Hands on: All about ports

In this month’s column I answer a query sent in by PCW reader Steven Parkes who, in common with several others, admits to being confused about network ports.

Here’s what Steven wrote: “Having grown up on the IBM XT and Dos, and learned all I know from magazines such as yours, I’m still confused about ports. Once there were about 6 (LPT1 & 2, and Com ports 1 to 4), now they seem to be numbered in their hundreds and unless we close them specifically, they seem to be wide open to any internet hacker.

“How many are there? Where are they? What do they consist of? Is there an accepted protocol for their use? If one is used for SMTP, for example (25 in my case), can it be specified for anything else? Can we close them ourselves without the help of firewalls? (A simple Dos command, or maybe a script, to shut them all, or all but those specified?).

“You can see I am in a muddle – I can’t believe that no-one else is!”

Where are the ports?
I’ll start with the easy stuff. The network ports that Steven talks about are nothing to do with the sockets or connectors found on the back of a PC, sometimes also referred to as ‘ports’.

It’s an easy mistake to make, especially as it’s usual to talk about them being open or closed and hackers getting ‘into’ a PC via open ports. However, to the question “where are they?” the answer is “not anywhere, really.” That’s because network ports are nothing more than labels that associate the network data packet contents with a particular application.

Think about it. You’ve got a server running several applications but it has only one network address. Each of these applications would have to look at every incoming network packet to determine whether or not it needs to do something with it.

It’s not impossible to do but it would require a lot of processing and really slow things down.

Tag each packet with a label saying which application it’s destined for and a lot less work is required. That’s exactly what a network port does, effectively extending the IP address to include not just the destination host but also a particular type of application or service running on it.

Applications can then be configured to respond only to the packets addressed to their specific port and they’re said to be ‘listening’ on that port. Most web servers listen on port 80, while most email servers listen on port 25 for SMTP traffic and 110 for Pop3.

So when you browse to a website, the packets will automatically have port 80 added to the end of the destination IP address by your browser software and when you send an email, the client software will append port 25 instead or port 110 when you retrieve messages with Pop3.

Like this story? Spread the news by clicking below:

 del.icio.us     Digg this     reddit!