ports on computer and firewall and it's purpose - 101 question

Question

Ok, computers have ports for applications to transfer data from the outside world into a firewall and then into a computer.

Then how does firefox and internet explorer use the same port on the same computer?

And why can't we use port 80 to pass all traffic from all places into the computer.

So why do we need specific ports?

Answer 1

ports can be used for anything, but there are conventions of the protocols to expect on certain ports.

and you can use 80 for other functions, some people do that as a simple way of bypassing firewalls...

however, only 1 application can be listening on a port.

Answer 2

It's not the ports on local that are important generally. It's the remote ports.

So when you open a browser and go to a site, you are establishing a connection from a (somewhat) random port on your end, to port 80 on the server end. The server responds back to you on the same connection. Web servers use TCP/IP, so this is what is called and established connection. If you were to go look at netstat -an on the server you connected to during web traffic, that is exactly what you would see:

tcp        0      0 ::ffff:192.168.1.223:22     ::ffff:192.168.1.230:2369   ESTABLISHED

That line says that my local machine has established a connection to my remote machine on port 22. My local machine picked a random outgoing port of 2369 to make this connection. In this case, this is an ssh connection to my webserver in the basement.

Ports that servers should use for a particular service are listed here, but if you are going to control both ends of the connection, there is nothing stopping you from running a webserver on port 8383 if you wanted to. Just don't expect anyone else to get to it without you telling them about it. (or it being found in a port scan).

If you were running a webserver on your computer, it would open port 80 and listen for connections. Only one service can be LISTENing per IP address, so you couldn't run two web servers at once. Same thing if you then connected to your local webserver. You'd open a random local port and connect to your local port 80 on the same IP.

The opening the random local port is what allows you to have multiple local connections to a known remote port like 80.

There are 65536 ports available so it's unlikely you will ever run out, but many have 'well known' usages and are therefore avoided for your end of the connection. Generally everything above 1023 is fair game though. ( All services which require any kind of priviledge run on ports below 1023 )

This is a TCP/IP connection. TCP/IP has internal language to ensure the reliable delivery of information and does a handshake at the open of every connection to ensure the data can be transmitted.

Another common type of connection would be UDP. UDP does not establish a connection and is therefore a bit faster and has lower latency, but the programs that use it must be able to loose information and still work. It's basically a send off the data and pray protocol. Many online games work this way.

Answer 3

Each connection has a source and destination port. This is what allows you to have multiple connections from your machine to (say) a web server running on port 80. Connections are uniquely identified by SourceIP:SourcePort and DestIP:DestPort.

So in your example, Firefox and IE will be using the same port on the remote web server (port 80), but will have a different ports on your machine to tell them apart.

Try running netstat in a command prompt to see current connections.

Answer 4

Some netstat output can show you what's going on:

C:\Temp> netstat -an

  TCP    192.168.XXX.150:1493   74.125.45.100:80       ESTABLISHED
  TCP    192.168.XXX.150:1504   69.59.196.213:80       ESTABLISHED
  TCP    192.168.XXX.150:1507   74.125.91.138:80       ESTABLISHED
  TCP    192.168.XXX.150:1510   65.55.11.162:80        ESTABLISHED
  TCP    192.168.XXX.150:1518   69.59.196.211:80       ESTABLISHED
  TCP    192.168.XXX.150:1519   69.59.196.216:80       ESTABLISHED
  TCP    192.168.XXX.150:3711   64.208.186.96:80       CLOSE_WAIT

Note that the 192.168.XXX.150 address is my computer's address on my home network. The 4 digit numbers following the IP address are the local port my computer is using to communicate with port 80 on a bunch of different servers.