What Is a Port Number and Why Does It Matter?
A server's IP address identifies that machine on the network; the port number states which of the dozens of services running simultaneously on the same IP the connection is meant for. A server can publish HTTP, HTTPS, SSH and a database service at the same time over a single IP address — the operating system routes the incoming connection to the right process by looking at the destination port number. Without this mechanism, only one service could run on a single IP address at a time.
The port number is a 16-bit field, so it can take a value between 0 and 65535. IANA (the Internet Assigned Numbers Authority) divides this space of 65536 ports into three regions, setting a standard for which port range is used for which purpose.
The Three Port Ranges: Well-Known, Registered, Dynamic
Port numbers are not handed out at random; there are three clear ranges defined by IANA, and each carries a different meaning for server administration.
| Range | Port Numbers | Description |
|---|---|---|
| Well-known | 0-1023 | Reserved for core services such as HTTP, SSH and DNS; on Unix/Linux systems, opening a socket in this range has historically required <b>root/administrator privileges</b>. |
| Registered | 1024-49151 | Assigned by IANA to specific applications (3306 for MySQL, 5432 for PostgreSQL and so on); no administrator privileges are needed to open a socket. |
| Dynamic / Ephemeral | 49152-65535 | Never permanently assigned to a service; the operating system assigns them automatically as temporary <b>source ports</b> for outbound connections. |
The requirement for a process running with root privileges in order to bind to a port in the well-known range (port 80, for instance) is a security restriction designed to stop an ordinary user process from impersonating a critical service. The registered range is where most application servers and databases actually run; no special privilege is needed to listen on those ports. The dynamic range is not an area to manage by hand — when your browser connects to a website, the temporary port used on your local machine is chosen automatically from this range.
The Port Numbers You Meet Most Often
Most of the services encountered daily in server administration use fixed ports in the well-known and registered ranges. The table below lists the ports referred to most often:
| Port | Protocol | Service | Description |
|---|---|---|---|
| 22 | TCP | SSH | Secure shell access and SFTP |
| 80 | TCP | HTTP | Unencrypted web traffic |
| 443 | TCP | HTTPS | Encrypted web traffic (TLS) |
| 21 | TCP | FTP (control) | FTP control channel |
| 25 | TCP | SMTP | Email delivery (server to server) |
| 53 | TCP/UDP | DNS | Domain name resolution |
| 3306 | TCP | MySQL / MariaDB | Relational database |
| 5432 | TCP | PostgreSQL | Relational database |
| 6379 | TCP | Redis | In-memory data store |
| 27017 | TCP | MongoDB | Document database |
| 3389 | TCP | RDP | Windows remote desktop |
| 51820 | UDP | WireGuard | VPN tunnel |
Some services are also run on alternative ports: 2222 for SSH, 8080 for HTTP and 8443 for HTTPS are common alternatives. These are usually chosen when the default port is taken by another service, or when an extra layer is needed behind a proxy or load balancer.
Seeing Which Ports Are Listening on a Server
Checking directly whether a port really is in use on the server, rather than assuming it, is the more reliable approach for both security and troubleshooting. On Linux systems the ss command shows which ports are in a listening state and which process opened them.
Lists every TCP and UDP port in a listening state on the server, together with the name of the process behind it.
ss -tulpn | grep ':443'A check like this reveals, for instance, whether a database service (MySQL, PostgreSQL, MongoDB) is listening only on the local interface (127.0.0.1) or on all network interfaces (0.0.0.0) — the latter can leave the database directly reachable from outside unless a separate firewall rule is in place. Which service a port belongs to is not always obvious, so it helps to compare the result against a list of known ports.
TCP or UDP?
A port number means nothing on its own; the protocol it is used with matters too. TCP is connection-oriented: a handshake happens before any data is sent, and packet order and integrity are guaranteed — which is why services where reliability comes first, such as web traffic, SSH, email and database connections, use TCP. UDP is connectionless, offering no ordering or delivery guarantee but running with lower latency — which is why DNS queries, DHCP, NTP and most VPN protocols (WireGuard, IKEv2/IPsec) prefer it.
- DNS (port 53) uses both TCP and UDP: ordinary queries run over UDP, while large responses (zone transfers, for example) go over TCP.
- Most application services such as SSH, HTTP, HTTPS, MySQL, PostgreSQL, Redis and MongoDB use TCP only.
- DHCP, NTP, SNMP and most VPN protocols (WireGuard, IKEv2/IPsec) use UDP for low latency and a simple request-response cycle.
The same port number is two entirely independent namespaces in TCP and UDP. When writing a firewall rule you have to state not only the port number but the protocol as well; saying "open port 53" is not enough on its own, and which protocol it should be opened for has to be defined separately.
Common Mistakes in Firewall and Port Management
- Opening broad port ranges wholesale: rules like "open everything between 1000 and 9000" enlarge the attack surface needlessly by opening a route in from outside to unused services or ones left running by accident (a debug interface, a forgotten test database).
- Running a service on its default port with no hardening at all: leaving SSH on port 22 is not a vulnerability in itself, but if password login is left enabled, that port becomes the first target of automated scanning tools.
- Confusing the port number with the protocol: saying "I opened port 443" does not guarantee that HTTPS will work; the TLS certificate, the server software and the application layer all have to be configured correctly too. The port only determines which door traffic comes in through, not its content.
- Opening the dynamic/ephemeral port range inbound unnecessarily: the response traffic of outbound connections is already permitted automatically by most stateful firewalls; opening this range inbound as well is usually pointless.
The right approach is to open the service ports the server actually uses (22, 80, 443, for example) inbound one by one and to reject everything else by default (default-deny). When you come across a port number, you can use the reference table below to confirm quickly which service it belongs to and which protocol it uses.