Protocols, Ports and Sockets

The files box at 192.168.10.20 does three jobs at once: it shares folders, serves a small web dashboard and accepts remote logins for the IT person. Packets for all three arrive at the same IP address. How does the box know which program each packet is for, and how do both sides agree on what the bytes mean?

The rule

The protocol sets the rules; the port picks the program; the socket is the plug.

Protocol — an agreed set of rules for a conversation: who speaks first, what each message looks like, what counts as an error. HTTP is a protocol for web pages, DNS for name lookups, TCP for reliable delivery. Two devices can only talk if they speak the same protocol.

Port — a number from 0 to 65535 that identifies a program or service on a host. The IP address gets the packet to the right machine; the port gets it to the right program on that machine. Ranges to know:

Socket — one end of a conversation, written as an IP address plus a port, such as 192.168.10.20:443. A server program opens a socket and listens on it. A single connection is identified by both ends together with the transport protocol: source IP, source port, destination IP, destination port and protocol. Because the client's ephemeral port differs for each connection, one server socket can serve hundreds of connections at the same time.

The shortcut

Read any connection as "from IP:port to IP:port". The side on a well-known port is almost always the server; the side on a high, random port is the client.

The trap is thinking a port is a physical socket on the back of the switch. Those are also called ports, but in this lesson a port is a number inside the packet that picks a program.

Drills

Answer fast — trust the rule.

Remember

• The protocol sets the rules; the port picks the program; the socket is the plug (IP:port).
• Read connections as "from IP:port to IP:port" — well-known port = server, high random port = client.
• Well-known 0–1023, registered 1024–49151, ephemeral 49152–65535.