An IP address shows which server a request is going to, but one address is not enough: a web site, mail, and a control panel can all run on one server at the same time. Splitting between them is the job of the port, the socket, and the service — three concepts that are often confused with one another, even though each follows quite different logic.
What a port, a socket, and a service are
A port is a numeric identifier from 1 to 65535 that points to a particular application on a server. A service is the program itself that listens on a given port and handles incoming connections, for example nginx or sshd. A socket is the combination of an IP address and a port that uniquely describes the endpoint of one particular connection. A server can have many sockets with the same local port at once, as long as the address or port on the other side of the connection differs.
How a port differs from an IP address
The difference becomes clearer when the two identifiers are compared side by side.
| Trait | IP address | Port |
|---|---|---|
| What it identifies | A particular server on a network | A particular service on a server |
| Range of values | Four numbers 0-255 | A number from 1 to 65535 |
| Analogy | A house address | An apartment number in the house |
How a socket is formed
When a browser opens a page, the operating system joins the server's IP address and the service's port into one socket — this is exactly what shows up in the output of network utilities on the server side.
Local address Foreign address State
203.0.113.10:80 198.51.100.20:52344 ESTABLISHED
203.0.113.10:22 198.51.100.21:49871 ESTABLISHEDWhich ports standard services occupy
Some ports are reserved for well-known services by convention and are rarely used for anything else, which simplifies configuring a web server and a firewall.
- 22 - the SSH service, remote server management.
- 80 - the HTTP service, plain web pages without encryption.
- 443 - the HTTPS service, web pages with TLS encryption.
- 3306 - the MySQL service, database connections.
Detailed setup of a web server that listens on ports 80 and 443 is covered in the article about configuring nginx, and the basic addressing concepts are in the piece about IPv4 addresses.
How to close or open a port
Whether a port is reachable from the outside is controlled by the firewall: even if a service listens on a port locally, the firewall can block incoming connections to it from the internet. Setting up a typical firewall on a VDS is covered in detail in the article about ufw on a VPS — it also explains why an open port without a running service is completely safe by itself. In practice, management and database ports are closed off, leaving exposed only what genuinely needs to accept public connections.
What to do: how to check open ports on a server
Before changing firewall rules, it helps to see the actual picture of occupied ports.
- Run the ss -tlnp command to see the list of ports that local services are listening on.
- Compare the list with the expected set of services — an extra open port can mean a forgotten service or a vulnerability.
- Check the current firewall rules and match them against the ports that are actually needed from the previous step.
- Close the ports of services that should not be reachable from outside in the firewall, keeping access only where it is needed.
Frequently asked questions
Can one port serve two different services at once?
No, the same port on one IP address can be listened on by only one service at a time — trying to start a second program on a busy port results in an error. Different services for one port are split across different IP addresses or behind a proxy server in front of them.
Why are some ports called "privileged"?
Ports from 1 to 1023, including 22 and 80, can traditionally be opened on Linux only by a process with root privileges, which historically reduced the risk of an ordinary user hijacking system services. Ports above that range have no such restriction.
Is it worth changing the SSH port from 22 to a non-standard one?
Changing the port does not make a server invulnerable, but it noticeably reduces the number of automated password-guessing attempts by bots that scan exactly port 22. It is an extra measure, not a replacement for proper access and firewall configuration.