About this video
Network ports operate at Layer 4 of the OSI model and solve a fundamental problem in client-server communication: when a server runs multiple services simultaneously, the client needs a way to direct its request to the correct one. Ports are virtual identifiers assigned to services, so a packet arriving at port 22 is routed to SSH while one arriving at port 443 reaches HTTPS. These assignments are standardized and overseen by the Internet Assigned Numbers Authority, which divides the full port range into three groups — well-known ports (0–1023), registered ports, and dynamic or private ports — each with different levels of convention and flexibility.
Port security centers on two main practices. The first is system hardening: every service running on a machine opens an additional attack surface, and reducing unnecessary services limits the number of potential vulnerabilities an attacker can exploit. Operating systems have moved away from enabling many services by default for exactly this reason. The second practice is the use of non-standard ports, sometimes called security through obscurity. Reassigning a service like SSH from port 22 to a high, non-standard port does not constitute genuine security on its own, since a thorough port scan will still discover it, but it does reduce exposure to automated scanners that target only common ports.
A socket is the combination of an IP address and a port number, and it precisely identifies a specific service on a specific host. Servers can expose multiple sockets simultaneously — different ports on the same IP, or the same port across multiple IP addresses — enabling them to host several distinct services or websites at once. Ephemeral ports extend this concept to the client side: when a machine makes multiple connections to the same destination service, it assigns a different source port to each session, creating a unique source socket per connection that allows the server to track and respond to each request independently. The netstat command provides a live view of all active sockets on a machine, making it a practical tool for observing this behavior in real time.
About TechKnowSurge
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →