Infrastructure & Networking
What is a port number?
A port number is a 16-bit unsigned integer, ranging from 0 to 65535, that identifies a specific process, service, or application on a networked device. Where an IP address identifies a specific device on a network a port number identifies a specific service running on that device, enabling multiple network services to operate simultaneously on the same device without conflicts. The combination of an IP address and a port number, called a socket, uniquely identifies a specific communication endpoint on the internet.
The port concept solves a fundamental network communication challenge, a server receives network traffic at a single IP address but may need to run many different services simultaneously. A web server might run an HTTPS service, an HTTP service, an SSH service, an SMTP mail service, and an FTP service all at the same time. Without port numbers the server would have no way to determine which incoming network connection should be handled by which service. Port numbers provide the disambiguation mechanism, each service listens on a designated port number and incoming connections specify the destination port in their headers.
Port numbers are part of the TCP and UDP transport protocols, the layer above IPv4 and IPv6 in the internet protocol stack. Every TCP and UDP connection specifies both a source port, assigned by the connecting client, and a destination port, identifying the service on the server. The combination of source IP, source port, destination IP, and destination port uniquely identifies each network connection, the five-tuple that fully specifies a communication session.
Port number ranges
Port numbers are divided into three ranges, each with different assignment characteristics and uses.
Well-known ports, 0 to 1023: the most significant port range. Well-known ports are assigned by the Internet Assigned Numbers Authority, IANA, to widely used, standardised services. These assignments are authoritative, when a client connects to port 443 it expects an HTTPS service because port 443 is the IANA-assigned port for HTTPS. Well-known port assignments are published in the IANA Service Name and Transport Protocol Port Number Registry.
Access to well-known ports requires elevated privileges on most operating systems, only processes running as root or with specific capabilities can bind to ports below 1024. This privilege requirement prevents unprivileged processes from impersonating standard services.
The most important well-known ports for web infrastructure:
Port 80, HTTP. Unencrypted web traffic. The default port for HTTP connections, a browser connecting to http://example.com connects to port 80 unless a different port is specified.
Port 443, HTTPS. Encrypted web traffic over TLS. The default port for HTTPS connections, a browser connecting to https://example.com connects to port 443.
Port 22, SSH. Secure Shell, encrypted remote command line access and file transfer. Used for server administration.
Port 25, SMTP. Simple Mail Transfer Protocol, email transmission between mail servers.
Port 53, DNS. Domain Name System, UDP and TCP. DNS queries and responses.
Port 21, FTP. File Transfer Protocol, control connection. Legacy file transfer protocol.
Port 3306, MySQL. Database server. Common default for MySQL database connections.
Port 5432, PostgreSQL. Database server. Default for PostgreSQL database connections.
Registered ports, 1024 to 49151: ports assigned by IANA to specific services upon request, less authoritative than well-known ports but documented and conventionally associated with specific applications. Services that do not warrant a well-known port assignment use registered ports.
Common registered ports in web development and infrastructure:
Port 3000, commonly used by Node.js development servers and React development environments.
Port 8000, Python development servers, Django and Flask default development ports.
Port 8080, alternative HTTP port, commonly used for development servers, proxy services, and HTTP services that cannot use the privileged port 80. http://example.com:8080 specifies port 8080 explicitly.
Port 8443, alternative HTTPS port, used when port 443 is unavailable. https://example.com:8443 specifies port 8443 explicitly.
Port 6379, Redis. In-memory data store, widely used for caching and session storage in web applications.
Dynamic and private ports, 49152 to 65535: also called ephemeral ports. Not assigned to specific services, used by operating systems as temporary source ports for outgoing connections. When a browser connects to a web server the browser’s operating system assigns an ephemeral source port, typically from this range, for the connection. The server uses the source port to distinguish simultaneous connections from the same client IP address.
How ports work in web connections
Understanding how port numbers function in the context of web connections clarifies why they matter for redirect management and HTTPS infrastructure.
Default port convention: URLs do not typically include port numbers because browsers apply default ports based on the URL scheme. https://example.com/page implicitly connects to port 443, the default HTTPS port. http://example.com/page implicitly connects to port 80, the default HTTP port. The browser handles the default port assignment transparently, users never see port 443 in typical HTTPS URLs.
When a service runs on a non-standard port the port must be explicitly included in the URL. https://example.com:8443/page connects to port 8443. http://localhost:3000 connects to a development server on port 3000. The colon followed by the port number is the URL syntax for explicit port specification.
Server binding: a web server process listens for connections by binding to a specific port on a specific IP address. Nginx configured to listen on 0.0.0.0:443 binds to all IPv4 interfaces on port 443, accepting HTTPS connections from any network interface. The same server might also bind to [::]:443 for IPv6 connections, 0.0.0.0:80 for HTTP connections that will be redirected to HTTPS, and 127.0.0.1:8080 for backend connections from a proxy.
TCP connection establishment: when a browser connects to a web server it initiates a TCP three-way handshake, the fundamental TCP connection establishment sequence. The browser sends a SYN packet to the server’s IP address and destination port. The server responds with SYN-ACK. The browser sends ACK. After the handshake the TCP connection is established and the browser sends the HTTP request. For HTTPS the TLS handshake follows the TCP handshake before any HTTP data is exchanged.
Multiple connections per server: a single server can maintain thousands of simultaneous connections because each connection is identified by the four-tuple of source IP, source port, destination IP, and destination port. Even if many connections share the same destination IP and port, because they are all connecting to the HTTPS service, they have different source IPs or source ports, enabling the server to distinguish and manage each connection independently.
Ports and HTTPS infrastructure
Port 443 and port 80 are the two ports that matter most for web infrastructure, they are the default ports for HTTPS and HTTP respectively.
Port 443, the HTTPS port: every HTTPS connection to a web server on a standard configuration arrives at port 443. The server must be configured to listen on port 443 and present valid SSL certificates for the domains it serves. Firewalls must permit inbound TCP connections on port 443 from the internet. Load balancers and CDN edge servers that handle SSL termination accept connections on port 443 and forward decrypted requests to backend servers.
Port 80, HTTP and HTTPS redirect: in modern web infrastructure port 80 serves a single purpose, receiving HTTP requests and immediately redirecting them to HTTPS on port 443. A web server that has migrated to HTTPS keeps port 80 open exclusively to serve 301 permanent redirects from HTTP to HTTPS. Closing port 80 entirely would break access for clients that attempt HTTP connections, including some automated systems and legacy applications.
The HTTP-to-HTTPS redirect on port 80 is the universal starting point for the HTTPS upgrade path. HSTS: HTTP Strict Transport Security, can eventually eliminate the need for port 80 by instructing browsers to always use HTTPS, but port 80 redirects remain necessary for first-time visitors and HSTS-unaware clients.
Non-standard HTTPS ports: running HTTPS on a non-standard port, port 8443 for example, requires explicit port specification in all URLs referencing the service. https://example.com:8443/api is valid but unusual for public-facing services. Non-standard ports are used in development environments, where port 443 may require elevated privileges or conflict with other services, and in multi-tenant hosting where multiple services run on the same server.
SSL certificates are issued for domain names, not for ports. A certificate for example.com is valid for HTTPS on any port, the certificate does not encode port information. Running HTTPS on port 8443 uses the same certificate as running HTTPS on port 443.
Ports and redirects
Port numbers create specific redirect scenarios, both for redirecting between ports and for managing redirect traffic in port-aware infrastructure.
HTTP port 80 to HTTPS port 443 redirect: the most universal port-aware redirect. Every HTTP request arriving on port 80 should return a 301 permanent redirect to the equivalent HTTPS URL on port 443. This redirect changes both the scheme, http:// to https://: and implicitly the port, 80 to 443. The redirect destination URL uses the standard HTTPS scheme without explicit port specification, https://example.com/path rather than https://example.com:443/path: because port 443 is the HTTPS default and need not be specified.
Nginx configuration for port 80 to port 443 redirect:
Non-standard port to standard port redirects: services migrating from non-standard ports, https://example.com:8443: to standard ports, https://example.com: require redirects from old URLs containing the explicit port to new URLs without explicit port specification. Users who bookmarked or linked to the non-standard port URL should be automatically redirected to the standard port. The redirect removes the port from the URL:
https://example.com:8443/page → https://example.com/page
This redirect changes the port while preserving the path, a 301 permanent redirect that tells browsers and search engines the service has permanently moved to the standard port.
Port numbers in redirect destination URLs: redirect destination URLs should not include port numbers unless the destination genuinely uses a non-standard port. Including :443 explicitly in an HTTPS redirect destination, https://example.com:443/page: is technically equivalent to https://example.com/page but unnecessarily exposes the port number. Similarly including :80 in HTTP URLs is redundant. Canonical redirect destinations use the implicit default port, no explicit port specification.
Firewall configuration for redirect infrastructure: redirect management infrastructure must have firewall rules permitting inbound connections on both port 80 and port 443. Port 80 receives HTTP requests that are redirected to HTTPS. Port 443 serves the redirect responses over HTTPS. Firewall rules that block port 80 prevent HTTP clients from reaching the redirect infrastructure, those clients receive connection failures rather than redirect responses.
Load balancer port configuration: load balancers serving redirect infrastructure must be configured to accept connections on both port 80 and port 443. The load balancer terminates SSL on port 443 and forwards decrypted connections to redirect processing backends. Port 80 connections may be handled entirely at the load balancer layer, returning 301 redirects to HTTPS without forwarding to backends, or forwarded to backends that generate redirect responses.
Port scanning and security
Port numbers are a surface for security considerations, open ports represent potential attack vectors that should be managed carefully.
Minimal open ports: servers should expose only the ports required for their intended function. A web server needs ports 80 and 443. It does not need port 21, FTP, port 23, Telnet, or other legacy service ports that may have been inadvertently left open. Firewall rules should block all ports not required for the server’s function, minimising the attack surface.
Port scanning: a common reconnaissance technique used by both security researchers and attackers. Port scanners, Nmap being the most widely known, send probe packets to a range of ports and analyse responses to determine which ports are open. Open ports indicate running services that may have vulnerabilities. Security audits include port scanning to verify that only intended services are exposed.
Non-standard ports as security through obscurity: running services on non-standard ports, SSH on port 2222 rather than 22, for example, reduces automated attack traffic because many attack tools scan only default ports. However this is security through obscurity, not genuine security, and should not replace proper authentication and access controls.