3
  1. Is a "port" a communication endpoint (in the transport layer)?

    Is a "port number" an address assigned to a port?

    Given a port, can we change the port number assigned to it, similar to that it is possible to change the IP address assigned to a network interface?

  2. From https://en.wikipedia.org/wiki/Network_socket

    sockets with TCP port 53 and UDP port 53 are distinct sockets

    What does the quote mean? Specifically,

    • Can a port be used by two transport protocols (e.g. TCP and UDP) simultaneously? (My understanding is that a port is part of a transport protocol, and can't belong to another protocol even at a different time.)

    • Does the quote mean that a port number 53 can be assigned to a port in TCP and to a port in UDP at different times (but not simultaneously)?

  • Related and possibly helpful: stackoverflow.com/questions/152457/… – Wildcard Oct 15 '15 at 19:28
  • An analogy is calling two different companies using the same extension number. – teppic Oct 15 '15 at 19:57
  • @teppic: do you mean TCP port 53 and UDP port 53 are two distinct ports? – Tim Oct 15 '15 at 20:15
  • @Tim Yes, you can use them for different things simultaneously. But well known apps will typically use the same port numbers if they use both. – teppic Oct 15 '15 at 20:17
  • Although a port cannot be used by two processes simultaneously, it is only a convention to run specific protocols on specific ports. Technically, there is no restriction to the ports a specific protocol can be used on. – stoeff Oct 15 '15 at 21:03
4

A computer can have one or more IP addresses.

Some IP protocols, like ICMP, only need IP addresses to communicate. Others, like UDP and TCP, require that packets be addressed to a port as well as an IP address. Generally you have a program implementing a service listen on a well-known port so that other systems know how to contact it. An ssh server will, for example, listen on port 22/tcp:

$ netstat -a -t
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 *:ssh                   *:*                     LISTEN     

$ netstat -a -t -n
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN   

The netstat program will give symbolic names to port numbers, by looking in /etc/services, and a program such as sshd would call getservbyname("ssh","tcp") to convert a name to a port number.

If you listen on IP address 0.0.0.0, that means to listen on all of a system's IP addresses, and that's why netstat prints a *.

The ssh server doesn't have to listen on port 22. You can change its config file to listen on port 8022, say. As long as the remote user knows the port number, and any intervening firewalls allow traffic to port 8022, it'll work.

For hundreds of services around the world, the well-known port numbers are maintained in the Service Name and Transport Protocol Port Number Registry. It's a superset of your local system's /etc/services.

A socket is a communications endpoint. Before it can be used, it must be bound to an IP address, port number, and protocol. If it's using TCP, it must then be connected to another socket before packets can be exchanged. A server calls socket to create a socket, bind to bind it, and listen to listen for connections. A client uses socket and bind, then connect to connect to a server. (The call to bind is optional for a client; when connect is called, the system will allocate an unused port and pick an appropriate IP address to bind to the socket.)

sockets with TCP port 53 and UDP port 53 are distinct sockets

If a service can be offered on both TCP and UDP, it's customary for the port number to be the same in both protocols. In the above case, you'd probably have a single DNS server that creates two sockets, one listening on 0.0.0.0:53/tcp and the other listening on 0.0.0.0:53/udp.

Some older services were designed to run on only one protocol, and in those cases you may see two services using the same port number (but of course on different protocols). For example, 512/tcp is for rexec, but 512/udp is for biff. Systems like this have completely different programs listening on the ports. rexecd listens on 512/tcp, and comsat listens on 512/udp.

  • Thanks. Is it correct to distinguish between a port and its port number, just like a network interface and its IP address or MAC address? My question is whether the port number of a port can be changed. – Tim Oct 22 '15 at 20:05
  • They're similar, but a port is conceptually more like a PCIe slot on your computer. Each has a number, but you don't get to arbitrarily choose the number; it's 1, 2, 3, etc. up to some maximum number. Your kernel will typically support 65535 ports for each protocol, numbered 1 through 65535. – Mark Plotnick Oct 22 '15 at 20:50
  • do you mean the port number of a port is fixed and can't be changed? – Tim Oct 22 '15 at 21:14
  • Yes, it can't be changed. – Mark Plotnick Oct 22 '15 at 22:14
8

TCP and UDP are two different protocols on top of IP. The TCP port number is part of the TCP protocol, and the UDP port number part of the UDP protocol. So yes, the two can be used simultaneously, as TCP and UDP are two different protocols, with different protocol numbers (see /etc/protocols).

A DNS server can and does listen to both UDP/53 and TCP/53, at the same time, as UDP is faster and has less overhead for everyday requests, while TCP may be necessary for especially large DNS requests, on account of UDP packet size limits from way back when. Here's named listening on both, at the same time, for example:

$ sudo lsof -i -nP | fgrep \*:53
named    1267  named   20u  IPv6    9691      0t0  TCP *:53 (LISTEN)
named    1267  named  512u  IPv6    9690      0t0  UDP *:53 
$ 

This named can serve hundreds, or even thousands of simultaneous UDP and TCP client requests via the two distinct ports listed above.

TCP and UDP otherwise are two distinct implementations of a transport layer, and bear two fields of sixteen bits each that specify the source port and destination port for each TCP or UDP packet. The port number to name mapping relationship could be fiddled with by adjusting the /etc/services file (probably a very, very bad idea), or a server could be instructed to listen on some not-default port number, assuming the client systems are all properly reconfigured to connect to it at that non-default port number, e.g. sshd -p 1234 on a server and then ssh -p 1234 server to connect to that not-default TCP port 1234, instead of the usual tcp/22. Or, a DNS server could be set to run at UDP port 8475, though then one would need to use a custom client program such as dig -p 8475 @server ... to query that custom UDP port, as operating systems in general will only chat up UDP/53 or TCP/53 on any nameserver IP they are given.

  • Thanks. Are TCP port 53 and UDP port 53 two distinct ports? – Tim Oct 15 '15 at 20:16
  • Can you also answer my part 1? – Tim Oct 15 '15 at 20:18
  • I'm not really sure what the first part is asking, though one could certainly run a DNS or whatever server on some other TCP or UDP port, assuming the client systems were properly configured to connect to it at that non-standard port. – thrig Oct 15 '15 at 20:33
  • Thanks. Sorry for the confusion. I have clarified my part 1. – Tim Oct 15 '15 at 21:32
  • For part 1, I was asking if the relation between a port and a port number is like a network interface and an IP address, in that the port number of a port can be changed? Or is the relation more like a network interface and a MAC address, in that the MAC address of a network interface is almost never changed, more like an identity rather than an address? – Tim Oct 22 '15 at 17:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.