Lesson 2 of 4 · 7 min
Ports, TCP and UDP
Why one IP address can run a hundred conversations at once, and why some of those conversations trade speed for reliability.
An IP address gets a packet to the right device. It does not say which app on that device should receive it. That is the job of a port: a number that tells your Mac which program is talking. Cloudflare’s Learning Center compares it to an apartment building: the street address (the IP) gets mail to the right building, and the apartment number (the port) gets it to the right door.
One connection, many doors
Ports let a computer tell different kinds of traffic apart even though it all arrives over the same Wi-Fi or cable connection. Cloudflare’s explanation is direct: “ports allow computers to easily differentiate between different kinds of traffic: emails go to a different port than webpages, for instance, even though both reach a computer over the same Internet connection.” Ports live in the TCP and UDP headers, one layer above the plain IP address; a bare IP packet has no room to say which port it is for.
Who is allowed to use which number
Port numbers run from 0 to 65535, and the Internet Assigned Numbers Authority (IANA) manages who gets which: system ports (0–1023) are assigned only through formal review, user or registered ports (1024–49151) can be registered for a specific service, and the top range, 49152–65535, is left unassigned for temporary use, such as the return address your browser picks for its own end of a connection.
| Port | Registered service | What usually uses it |
|---|---|---|
| 22 | Secure Shell (SSH) | Remote command-line access |
| 25 | Simple Mail Transfer | Sending email between mail servers |
| 53 | Domain Name Server | DNS lookups |
| 80 | HTTP | Ordinary, unencrypted web pages |
| 443 | HTTPS | Encrypted web pages |
TCP: slower, but nothing goes missing
The Transmission Control Protocol (TCP), defined in RFC 9293, is built to be dependable: it “provides a reliable, in-order, byte-stream service to applications”, detecting lost packets through sequence numbers and resending them until the other side confirms receipt. That reliability costs a little time and overhead, which is why TCP is the right choice for things that must arrive intact and in order: a webpage, a file download, an email.
UDP: fast, and willing to lose a little
The User Datagram Protocol, described in RFC 768, takes the opposite trade-off: it “provides a procedure for application programs to send messages to other programs with a minimum of protocol mechanism.” There is no handshake, no guarantee of order, and no automatic resend. Cloudflare notes that this suits “especially time-sensitive transmissions such as video playback or DNS lookups”, where a dropped packet is a minor glitch, but waiting for a retransmission would be worse than just moving on.
Key takeaways
- A port is a number that tells a device which app or service a packet is for; the IP address alone only identifies the device.
- IANA manages port numbers in three bands: system ports (0–1023), user/registered ports (1024–49151), and unassigned dynamic ports (49152–65535).
- Common ports include 22 (SSH), 25 (mail), 53 (DNS), 80 (HTTP) and 443 (HTTPS).
- TCP (RFC 9293) checks and resends lost data for reliable, in-order delivery, at some cost in speed.
- UDP (RFC 768) skips those checks for speed, which suits time-sensitive traffic like video and DNS lookups.
Check yourself
1. What problem do ports solve that an IP address alone cannot?
- They tell the network which app on a device a packet is for — Right.
- They encrypt the connection
- They replace the need for an IP address
- They make Wi-Fi faster
The IP address routes a packet to a device; the port, carried in the TCP or UDP header, says which program on that device should handle it.
2. Which port is registered for HTTPS according to the IANA registry?
- 21
- 80
- 443 — Right.
- 8080
IANA lists port 443 as "https", used for HTTP over TLS/SSL. Port 80 is plain, unencrypted HTTP.
3. Why does RFC 9293 describe TCP as "reliable, in-order"?
- Because TCP detects lost data and resends it, and keeps data in the order it was sent — Right.
- Because TCP never uses ports
- Because TCP is always faster than UDP
- Because TCP encrypts everything by default
TCP tracks sequence numbers to detect gaps, resends missing data, and reassembles the byte stream in order.
4. Why would DNS lookups and video playback typically use UDP instead of TCP?
- UDP is more secure
- UDP trades reliability for speed, which suits traffic where a missing packet is only a minor glitch — Right.
- TCP cannot use port 53
- UDP guarantees packets arrive in order
Cloudflare notes UDP suits "especially time-sensitive transmissions such as video playback or DNS lookups" precisely because it skips TCP’s handshake and retransmission overhead.
Do it with FireAI
Put this lesson into practice on your own Mac.
- Find out where an app sends data, on the World map — See exactly which company and country one app is quietly talking to.
- Rules: app, website, domain, IP or a range, forever or until you restart — Write a rule as precise as one address or as broad as an entire domain.
- Deep inspection, without decrypting anything — Get real detail on a secure connection without FireAI ever reading what’s inside it.
Sources
- RFC 9293: Transmission Control Protocol (TCP)
- RFC 768: User Datagram Protocol
- IANA: Service Name and Transport Protocol Port Number Registry
- Cloudflare Learning: What is a computer port?
- Cloudflare Learning: What is UDP?
Put it into practice on your Mac
Try every feature free for 17 days, no card needed.