What is a port? 443, 53, 3389 and friends

What is a network port? It's a number from 0 to 65535 that tells a computer which program a piece of traffic belongs to. The IP address gets data to the right machine; the port gets it to the right program on that machine. Servers wait on well-known ports, such as 443 for secure websites or 53 for DNS, while your side of a connection uses a random high number that Windows picks and throws away afterwards.

What is a network port, really

Picture an apartment building. The street address gets a letter to the building; the apartment number gets it to the right door. On a network, the IP address is the street address and the port is the apartment number.

A few details make the picture complete:

• Ports are just numbers. Nothing physical is involved. A port is "open" only when a program is listening on it.
• TCP and UDP have separate sets. TCP port 53 and UDP port 53 are different doors that happen to share a number.
• Every connection has two ports, one at each end. A connection is identified by five things together: the protocol, your address, your port, the remote address and the remote port. That is why your browser can hold dozens of connections to port 443 at once without mixing them up.

The Internet Assigned Numbers Authority (IANA) splits the range into three bands: 0–1023 are the well-known ports, 1024–49151 are registered to particular services, and 49152–65535 are left for temporary use.

The well-known ports you'll actually see

These are the numbers that turn up on an ordinary Windows PC.

Treat the table as a convention, not a guarantee. Any program can use any port. Traffic on 443 is usually HTTPS, but a port number proves nothing about what is inside, and plenty of unwanted software uses 443 precisely because it blends in.

Ephemeral ports: the random number on your side

When your PC opens a connection, Windows gives your side a temporary port from its dynamic range, which is 49152–65535 by default on current versions of Windows. When the connection closes, the number goes back in the pool. These are called ephemeral ports.

So on an outbound connection the local port is noise. It changes every time and tells you nothing. The remote port is the useful one: it names the service you're talking to. If you are curious about your own range, netsh int ipv4 show dynamicport tcp shows it.

Local port and remote port

Put the two together and you can read any connection:

• Outbound (your PC called out): local port is high and random, remote port is the service. 10.0.0.5 :51234 → 142.250.74.46 :443 is a secure web connection.
• Inbound (another machine called you): local port is the service, remote port is the other machine's random one. 10.0.0.5 :3389 → 10.0.0.9 :50122 is someone connected to your Remote Desktop.
• Loopback (both ends are this PC, 127.0.0.1 or ::1): two programs on your computer talking to each other, often an app and its own helper process.

Direction has its own explainer in inbound and outbound connections. The state a connection is in, such as ESTABLISHED or TIME_WAIT, is covered in TCP states decoded.

How to see ports on Windows

Windows has three built-in ways:

• netstat -ano in Command Prompt lists every TCP and UDP endpoint with its process ID.
• Get-NetTCPConnection and Get-NetUDPEndpoint in PowerShell give the same data as objects you can filter.
• Resource Monitor (resmon) has a Listening Ports section on its Network tab.

They all show a snapshot, and you have to match process IDs to programs yourself. Finding which app is using a port walks through that.

Ports in NetSecWall

In the Live tab, each program expands into its connections, written as local :port → remote :port, or :port (listening) for a socket waiting for inbound connections. The Proto column says TCPv4, TCPv6, UDPv4 or UDPv6, so you can tell TCP 53 from UDP 53 at a glance.

The filter bar above the list does the matching for you:

1. Type a number into the Port box. NetSecWall keeps only connections where either the local or the remote port matches.
2. Set Proto to TCP or UDP if you care about one of them.
3. Tick Hide loopback to drop programs talking to themselves.

The main text box, "Filter: process, service, host, IP, PID, or port…", also accepts a port number, which is quicker for a one-off check.

The grouped views (By IP, By Domain, By Country) add a Ports column that lists the ports used with each address. The Multi-port checkbox keeps only groups talking on two or more ports, which is a quick way to spot an address used for more than ordinary web traffic. Filtering the Live tab covers every option.

If you run the Plus plan or higher, the detection engine also treats a short list of ports associated with remote-access tools, such as 4444, 1337 and 31337, as one weak signal ("Non-Standard Port", MITRE ATT&CK T1571). On its own it won't flag anything; combined with other signals it raises a program's risk score. The list is editable under Security ▸ Detection rules…, in the RAT / C2 ports catalog.

Closing or blocking a port

A port stops being open when the program listening on it stops. If you can't stop the program, block the port with a firewall rule. In NetSecWall that is Rules ▸ New rule…, with Local ports for traffic arriving at your PC and Remote ports for traffic you send out; ports apply to TCP and UDP only. Create a custom firewall rule has the details, including the caveat about the background service.

The short version

Ports are apartment numbers for programs. The remote port on an outbound connection tells you the service; the local one is a throwaway. A listening port is a door someone could knock on; an outbound 443 is not. To see every port every program is using right now, download the 7-day trial and type a port number into the Live tab's filter.