Port: How Multiple Services Share One IP

Why ports exist

An IP address targets a machine. But that machine runs a dozen processes at once: a web server, SSH daemon, database, monitoring agent. When a packet arrives at 192.168.1.50, which process should receive it?

A port answers that question. It is a 16-bit number (0 to 65535) carried in the TCP/UDP header. Every listening process binds to a specific port via bind() + listen(). When a packet arrives on that port, the kernel delivers it to the bound process.

The pair (IP, port) forms a socket address, a globally unique endpoint address on the internet.

Port categories

Common well-known ports:

• 22 SSH
• 53 DNS
• 67/68 DHCP server / client
• 80 HTTP
• 123 NTP
• 443 HTTPS
• 3306 MySQL
• 5432 PostgreSQL
• 6379 Redis

The full list is in /etc/services.

Ephemeral ports: why you see 54321 in a curl trace

When a client opens a connection, it does not pick its source port explicitly. The OS picks a random port from the ephemeral range (on Linux the default is 32768-60999; check it with cat /proc/sys/net/ipv4/ip_local_port_range).

These ports live only for the duration of the connection. After it closes, they are released (after a TIME_WAIT delay, see tcp-states).

This means: if you open many outgoing connections rapidly, you can exhaust the ephemeral range. On a cloud NAT gateway handling thousands of clients, that is a real operational problem.

One port, one process?

In general, yes. Only one process can bind() to a given (IP, port) pair. A second attempt returns EADDRINUSE.

Exceptions:

• SO_REUSEPORT lets multiple processes listen on the same port; the kernel distributes incoming connections among them (nginx and haproxy use this).
• 0.0.0.0 vs. a specific IP: bind 0.0.0.0:80 and bind 1.2.3.4:80 may or may not conflict depending on the order of the bind calls.

Checking who listens on what

ss -tlnp                # all TCP listening sockets with process info

ss -ulnp                # UDP

lsof -i :443            # who is on port 443

netstat -tulnp          # classic alternative, still works

Flag breakdown for ss:

• -t TCP, -u UDP
• -l listening sockets only
• -n no DNS resolution
• -p show process (requires root for other users' sockets)