Ports and Sockets

// CHAPTER 01

The Multiplexing Problem

One IP address, millions of simultaneous connections — how does the OS sort them out?

// REAL-WORLD SCENARIO

(source_ip, source_port, destination_ip, destination_port, protocol)

Example — two simultaneous Chrome tabs to the same server:
  Tab 1: (192.168.1.10, 54321, 142.250.80.46, 443, TCP)
  Tab 2: (192.168.1.10, 54322, 142.250.80.46, 443, TCP)

Same destination — different source ports — different 5-tuples.
The kernel delivers replies to exactly the right tab via this key.

The receiving server sees the reverse 5-tuple as its connection state:
  (142.250.80.46, 443, 192.168.1.10, 54321, TCP) — for tab 1
  (142.250.80.46, 443, 192.168.1.10, 54322, TCP) — for tab 2

🌐 One Port Handles Millions of Connections

// CHAPTER 02

Port Ranges and IANA Registration

Well-known, registered, and ephemeral ranges — and why root is required for ports below 1024

// REAL-WORLD SCENARIO

0–1023:     Well-Known Ports (System Ports)
            Assigned to specific protocols by IANA.
            Require root/administrator privilege to bind on Unix/Linux.
            (The privilege requirement prevents an unprivileged process
            from impersonating a system service like SSH or HTTP.)
            Examples: HTTP=80, HTTPS=443, SSH=22, DNS=53, SMTP=25

1024–49151: Registered Ports (User Ports)
            Can be registered with IANA by application vendors.
            No root privilege required to bind.
            Examples: MySQL=3306, PostgreSQL=5432, Redis=6379,
                      MongoDB=27017, Elasticsearch=9200, NATS=4222

49152–65535: Dynamic/Ephemeral Ports (Private Ports)
            Not assigned. Used by the OS for client-side source ports.
            When your browser connects to a server, the OS picks a
            random ephemeral port for your end of the connection.
            RFC 6335: IANA defines 49152–65535 as ephemeral range.
            Linux default: 32768–60999 (sysctl net.ipv4.ip_local_port_range).

# View port assignments
cat /etc/services | head -50             # Known port names
getent services 443                      # Lookup specific port

# Check ephemeral port range
sysctl net.ipv4.ip_local_port_range      # Default: 32768 60999

# Expand ephemeral range for high-connection services
sysctl -w net.ipv4.ip_local_port_range="1024 65535"

# Check what is listening
ss -tlnp                                 # TCP listening sockets with process
ss -ulnp                                 # UDP listening sockets
ss -tanp                                 # All TCP connections with process

# Count connections by state
ss -tan | awk '{print $1}' | sort | uniq -c

# Check TIME_WAIT accumulation
ss -tan state time-wait | wc -l

// CHAPTER 03

Well-Known Ports — A Security Reference

Every open port is an attack surface — know what you're exposing and why

// REAL-WORLD SCENARIO

WELL-KNOWN PORT REFERENCE

Click any port for description and security notes. Filter by category.

// CHAPTER 04

The Socket API — 40 Years of Stable Abstraction

socket(), bind(), listen(), accept(), connect() — how the Berkeley Sockets API works

// REAL-WORLD SCENARIO

# 1. socket() — create an endpoint
fd = socket(AF_INET, SOCK_STREAM, 0)
# AF_INET = IPv4, AF_INET6 = IPv6, AF_UNIX = local IPC
# SOCK_STREAM = TCP (reliable, ordered), SOCK_DGRAM = UDP (unreliable, fast)
# Returns: file descriptor (integer) — treat it like a file

# 2. bind() — associate socket with an address (server-side)
bind(fd, ("0.0.0.0", 8080))
# 0.0.0.0 = listen on all interfaces
# 127.0.0.1 = listen on localhost only (no external access)
# Clients usually skip bind() — OS auto-assigns an ephemeral source port

# 3. listen() — mark socket as passive (server-side)
listen(fd, 1024)  # 1024 = accept queue depth
# Kernel now accepts TCP handshakes and queues completed connections
# Application calls accept() to retrieve them

# 4. accept() — retrieve a completed connection (server-side)
client_fd, client_addr = accept(fd)
# Returns a NEW socket fd for this specific connection
# Original fd stays listening for more connections
# New fd's 5-tuple: (server_ip:8080, client_ip:ephemeral_port)

# 5. connect() — establish a connection (client-side)
connect(fd, ("server.example.com", 443))
# Triggers TCP 3-way handshake
# Blocks until connected (or times out after ~127 seconds default)
# OS auto-assigns ephemeral source port

# 6. send/recv — transfer data
send(fd, data, 0)           # Write to socket (kernel buffers it)
data = recv(fd, 4096, 0)    # Read up to 4096 bytes (blocks if no data)
# recv() returns 0 when remote side closed connection (FIN received)

# 7. close() — initiate graceful shutdown
close(fd)   # Sends FIN, begins 4-way teardown

TCP SOCKET CONNECTION LIFECYCLE

Step through the system calls from socket creation to teardown.

# SO_REUSEADDR — allow binding to port in TIME_WAIT
# Essential for server restart without waiting ~120 seconds
sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)

# SO_REUSEPORT — allow multiple processes to bind the same address:port
# Kernel load-balances incoming connections across all bound processes
# Used by multi-worker servers (nginx worker processes all bind port 443)
sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEPORT, 1)

# TCP_NODELAY — disable Nagle algorithm (don't buffer small writes)
# Essential for interactive protocols: SSH, gaming, financial trading
# Without it, small writes are buffered for up to 200ms
sock.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)

# SO_KEEPALIVE — send TCP keepalive probes on idle connections
# Detects dead peers (router rebooted, network cable pulled)
sock.setsockopt(socket.SOL_SOCKET, socket.SO_KEEPALIVE, 1)
sock.setsockopt(socket.IPPROTO_TCP, socket.TCP_KEEPIDLE, 60)    # First probe after 60s idle
sock.setsockopt(socket.IPPROTO_TCP, socket.TCP_KEEPINTVL, 10)   # Probe every 10s
sock.setsockopt(socket.IPPROTO_TCP, socket.TCP_KEEPCNT, 5)      # Close after 5 missed probes

# SO_RCVBUF / SO_SNDBUF — receive/send buffer size
sock.setsockopt(socket.SOL_SOCKET, socket.SO_RCVBUF, 4194304)   # 4 MB receive buffer
# Larger buffers = better throughput on high-latency paths (BDP tuning)

# SO_LINGER — control behavior when close() is called
# linger=True, timeout=0 → RST on close (no TIME_WAIT, immediate port reclaim)
# Useful for test servers; dangerous in production (may lose in-flight data)
import struct
sock.setsockopt(socket.SOL_SOCKET, socket.SO_LINGER, struct.pack('ii', 1, 0))

// CHAPTER 05

The 5-Tuple and Connection Demultiplexing

How the kernel uses five fields to identify every active connection in O(1)

// REAL-WORLD SCENARIO

FIVE-TUPLE CONNECTION TABLE

Click any connection row to see why its 5-tuple is unique. Note connections 1 and 2 go to the same server.

1. Interrupt: NIC DMA's packet to ring buffer, signals CPU via interrupt
2. Kernel extracts IP header: src_ip, dst_ip, protocol
3. Kernel extracts TCP header: src_port, dst_port
4. Computes: hash(src_ip, src_port, dst_ip, dst_port, proto) → bucket
5. Walks bucket list to find matching socket
6. Copies segment data to socket's receive buffer (sk_buff)
7. Wakes any thread blocked in recv()/read() on that socket

If no match in ESTABLISHED table → check LISTEN sockets
If match in LISTEN → process new connection (send SYN-ACK, add to SYN queue)
If no match at all → send RST (connection refused)

⚡ Modern Servers Handle 1–10 Million Connections Per Machine

// CHAPTER 06

Port Exhaustion — When Connections Run Out

The client-side scaling failure nobody talks about until it hits production

// REAL-WORLD SCENARIO

# Diagnose port exhaustion
ss -s                                          # Summary: connected, listening, TIME_WAIT counts
ss -tan | awk '{print $1}' | sort | uniq -c   # Count by state
ss -tan state time-wait | wc -l                # Count TIME_WAIT specifically

# Quick checks
cat /proc/sys/net/ipv4/ip_local_port_range     # Ephemeral range
netstat -s | grep "SYNs to LISTEN|failed"    # Connection failures

# SOLUTION 1: Connection pooling (best solution — root cause fix)
# Reuse existing connections instead of creating new ones per request
# PgBouncer for PostgreSQL, ProxySQL for MySQL
# pool_size = peak_QPS × avg_query_time_seconds
# Example: 10,000 QPS × 0.010s = 100 connections max needed

# SOLUTION 2: Expand ephemeral port range
sysctl -w net.ipv4.ip_local_port_range="1024 65535"  # ~64K ports instead of ~28K

# SOLUTION 3: Enable tcp_tw_reuse (safe for clients)
sysctl -w net.ipv4.tcp_tw_reuse=1
# Allows reusing TIME_WAIT sockets for new outbound connections
# Requires TCP Timestamps (enabled by default on Linux)
# SAFE: client-side only, doesn't affect connection correctness

# SOLUTION 4: Multiple source IPs (each source IP gets its own port space)
ip addr add 10.0.0.2/24 dev eth0
# Now client can use 10.0.0.1 AND 10.0.0.2 as source IPs = 2× port space

# DANGER — do NOT use tcp_tw_recycle (removed in Linux 4.12)
# Breaks connections through NAT; was never safe for production

// CHAPTER 07

Server-Side: Accept Queue and Backlog

Why connections get refused under burst traffic and how to fix it

// REAL-WORLD SCENARIO

# Production kernel tuning
sysctl -w net.core.somaxconn=65536             # Max accept queue depth
sysctl -w net.ipv4.tcp_max_syn_backlog=65536   # Max SYN queue depth
sysctl -w net.core.netdev_max_backlog=65536    # NIC receive queue depth

# Application: request high backlog in listen()
# Python
import socket
s = socket.socket()
s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
s.bind(('0.0.0.0', 8080))
s.listen(65535)  # Capped by somaxconn

# C
listen(fd, SOMAXCONN);   // Use OS maximum

# nginx config (also needs OS tuning above)
# listen 443 ssl backlog=65535;

# Monitor queue state
ss -tlnp | grep ':443'
# Output: State Recv-Q Send-Q
# Recv-Q = current accept queue depth (> 0 means app is behind)
# Send-Q = max queue size

# Monitor drops
cat /proc/net/netstat | grep ListenOverflows
netstat -s | grep "listen queue"  # Count dropped due to full queue

// CHAPTER 08

Non-Blocking I/O and Event-Driven Servers

From the C10K problem to epoll — why nginx handles 100K connections

// REAL-WORLD SCENARIO

select()  — monitors up to FD_SETSIZE (1024) fds.
             O(n) scan on EVERY call. Obsolete. Max 1024 connections.

poll()    — removes 1024 limit. Still O(n) scan. Not scalable.

epoll()   — Linux only (since 2.5.44, 2002). O(1) event notification.
(Linux)    The kernel maintains a red-black tree of monitored fds.
             When any fd becomes ready, kernel adds it to a ready list.
             epoll_wait() returns ONLY ready fds — no scanning.
             Supports edge-triggered (ET) and level-triggered (LT) modes.
             Used by: nginx, Redis, Node.js (libuv), PostgreSQL.

kqueue()  — BSD/macOS equivalent of epoll. Same O(1) semantics.
(BSD/macOS)

io_uring  — Linux 5.1+ (2019). Async I/O that avoids syscall overhead.
             Batches I/O operations through shared ring buffers.
             Application submits operations without syscall (mmap'd ring).
             Used by: Tokio (Rust), io_uring-aware web servers.

import asyncio

async def handle_client(reader, writer):
    while True:
        data = await reader.read(4096)
        if not data:
            break
        writer.write(b"Echo: " + data)
        await writer.drain()
    writer.close()
    await writer.wait_closed()

async def main():
    server = await asyncio.start_server(handle_client, '0.0.0.0', 8888, backlog=65535)
    async with server:
        await server.serve_forever()

asyncio.run(main())
# asyncio uses epoll (Linux), kqueue (macOS), or IOCP (Windows) automatically
# Single event loop handles 100,000 concurrent connections in one thread

// CHAPTER 09

Unix Domain Sockets — Local IPC via the Socket API

Same API, no network stack — why your database connection is 30% faster using /tmp/postgres.sock

// REAL-WORLD SCENARIO

# Common Unix domain socket paths
/var/run/postgresql/.s.PGSQL.5432   # PostgreSQL
/var/lib/mysql/mysql.sock           # MySQL/MariaDB
/var/run/redis/redis.sock           # Redis (when configured)
/run/nginx.sock                     # nginx upstream to PHP-FPM
/var/run/docker.sock                # Docker daemon API
/run/systemd/private/io.systemd.PrivateUsers  # systemd internal

# Connect to PostgreSQL via Unix socket
psql -h /var/run/postgresql -U username dbname
# Or simply: psql -U username dbname (auto-finds socket)

# Connect to MySQL via Unix socket
mysql -S /var/lib/mysql/mysql.sock -u root

# Python: explicitly use Unix socket
import socket
sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
sock.connect('/tmp/myapp.sock')

# Python: PostgreSQL via Unix socket (psycopg2)
import psycopg2
conn = psycopg2.connect(host='/var/run/postgresql', dbname='mydb', user='user')
# Equivalent to TCP: host='127.0.0.1', port=5432

⚠ The Docker socket is root-equivalent

// CHAPTER 10

TCP Socket States

The full state machine — from CLOSED to ESTABLISHED to TIME_WAIT

CLOSED      → Initial state. No connection.

LISTEN      → Server has called listen(). Waiting for incoming SYNs.
               (Server side only. Shows in ss -tlnp output.)

SYN_SENT    → Client called connect(), sent SYN. Waiting for SYN-ACK.
               (If stuck here: server unreachable or firewall dropped SYN)

SYN_RCVD    → Server received SYN, sent SYN-ACK. Waiting for final ACK.
               (SYN flood attack fills this state for many spoofed IPs)

ESTABLISHED → 3-way handshake complete. Data transfer phase.
               (Normal connected state. Both sides.)

FIN_WAIT_1  → Active closer sent FIN. Waiting for ACK.

FIN_WAIT_2  → ACK received for our FIN. Waiting for remote FIN.
               (net.ipv4.tcp_fin_timeout controls max time here — default 60s)

CLOSE_WAIT  → Remote sent FIN; we sent ACK. App must call close() to continue.
               ⚠ Many CLOSE_WAIT entries = application not calling close() promptly
               (Often a resource leak bug)

LAST_ACK    → Passive closer sent FIN after receiving FIN. Waiting for final ACK.

TIME_WAIT   → Active closer received remote FIN, sent final ACK. Waiting 2×MSL.
               ⚠ Many TIME_WAIT entries = many short-lived connections from one client
               (Normal but can cause port exhaustion. See Chapter 6.)

CLOSED      → Connection fully terminated.

// CHAPTER 11

Port Scanning and Service Discovery

How nmap works, what attackers see, and interpreting scan results

// REAL-WORLD SCENARIO

# SYN scan — fastest, requires root
nmap -sS -p 1-1024 target           # Top 1024 ports
nmap -sS -p 1-65535 target          # Full scan
nmap -sS --top-ports 100 target     # nmap's 100 most common ports

# Connect scan — no root required
nmap -sT target

# UDP scan of common services
nmap -sU --top-ports 20 target      # DNS(53), SNMP(161), NTP(123)...

# Service and version detection
nmap -sV target                     # Identify service versions (banner grab)
nmap -A target                      # SYN + version + OS + scripts + traceroute

# Specific port checks
nmap -p 22,80,443,3306 target

# Subnet scan
nmap -sS 192.168.1.0/24             # All hosts in /24

# Output formats
nmap -sS -oN output.txt target      # Normal output
nmap -sS -oX output.xml target      # XML for parsing
nmap -sS -oG output.gnmap target    # Grepable format

# Quick ping sweep (host discovery only)
nmap -sn 10.0.0.0/24

// CHAPTER 12

Firewall Rules and the 5-Tuple

Translating security policy to packet-level rules using port knowledge

# Default: deny all inbound, allow all outbound
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Allow loopback (localhost communication)
iptables -A INPUT -i lo -j ACCEPT

# Allow established/related (return traffic for outbound connections)
# This allows: responses to our outbound requests, ICMP errors, FTP data
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# SSH with rate limiting (prevent brute force)
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW   -m limit --limit 5/min --limit-burst 10 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP   # Drop excess

# HTTPS
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# HTTP (redirect to HTTPS — still needs to be open)
iptables -A INPUT -p tcp --dport 80 -j ACCEPT

# ICMP — allow for ping and PMTUD (fragmentation needed)
iptables -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request   -m limit --limit 10/sec -j ACCEPT

# Log dropped packets (for incident investigation)
iptables -A INPUT -j LOG --log-prefix "IPTABLES DROP: " --log-level 4
iptables -A INPUT -j DROP

// CHAPTER 13

Troubleshooting Connection Issues

Systematic diagnosis from socket layer to application layer

# ── LAYER 3: Is the host reachable? ─────────────────────────────────
ping -c 4 10.0.0.1                   # ICMP echo (blocked by some firewalls)
traceroute 10.0.0.1                  # Hop-by-hop path trace

# ── LAYER 4: Is the port open? ───────────────────────────────────────
nc -zv 10.0.0.1 443                  # TCP connect test
# "succeeded" = port open
# "refused" = port not open or actively rejected (RST)
# (timeout) = firewall DROP or host unreachable

nc -u -zv 10.0.0.1 53               # UDP port test

# ── LOCAL: Is the service listening? ────────────────────────────────
ss -tlnp | grep ':443'               # TCP listening on 443?
ss -ulnp | grep ':53'                # UDP listening on 53?
ss -tanp | grep 'ESTABLISHED'        # All active connections

# ── FIREWALL: Is traffic being blocked? ─────────────────────────────
iptables -L -n -v | grep 443         # Check rules for port 443
iptables -L -n --line-numbers        # All rules with line numbers

# ── PACKET CAPTURE: What's actually happening? ──────────────────────
tcpdump -i eth0 -n 'host 10.0.0.1 and port 443' -c 20
# If you see: SYN → SYN-ACK → ACK = connected
# If you see: SYN → SYN → SYN = server not responding (firewall drop)
# If you see: SYN → RST = refused (no listener or app rejected)

# ── APPLICATION: TLS/SSL check ───────────────────────────────────────
openssl s_client -connect 10.0.0.1:443 -servername hostname
# Shows certificate, cipher suite, TLS version

# ── SYSCALL TRACE: What's the app doing? ────────────────────────────
strace -e trace=network -p PID      # All network syscalls for a process

// CHAPTER 14

Common Misconceptions

Port and socket errors that waste hours in production debugging

✗ Common Mistake — A server can only handle 65,535 simultaneous connections

✗ Common Mistake — Opening a connection 'uses up' a port on the server

✗ Common Mistake — Connection refused and connection timeout mean the same thing

✗ Common Mistake — SO_REUSEADDR and SO_REUSEPORT do the same thing

✗ Common Mistake — Closing a connection immediately frees the port

✗ Common Mistake — Moving a service to a non-standard port makes it secure

// CHAPTER 15

Interview Questions