The three port ranges
- 0–1023, well-known: assigned by IANA to standard services. On Unix only root (or a process with CAP_NET_BIND_SERVICE) can listen on them.
- 1024–49151, registered: assigned on request to vendors and projects (3306 MySQL, 5432 PostgreSQL, 6379 Redis). Any user can bind them.
- 49152–65535, dynamic / ephemeral: used for the client side of connections. Linux actually uses 32768–60999 by default (
net.ipv4.ip_local_port_range).
Ports that should never face the internet
Redis (6379), Memcached (11211), MongoDB (27017), Elasticsearch (9200), the Docker API (2375), etcd (2379) and most databases ship without authentication or with weak defaults, and are scanned continuously. Bind them to 127.0.0.1 or a private interface, put them behind a VPN or a firewall rule, and never rely on obscurity. Shodan indexes all of them within hours.
Finding what is listening
ss -tulpn # Linux: listening TCP/UDP sockets with process names
sudo lsof -i :8080 # which process owns port 8080
nc -zv host 22 # is a remote port open?A port that is “open” in ss but unreachable from outside is usually blocked by a firewall (ufw, nftables, a cloud security group, or Cloudflare only proxying 80/443).
Questions
What is the difference between TCP and UDP ports?
They are separate namespaces: TCP 53 and UDP 53 are different sockets, even though DNS uses both. A service can listen on one, the other or both.
Why can’t I bind port 80 without root?
Ports below 1024 are privileged on Unix. Run the service on a high port behind a reverse proxy, grant the binary CAP_NET_BIND_SERVICE (setcap), or use systemd socket activation.
What does “address already in use” mean?
Another process already listens on that port (ss -tulpn shows which), or a recently closed socket is still in TIME_WAIT. SO_REUSEADDR, or waiting a minute, fixes the latter.
Which ports does HTTP/3 use?
UDP 443. HTTP/3 runs over QUIC, which is UDP-based; browsers discover it through the Alt-Svc header or an HTTPS DNS record.