownership over WHOIS/RDAP, the domain lookup tools guide also helps.

Security: Spotting Port Scan Traces on the Server Side

A note on performance: a single TCP SYN-ACK round trip is around 20-50 ms within the same continent and 100-200 ms transatlantic. Because of UDP probe + ICMP rate limiting, UDP scans are 10-100x slower than TCP. With nmap, scanning all 65535 ports against a single host at T4 speed completes in 1-3 minutes; at T2 it stretches to 10-30 minutes. A full scan of a /24 subnet of a thousand hosts can take hours.

As the server owner, know that every scan leaves traces. nginx/apache access logs, syslog, auth.log, journalctl and especially the iptables LOG target are all used to catch scans.

For continuous monitoring, use Prometheus + Grafana or the ELK stack; suspicious connection rate should fire as a metric-driven alarm. Crowd-sourced IP reputation tools like Modsecurity or CrowdSec provide automatic blocking.

Limits of Online Port Checker Tools

Online tools are great for quick checks, but watch out: most only test TCP and skip UDP. Some only let you pick from a "common ports" list with no custom port input. Worse, some cache hundreds of users' results at the same time and return stale data. For critical decisions, treat the online tool as a first indicator only and confirm via the command line.

• Speed advantage: One tap from a browser. Even works from mobile.
• Tested from the right vantage: The tool's server sits in a different AS, so it catches ISP-side filtering.
• Limitation 1: TCP-focused; no UDP, SCTP or custom protocol testing.
• Limitation 2: Usually only well-known ports are offered.
• Limitation 3: Caching can keep newly opened ports showing as "closed" for minutes.
• Limitation 4: Logging — some tools record the tested IPs. Don't use them in sensitive environments.

Port Lookups on Kubernetes

In a Kubernetes environment every pod has its own IP+port, every service has a clusterIP, NodePorts and an Ingress. When an application is reported "unreachable," the port lookup must happen at three layers: pod-internal (kubectl exec -it deploy/api -- curl -v localhost:3000/health), service-cluster (a debug pod with nc -zv api-svc.production 80 or dig api-svc.production.svc.cluster.local), external (nmap -p 80,443 ingress-ip against the Ingress public IP). Restricting pod-to-pod port access via NetworkPolicy — for example, only the api pod can reach the postgres pod on 5432 — is critical for layered security. Our Kubernetes basics guide covers NetworkPolicy and service mesh details.

IPv6 and Port Lookup

IPv6 adoption is moving slowly in Turkey, but most modern home modems and cloud providers now offer IPv6. There is no NAT in IPv6 — every device can have its own global IPv6 address. That doesn't mean port forwarding is irrelevant, because the ISP or the device firewall can still drop inbound. nmap, ss, telnet and nc all do IPv6 testing with the -6 flag: nmap -6 -p 22,80,443 2001:db8::1, nc -6 -zv 2001:db8::1 443, ss -6 -tlnp. Resolve DNS AAAA records with dig +short host AAAA.

Common Errors and Their Fixes

• "Connection refused": The service isn't listening. Confirm with ss -tlnp and start it if needed.
• "Connection timed out": A firewall is dropping the packet. Check UFW, the cloud SG, iptables and ISP filters.
• "No route to host": Routing table problem; check with ip route.
• "Address already in use": Another process holds the same port. sudo ss -tlnp 'sport = :80'.
• "Permission denied" (port below 1024): Non-root processes cannot bind ports below 1024; grant the capability via setcap cap_net_bind_service=+ep.
• "Failed to bind": An IPv6 + IPv4 conflict may be at play. Check net.ipv6.bindv6only=0.
• Unreachable from a specific IP: That IP or AS may be blocked. Review the DDoS protection rules.

Automation: Periodic Port Audits

A one-shot scan isn't enough. New service installs, freshly opened holes and forgotten dev ports accumulate over time. A weekly or daily periodic scan can be plugged into CI/CD or run as a cron job.

nmap vs masscan vs zmap: Scanning Tool Comparison

A legal note: in Turkey, port lookup on its own is not a crime; however, scans driven by attempted unauthorized access or intent to violate system security fall under articles 243-244-245 of TCK No. 5237. Under KVKK and Internet Law No. 5651, operators must keep records of scanning attempts. If you work as a professional pentester, sign the contract on paper, attach a scope document and carry insurance.

• nmap: The richest feature set, NSE script engine, OS detection, banner grabbing. Slow at internet scale.
• masscan: 10 million packets per second; can scan all of IPv4 in a day. Doesn't do service detection though.
• zmap: An internet-scale research tool from universities. Speed comparable to masscan, with cleaner random sampling.
• RustScan: A frontend to nmap; first scans quickly, then invokes nmap only on the open ports.
• Angry IP Scanner: GUI, aimed at Windows users.

Game Servers and Port Lookups

Games like Minecraft (TCP 25565), CS2 (UDP 27015), Valorant, Rust and Ark Survival each have their own ports. For self-hosters, port forwarding plus a CGN check is critical. The table below lists the most common game server ports:

• Minecraft Java: TCP 25565
• Minecraft Bedrock: UDP 19132
• CS2 / CS:GO: UDP 27015 (game), TCP 27015 (rcon)
• Rust: UDP 28015 (game), 28016 (rcon), 28082 (app)
• ARK: UDP 7777, 7778, 27015
• Valheim: UDP 2456-2458
• Terraria: TCP 7777
• Factorio: UDP 34197
• Palworld: UDP 8211
• SteamCMD/Steam: UDP 27000-27100, TCP 27015-27050

Quick Decision Flow: A Port Lookup Algorithm

Security cameras, NVRs and IoT devices typically use ports 80 (web UI), 8000 (Hikvision proprietary), 554 (RTSP) and 8554. Exposing these directly to the internet is a major security mistake — Shodan lists millions of cameras left open. The right approach: keep the device behind a VPN, and instead of port forwarding use WireGuard or Tailscale. The ordered checklist below resolves most "port won't open" cases: (1) confirm the service is listening with ss -tlnp from inside the host; (2) check the application is responding from localhost with curl http://localhost:PORT; (3) test the host firewall from the same LAN with nc -zv LAN_IP PORT; (4) review the cloud firewall / Security Group rules; (5) make sure the ISP is not filtering outbound 25/445 and the like; (6) check whether the modem WAN IP matches the IP seen by the online checker (a CGN test); (7) verify the modem port-forwarding rule and the static LAN IP assignment are correct; (8) run the final test from mobile data with nc -zv WAN_IP PORT.

References and Further Reading

• IANA Service Name and Port Number Registry — the official port assignment list
• Nmap Reference Guide
• RFC 793 — Transmission Control Protocol
• RFC 6056 — Recommendations for Transport-Protocol Port Randomization
• RFC 6598 — IANA-Reserved IPv4 Prefix for Shared Address Space (CGN)
• RFC 8445 — Interactive Connectivity Establishment (ICE)
• Microsoft Learn — Test-NetConnection
• openwall.com oss-security mail list
• Shodan — the search engine for internet-exposed devices
• Censys — internet asset discovery platform

Related Posts

• What Is DNS, How to Change the Settings — the name resolution layer that comes before port lookup
• Domain Lookup Tools: WHOIS, RDAP and DNS
• VPS Security Hardening
• SSH Brute-Force Protection with Fail2ban
• Nginx Configuration Guide
• Defending Against DDoS Attacks
• Linux Server Administration Basics
• Kubernetes Basics