Ports & Sockets

1. What Is It?

An IP address gets a packet to the right machine. A port gets it to the right process on that machine. Ports are 16-bit integers (0–65535) that the OS uses to multiplex network traffic across concurrent applications. Your web server on port 443 and your Postgres instance on port 5432 live on the same machine with the same IP — the port is what distinguishes them.

A socket is the OS abstraction for a network endpoint. It pairs an IP address with a port and an optional transport protocol (TCP or UDP). When your application calls connect("api.example.com", 443), the OS creates a socket, binds an ephemeral local port to it, and hands you a file descriptor. Everything you send or receive on that connection goes through that socket.

2. How It Works

A TCP connection is uniquely identified by four values: (source IP, source port, destination IP, destination port). This 4-tuple is called a socket pair, and it's how the OS demultiplexes incoming packets to the right process and connection.

-+ResetFullscreen

Ephemeral ports: When your app opens an outbound TCP connection, the OS assigns a random source port from the ephemeral range (typically 32768–60999 on Linux, 49152–65535 per IANA). This port exists only for the duration of the connection.

Listening socket vs. connected socket: A server calls bind(port) then listen() — this creates a single listening socket. For each incoming connection the OS creates a separate connected socket with a unique 4-tuple. That's why a server can handle thousands of concurrent connections all on port 443 simultaneously.

Well-known port assignments:

Concrete example — Docker port mapping: When you run docker run -p 8080:80 nginx, Docker creates a NAT rule that forwards traffic arriving at host:8080 to container:80. The container's nginx is listening on port 80 inside a private network; port 8080 is what's exposed on the host. Mismatching these is one of the most common Docker debugging situations.

3. What SDEs Actually Need to Know

"Address already in use" errors: EADDRINUSE means another process is already listening on that port, or a previous process's socket is in TIME_WAIT state. Use lsof -i :PORT or ss -tlnp | grep PORT to find what's holding it. For TIME_WAIT, either wait ~60s or set SO_REUSEADDR on the socket (most frameworks do this by default).

Port exhaustion: Each outbound TCP connection uses one ephemeral port. At ~30,000 available ephemeral ports, a service making many short-lived connections to the same destination IP:port can exhaust them. Symptoms: connection errors despite the target being healthy. Fix: connection pooling (reuse sockets) or increase the ephemeral range (net.ipv4.ip_local_port_range).

0.0.0.0 vs 127.0.0.1 bind address:

• 127.0.0.1 — loopback only, unreachable from outside the host. Use for services that should not be externally accessible.
• 0.0.0.0 — all interfaces, including the network-facing NIC. Required if you want the service reachable from other machines or containers.
• In Kubernetes, this is why your service must bind 0.0.0.0 — the pod IP is different from 127.0.0.1, and kube-proxy routes traffic to the pod IP.

Privileged ports (< 1024): On Linux, binding a port below 1024 requires root or the CAP_NET_BIND_SERVICE capability. This is why production containers either run as root (bad practice), use a reverse proxy (nginx binds 443 as root, then drops privileges), or are granted the specific capability.

4. Tradeoffs & Decisions

Assigning custom ports: When you choose a port for your service, avoid the IANA well-known range (0–1023) and registered services your stack might use. Using a port already in use by Redis or a monitoring agent causes EADDRINUSE and confusing failures. Tools like ss -tlnp show all currently bound ports.

Connection pooling vs. per-request connections: Opening a new TCP connection for every request costs: DNS lookup + TCP 3-way handshake + TLS handshake ≈ 1–3 RTTs of overhead. Connection pooling holds open connections and reuses them. The tradeoff is resource consumption (idle connections hold OS memory and file descriptors) and complexity (pool sizing, health checks). For most database clients and HTTP clients to shared services, pooling is the right default.

Firewall rules at the port level: Security groups and iptables rules operate on port ranges. Opening port 0-65535 from all sources (0.0.0.0/0) defeats network-layer security. Principle of least privilege: only open the specific ports needed, and only to the CIDR blocks that need access.

5. Interview Cheat Sheet

Key sentences:

• "A port multiplexes traffic to the right process; a socket is the OS abstraction combining IP + port + protocol into a file descriptor your app reads and writes."
• "A TCP connection is uniquely identified by a 4-tuple: source IP, source port, destination IP, destination port — this is how the OS handles thousands of concurrent connections all arriving on port 443."
• "Ephemeral ports are temporary source ports the OS assigns to outbound connections; exhausting them (~30k by default) causes connection failures even when the destination is healthy."
• "Binding to 127.0.0.1 makes a service reachable only from the same host; 0.0.0.0 opens it on all interfaces."

Common follow-ups:

Q: Why can a server accept many connections on the same port? A: The listening socket accepts new connections; each accepted connection becomes a separate connected socket distinguished by the unique 4-tuple (client IP, client port, server IP, server port). The OS routes incoming packets to the right socket based on this 4-tuple.

Q: What is TIME_WAIT and why does it matter? A: After a TCP connection closes, the OS keeps the socket in TIME_WAIT for 2× the maximum segment lifetime (typically 60s on Linux) to ensure delayed packets from the old connection don't corrupt a new one on the same 4-tuple. When restarting a server rapidly, the old port may still be in TIME_WAIT — SO_REUSEADDR lets the new process bind it immediately.

Q: How does NAT affect port usage? A: A NAT gateway rewrites the source IP and port of outbound packets from private hosts so they appear to come from the NAT's public IP. It tracks the mapping in a connection table to route responses back. NAT gateways also have port limits — many cloud NAT implementations cap concurrent connections per source IP.