Ports and the services behind the common ones

02The row is the observation

A socket is a communication endpoint. To distinguish endpoints here, retain an IP address, a port and a transport. For example, TCP at one address and port is different from UDP at that same address and number. The abbreviated cards assume one stated host and omit its address to focus on port and transport.

The client sends toward a destination port; the client also has its own local port. A conversation therefore has two ends. The dynamic port range is 49152 through 65535, often used for temporary client endpoints. It is a reserved range for local allocation, not evidence that every operating system always chooses clients from exactly that range.

On the activity host, 9090/tcp and 9090/udp are separate endpoints because the transports differ. The notes page uses the TCP row. The notes datagrams row uses UDP. Datagram means a separate message; the next lesson explains the transport difference.

HTTP is conventionally associated with 80/tcp, and HTTPS with 443/tcp. A convention is a common association, not proof of a listener or protocol. A label saying HTTP also does not verify what the program actually speaks. For this reading task, use the stated listener row; a real investigation needs more evidence.

A listener shows that an endpoint is waiting under the conditions described by the evidence. That alone does not show a vulnerability, authorization to connect, or successful application behavior.

03Read the activity rows, then the field row

Use the notes page and notes datagrams rows for the guided comparison. They use port 9090 with different transports. A separate customary HTTPS row supplies an association without supplying a listener. Keep that distinction as you read.

Predict which destination a notes-page client uses and compare with the printed check. Leave the separate demo row for the later question. The independent check cards give another case; do not substitute the activity port for those values.

Read the endpoint before guessing a service

A listener waits for incoming traffic at an endpoint. Keep an address,
port and transport when identifying an endpoint; these shortened rows
assume one host and omit its address. TCP and UDP use separate port
spaces even when the digits match. A client also has its own port.

Dynamic ports range from 49152 through 65535. The later client examples
use that range. A customary association such as HTTP with 80/tcp or
HTTPS with 443/tcp does not establish an actual listener or protocol.
The supplied row is evidence for this card, not a scan or vulnerability.

Original fictional listener card. Not output from ss.

Worked row
Service        Listener   Name that does not decide the port
status page    8081/tcp   HTTP is often associated with 80/tcp
The client on this row uses 8081.

Activity rows
Service           Listener   Note
notes page        9090/tcp   the stated listener for the page
notes datagrams   9090/udp   same number, other transport, not the page
https customary   443/tcp    no row says a listener is here

Predict before reading the check. Check: the notes page client uses 9090.

Separate row used by the question
Service     Listener
demo HTTP   8080/tcp

1. Find the notes page row and the notes datagrams row. Both use 9090. One is TCP and one is UDP.
2. Name the port a client uses for the notes page. Ignore the customary 443/tcp row, which says no listener is there.
3. Check: the notes page client uses 9090.
4. Leave the field row for the question. Do not connect to a port and do not scan.

04Optional challenge

Allow about ten extra minutes. On paper, write the same IP address and port once with TCP and once with UDP. Explain what changed and why the endpoints are distinct. Then state why a familiar number alone cannot identify the actual program or prove a security flaw.

05Cards for the checks

The checks below use these cards. They are original fictional text, safe to read anywhere.

1Service        Listener
2demo HTTP      8080/tcp
3time sync      123/udp
4metrics        9100/tcp
5metrics feed   9100/udp
6 
7One conversation seen on the card
8client end 52814/tcp  ->  listener 8080/tcp

06Fresh cases for the checks

Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.

Server mint: IPv4 192.0.2.81; TCP listener port 8187.
Client fern: IPv4 192.0.2.82; temporary TCP port 53126.
Request: fern 192.0.2.82:53126 → mint 192.0.2.81:8187 over TCP.
Reply uses the reverse endpoint direction in this case.
These documentation addresses are fictional evidence.

07Explain your prediction

Optional written self-check: Describe both endpoints and their direction. Keep a listener, a customary port association and a verified application protocol as separate claims.