Port Number
Definition
A 16-bit integer in the TCP or UDP header that identifies the application-layer service at each endpoint. Well-known ports are assigned by IANA: HTTP is 80, HTTPS is 443, SMTP is 25, DNS is 53. Traffic on unexpected port numbers is a common indicator of tunnelling or evasion.
- Size
- 16-bit integer in the TCP/UDP header
- Assigned by
- IANA
- Well-known examples
- HTTP 80, HTTPS 443, DNS 53
- Investigative flag
- Traffic on an unexpected port
Common questions
Why does traffic on an unexpected port draw attention?+
Malware and attackers often tunnel one protocol inside another, such as running command-and-control traffic over port 443 to blend with normal HTTPS, so a mismatch between the port and the protocol actually observed is a common evasion indicator.
What is the difference between well-known and ephemeral ports?+
Well-known ports, roughly 0 to 1023, are IANA-assigned to standard services, while ephemeral ports are temporary high-numbered ports a client picks for the source side of its own outbound connection.
Related terms
- Beaconing
- Periodic outbound connections from a compromised host to a command-and-control server, typically at regular intervals. The regularity of the interval, measured in...
- DNS Tunnelling
- Encoding data inside DNS queries and responses to exfiltrate information or carry command-and-control traffic through a network that permits DNS but blocks...
- Network Flow (NetFlow/IPFIX)
- A summary record of a network conversation, storing source IP, destination IP, source port, destination port, protocol, byte count, and timestamps, without...
- Packet Capture (PCAP)
- The interception and recording of network packets as they traverse an interface. The raw data is stored in PCAP format and analysed...
- TCP Three-Way Handshake
- The connection establishment sequence in TCP: the client sends SYN, the server responds SYN-ACK, and the client completes with ACK. The timestamps...