Overview
A port is a 16-bit number (0 to 65,535) that identifies a specific program on a machine. The IP address gets a packet to the right computer; the port gets it to the right process. A connection is uniquely identified by five values: protocol, source IP, source port, destination IP, and destination port.
Well-known services listen on standard ports: 80 for HTTP, 443 for HTTPS, 22 for SSH, 5432 for PostgreSQL, 6379 for Redis. Clients use temporary ephemeral ports for their side of each connection. In system design, ports matter for firewall rules, load balancer listeners, container mappings, and connection limits.
The IP address is the building; the port is the apartment. The mail carrier delivers to the building, and the building's mailroom routes each letter to the right apartment.
When to use it
- Configuring load balancer listeners and target groups.
- Writing firewall or security group rules.
- Mapping container ports to host ports.
- Debugging 'connection refused' and port exhaustion.
Where it shows up in interviews
Recognize it when: which ports are open to the internet vs internal only.
- Secure a three-tier architecture
- Design a bastion / jump host setup
Recognize it when: a proxy or client opens many outbound connections.
- Design a web crawler
- Design an API gateway
Where it is used in real software
Typical rule: allow 443 from anywhere to the load balancer, allow 8080 only from the load balancer to app servers, allow 5432 only from app servers to the database.
A proxy calling one backend IP:port can run out of ephemeral ports (about 28,000 by default on Linux) if connections are not reused.
docker run -p 8080:3000 maps host port 8080 to container port 3000; Kubernetes Services map a stable port to pod target ports.
Key terms
- Well-known ports
- 0-1023, reserved for standard services and requiring privileges to bind.
- Ephemeral ports
- Temporary client-side ports assigned per outgoing connection.
- 5-tuple
- Protocol, source IP, source port, destination IP, destination port: identifies a connection.
- Listening socket
- A process bound to a port waiting for connections.
How it works, step by step
- 1Server binds and listens
The web server listens on 0.0.0.0:443.
- 2Client picks an ephemeral port
The OS assigns something like 52814 for the client side.
- 3Connection is identified by the 5-tuple
TCP, client-IP:52814, server-IP:443.
- 4Firewalls filter by port
Only allowed destination ports pass.
- 5Port closes after the connection ends
The client port enters TIME_WAIT briefly before reuse.
Ports you will see in system designs
Default ports (can be changed)
| Port | Service | Exposure |
|---|---|---|
| 443 / 80 | HTTPS / HTTP | Public (load balancer) |
| 22 | SSH | Restricted (VPN or bastion) |
| 5432 / 3306 | PostgreSQL / MySQL | Private (app tier only) |
| 6379 | Redis | Private |
| 9092 | Kafka | Private |
| 53 | DNS (UDP/TCP) | Resolvers |
NOWPort: 443 / 80 | Service: HTTPS / HTTP | Exposure: Public (load balancer)
Only the edge should expose public ports. Databases and caches exposed to the internet are one of the most common causes of breaches.
Implementation
# Which process is listening on port 5432?sudo lsof -iTCP:5432 -sTCP:LISTENss -ltnp | grep 5432 # Linux # Is a remote port reachable?nc -vz db.internal 5432 # Map a container port to the hostdocker run -p 8080:3000 my-api # host:8080 -> container:3000 # Ephemeral port range on Linuxcat /proc/sys/net/ipv4/ip_local_port_range # e.g. 32768 60999Complexity and performance
16 bits.
Per source IP and destination.
Before a client port can be reused.
Trade-offs
Non-standard ports reduce noise from automated scanners but are not real security; use firewalls and authentication.
Pooling and keep-alive avoid ephemeral port exhaustion and handshake costs.
Variants and related techniques
SSH tunnels or NAT rules forward a local port to a remote service.
Lets multiple processes bind the same port for kernel-level load balancing.
Common mistakes
- Opening database ports to 0.0.0.0/0.
Fix: Restrict to the app tier's security group or subnet.
- Creating a new connection per request at high volume.
Fix: Use keep-alive and pools to avoid port exhaustion.
Interview questions
How can a server handle more than 65,535 connections?
The limit applies per 5-tuple. A server on port 443 can accept connections from many client IPs and ports; the practical limit is memory and file descriptors, which can reach millions.
What causes 'connection refused'?
Nothing is listening on that IP and port, or a firewall actively rejects it. A timeout instead usually means packets are being silently dropped.
Practice problems
| Problem | Difficulty | What it trains |
|---|---|---|
| Write security group rules for web, app, and DB tiers | Easy | Least exposure. |
| Diagnose ephemeral port exhaustion in a proxy | Medium | Connection reuse. |