Network ports

What it means

A network port distinguishes an endpoint within a transport protocol on an address. A destination such as TCP port 443 is a convention and configuration choice, not proof that HTTPS is running or reachable. TCP 443 and UDP 443 are different transport endpoints even when their numbers match. IANA port registry Port management

Try it

Simulation — match an endpoint tuple. Start with a synthetic TCP listener on 192.0.2.10:443, then switch the request to UDP 443: no listener matches. Try TCP 8443, which the fixture intentionally labels plain HTTP even though the number is often associated with HTTPS deployments. Enter zero, a negative number or 65536 to see input validation instead of a wrapped result. Reset restores the listener selection and previous errors.

How the mechanism works

A listening application may bind to a local address, a port and a particular transport. Incoming packets with a matching destination tuple can be handed to that socket when routing and firewall policy permit it. Client source ports are part of a connection's transport tuple too, but selecting a destination does not fix the source in this teaching control. A common service mapping such as HTTPS 443 is a helpful convention, not protocol detection or evidence that a certificate is correctly configured.

Valid TCP/UDP port numbers are 16-bit values from 0 to 65535, with port zero having special/reserved meanings across APIs and assignments. This destination-port exercise intentionally requires 1–65535. It does not assert that zero is impossible as a source port in every transport protocol or operating system. Even a matching local listener tells us nothing about a remote route unless separately observed.

The same number can mean different endpoints

In the synthetic listener table, 192.0.2.10 / TCP / 443 matches a configured TLS service. Change only TCP to UDP, retaining 443: there is no matching UDP listener in that table. Change to TCP 8443 and the table deliberately names a plain HTTP fixture, demonstrating that number 8443 itself does not prove TLS.

A real network diagnosis additionally needs the chosen local bind address, routes, firewalls, application behavior and sometimes a proxy or load balancer. Even an exact configured-listener match cannot establish that a remote client can reach it. Read-only local observations and permission matter more than trying a large scan of somebody else's address space.

A listening socket is not evidence of public reachability

Consider a local service configured to bind TCP 0.0.0.0:443 on a host. That wildcard IPv4 bind can cover multiple local IPv4 interfaces, but it does not tell you whether a public route, NAT mapping, firewall policy or TLS configuration permits the intended client to complete an HTTPS exchange. Another service on UDP 443 remains a separate transport endpoint even if the number is the same.

For a connection complaint, first establish the intended destination tuple and the host/interface being observed. With authorization, compare a read-only local listener view with the expected configuration, then check network-path evidence separately. Do not open a port broadly or disable filtering merely because a simulated listener matches. The scene tests only its finite list of fictional listener tuples. Port namespace

In practice

Document address family, destination address, protocol and port together, plus the intended application. For a system you administer, use authorized local listener and firewall inspection before a network test. Do not open new public ports merely because a tutorial mentions a common service assignment; verify actual access needs and rollback policy.

Limits and common mistakes

The list of listeners is invented; there are no sockets, DNS queries or real network checks. Containers, proxies, NAT, IP scope, firewall behavior and process permissions are not represented. A port number cannot prove encryption, application identity or public availability.

Key takeaways

Port numbers are scoped by transport and endpoint. Interpret a port only with its address, protocol and observed listener; a familiar number is not a security or availability certificate.