TechKnowSurge
CompTIA Network+ 1.4 CompTIA A+ Core 1 2.1 Cisco CCNA 1.5 Cisco CCST Cybersecurity 2.1
TechKnowSurge Catalog Videos DEMO: Wireshark, Ephemeral Ports
VideoNetworkFree

DEMO: Wireshark, Ephemeral Ports

Ephemeral ports are temporary source ports assigned by a client machine to manage individual TCP connections with remote hosts. This topic covers how browsers assign, reuse, and create new ephemeral ports depending on the application and connection context.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Ephemeral ports are short-lived, dynamically assigned source ports that a client machine uses when initiating TCP connections to remote hosts. Rather than using a fixed port, the operating system selects an available port from a defined range and assigns it to the outgoing connection, allowing the system to track multiple simultaneous sessions to the same or different destinations. These ports exist only for the duration of the communication and are released once the connection is closed. When a browser makes multiple requests to the same web server, it often reuses an already-established TCP connection rather than opening a new one. This connection reuse is visible in packet captures, where the same ephemeral port number appears across multiple HTTP requests within the same browser session. The browser maintains awareness of active connections and leverages them for efficiency, reducing the overhead of repeatedly completing TCP handshakes. When a second, independent browser application connects to the same server, it has no access to the first browser's existing connections and must establish its own TCP session. This results in a new, distinct ephemeral port being assigned, which is clearly observable in captured traffic as a different source port number. This behavior highlights that connection tracking and reuse operate at the application level, meaning separate applications maintain separate TCP sessions even when communicating with the same remote host.

What you'll learn

What's covered

Ephemeral Ports

Aligned to

CompTIA Network+
1.4 Explain common networking ports, protocols, services, and traffic types.
CompTIA A+ Core 1
2.1 Compare and contrast Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) ports, protocols, and their purposes.
Cisco CCNA
1.5 Compare TCP to UDP
Cisco CCST Cybersecurity
2.1 Describe TCP/IP protocol vulnerabilities

Key terms

Port
A logical endpoint for communication in a network, identified by a number that specifies a particular service or application.
Ephemeral Port
A temporary source port dynamically assigned by a client operating system for the duration of a connection, used to track multiple simultaneous sessions with the same server.
Transmission Control Protocol
TCP
A connection-oriented transport protocol that ensures reliable, ordered, and error-checked delivery of data.
Server
A computer or program that provides services or resources to other devices, known as clients, over a network.

Transcript

An ephemeral port on a machine is a source port. This demo laptop will create an ephemeral port to communicate and establish a connection with another machine. Sometimes it can reuse those connections, while other times it will establish a new connection.

Capturing the First Request

First of all, we're going to start by monitoring this Ethernet connection. So I get the Ethernet connection going, and I'm going to generate some web traffic. I'll bring up a browser and I'm going to go to that Demo Pi site that we have.

In this case right here we've got this request — it's making an HTTP request. So we see now that 60,959 is the request that it makes. It's using this TCP connection, 60,959.

A Second Tab in the Same Browser

Now what I'm going to do is open up a second tab on here. I'm going to go to the same site, but in this case I'm going to go to index2.html. This is another web page that we had created, so I'm going to go to that. It generates some more traffic.

Let's see what the new request is going to. So here is the request I just made. It's another port that it's using with it, and so that is a different port — although I believe if we look back here, it was established way back here, so 60,960. Essentially it already made this connection and it's just reusing this connection. So Chrome has some capability of keeping track of these conversations and using that same connection.

A Different Browser

But now let's take a look and see what happens if we bring up a new browser. I'm going to bring up Edge in this case, and we are going to go to the same website and generate some traffic there, and we'll see what it compares to. So this is 60,959, 60,960. We just went to a new page here using Edge, so let's find that. Here's the HTTP, here's the request for that, and we see that it's 61,011.

So it is a different port. It's keeping track — it's a different ephemeral port, keeping track of this conversation on a different port in this case. Chrome is using essentially the same port that it had already established, versus when we bring up another browser: now it's making a new connection and establishing a different TCP connection for that communication.

So we see that there is some capability of keeping track of these conversations on an application level, but between applications then perhaps we need to establish a new TCP connection to get that information.

So that is ephemeral ports. You can see these ephemeral ports that are being randomly created on the demo laptop, or our source machine.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →