Ports and Multiplexing OSI layer 4

The transport layer (OSI Layer 4) uses port numbers to manage multiple network communications on a single device. Ports act as virtual channels, directing data to the correct application or service, enabling simultaneous activities like web browsing, file downloads, and email without interference.

Key Points

• Ports are 16-bit numbers (0-65535) that identify applications and services.
• Multiplexing allows multiple simultaneous connections via port separation.
• Destination ports are fixed, well-known numbers identifying server services.
• Source ports are dynamically assigned by the client OS for each connection.
• Socket pairs (IP:Port combinations) uniquely identify each communication.

---

How Ports Enable Multiplexing

Multiplexing allows the transport layer to handle multiple communications from the same host simultaneously. Without ports, the OS couldn’t distinguish between data streams for different applications.

The Problem Ports Solve

A single machine typically:

• Runs multiple applications concurrently.
• Communicates with several servers at once.
• Uses different transport protocols (TCP and UDP).

Port numbers resolve this by:

• Separating individual communications.
• Routing incoming data to the correct application.
• Uniquely identifying outgoing connections.

---

Port Types

Destination Ports

Identify the service running on the server:

• Well-known and fixed numbers.
• Standardized for common protocols.
• Tell the server which application should handle the request.

Common examples:

Port	Protocol	Service
80	HTTP	Web traffic
443	HTTPS	Secure web
21	FTP	File transfer
22	SSH	Secure shell
25	SMTP	Email

Source Ports

Identify the client’s side of the connection:

• Dynamically chosen by the client OS.
• Selected from the ephemeral port range (49152-65535).
• Unique for each connection instance.
• Enable tracking of individual conversations.

Key Distinction: Destination ports are predictable and service-specific; source ports are random and connection-specific.

---

Port Number Ranges

The full port range (0-65535) is divided into three categories:

Port Range	Name	Usage	Assignment
0 – 1023	Well-Known Ports	Standard protocols and services	IANA-assigned, requires admin privileges
1024 – 49151	Registered Ports	Vendor applications and services	IANA-registered, general use
49152 – 65535	Dynamic/Ephemeral Ports	Client-side temporary connections	Automatically assigned by OS

---

Socket Pairs: Complete Connection Identity

A socket pair uniquely identifies each communication using:

[Client IP : Source Port] ↔ [Server IP : Destination Port]

Example: Multiple Simultaneous Connections

Client (192.168.1.10)
│
├─ [192.168.1.10:3166] → [Facebook:80]   (Web browsing)
├─ [192.168.1.10:31061] → [Google:80]    (Web browsing)
└─ [192.168.1.10:1305] → [FileServer:21] (FTP download)

Each connection uses a different source port, allowing the OS to:

• Keep conversations separate.
• Deliver responses to the correct application.
• Maintain multiple connections to the same destination port.

---

Practical Example: Web Browser Connections

When you open multiple websites:

1. Browser requests Facebook:
   • Source: 192.168.1.10:3166 (random)
   • Destination: Facebook:80 (HTTP)
2. Browser requests Google:
   • Source: 192.168.1.10:31061 (different random port)
   • Destination: Google:80 (HTTP)
3. Data returns:
   • Facebook’s response arrives at port 3166 → Browser displays on Facebook tab.
   • Google’s response arrives at port 31061 → Browser displays on Google tab.

The browser uses the source port to match responses to the correct tab.

---

Server-Side Perspective

Servers listen on multiple ports to provide different services:

Web Server (203.0.113.50)
│
├─ Port 80  → HTTP service
├─ Port 443 → HTTPS service
├─ Port 21  → FTP service
└─ Port 22  → SSH service

The destination port in incoming packets tells the server which service to use.

---

Monitoring Ports with netstat

The netstat command displays active connections and ports:

netstat -an

Sample Output:

Proto  Local Address          Foreign Address        State
TCP    192.168.1.10:3166      151.101.1.140:80      ESTABLISHED
TCP    192.168.1.10:31061     172.217.14.206:80     ESTABLISHED

• Shows active TCP connections.
• Different source ports (3166, 31061) for each connection.
• Connections to web servers (port 80).

---

Common Misconceptions

Avoid these errors:

• Confusing source and destination ports – Destination identifies the service; source identifies the session.
• Thinking servers use random ports – Servers use fixed, well-known ports.
• Believing one port = one user – A server can handle thousands of connections on the same port.
• Forgetting port ranges matter – Clients should use ephemeral ports (49152-65535) for source ports.
• Ignoring the IP address – The socket pair includes both IP and port.

---

Key Takeaways

• Ports are 16-bit numbers (0-65535) identifying applications/services.
• Destination ports are fixed; source ports are dynamic.
• Socket pairs (IP:Port) uniquely identify communications.
• Multiplexing enables simultaneous connections via port separation.
• Well-known ports (0-1023) are standardized; ephemeral ports (49152-65535) are temporary.

---

Learn More

Related Concepts

• TCP vs UDP: Port usage differs between protocols.
• Port Forwarding: Redirects external ports to internal devices.
• Firewalls: Control traffic based on port numbers.
• NAT: Routers handle port mapping for multiple devices.

Standards References

• RFC 793 – Transmission Control Protocol (TCP).
• RFC 768 – User Datagram Protocol (UDP).
• IANA Port Registry – Official list of assigned ports.