When a server is connected to the Internet, it receives thousands of incoming network packets every second. But how does the operating system know whether an incoming packet belongs to your Nginx web server, your SSH terminal daemon, your MySQL database, or your Minecraft game server?
The answer is Network Ports. In this guide, we break down what network ports are, how port ranges function, and how to inspect listening ports on your RivinCloud VPS.
1. Analogy: The Apartment Building
Think of your server's public IP address (192.0.2.1) as the street address of a large apartment building.
Server IP: 192.0.2.1 (Building Address)
├── Port 22 ──► Apartment 22 (SSH Service)
├── Port 80 ──► Apartment 80 (Nginx HTTP Web Server)
├── Port 443 ──► Apartment 443 (Nginx HTTPS Web Server)
├── Port 3306 ──► Apartment 3306 (MySQL Database)
└── Port 25565 ──► Apartment 25565(Minecraft Game Server)
Without port numbers, network traffic would arrive at the building address with no indication of which specific application room should receive the payload.
2. Port Ranges & Categories
Network ports are 16-bit numerical identifiers ranging from 0 to 65535:
1. Well-Known Ports (0 – 1023)
Reserved for privileged system services. Standard users cannot bind to these ports without root or CAP_NET_BIND_SERVICE privileges:
- Port 22: SSH (Secure Shell)
- Port 53: DNS (Domain Name System)
- Port 80: HTTP Unencrypted Web
- Port 443: HTTPS Encrypted Web
2. Registered Ports (1024 – 49151)
Assigned by IANA for specific vendor applications and software daemons:
- Port 3306: MySQL / MariaDB Database
- Port 5432: PostgreSQL Database
- Port 6379: Redis In-Memory Cache
- Port 25565: Minecraft Java Edition Server
3. Dynamic / Ephemeral Ports (49152 – 65535)
Temporary client-side ports assigned automatically by the OS kernel when an outbound connection is initiated.
3. What is a Network Socket?
A socket is the combination of an IP Address + Port Number + Protocol:
192.0.2.1:443 (TCP) --> Listening HTTPS Web Socket
0.0.0.0:80: Service is listening publicly on all available network interfaces.127.0.0.1:3306: Service is bound strictly to local loopback (localhost only).
Command of the Day: ss -tulpn
The ss command with -tulpn options lists all listening TCP and UDP ports and the applications bound to them.
Syntax
sudo ss -tulpn
Options Breakdown:
-t: TCP sockets-u: UDP sockets-l: Listening sockets only-p: Display Process Name & PID-n: Show numeric port numbers
Sample Output
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
tcp LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=1120,fd=6))
tcp LISTEN 0 128 127.0.0.1:3306 0.0.0.0:* users:(("mariadbd",pid=850,fd=19))
tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=684,fd=3))
Common Mistakes
- Leaving internal ports exposed to
0.0.0.0: Databases like Redis or MySQL should bind to127.0.0.1unless remote connections are required and protected by UFW IP whitelisting. - Port Conflicts: Trying to launch two web servers simultaneously on port 80 causes
Address already in useerrors.
Troubleshooting
- Finding which application is holding a port:
sudo lsof -i :80
Best Practices
- Periodically audit open ports using
sudo ss -tulpn. - Restrict sensitive ports using UFW firewall rules.
Frequently Asked Questions
Can two different applications listen on the same port?
No. Operating systems prohibit two applications from binding to the exact same IP, port, and protocol combination simultaneously.
Conclusion
Ports allow operating systems to direct traffic to specific applications. Audit your listening ports regularly on RivinCloud VPS to maintain security!