Why ports need a range structure at all
A port number identifies a specific service or connection endpoint on a device, alongside its IP address — since two unrelated applications on the same machine both need the network stack to route traffic to the correct one, ports need to be assigned in some organized way to avoid different services silently colliding on the same number. The Internet Assigned Numbers Authority (IANA) manages this via three bands across the full 16-bit (0–65535) range.
The three ranges
| Range | Name | Purpose |
|---|---|---|
| 0–1023 | Well-known ports | Reserved for widely used, standardized system services |
| 1024–49151 | Registered ports | Assignable to specific applications/vendors by request, less strictly enforced |
| 49152–65535 | Dynamic/private ports | Used for temporary, ephemeral connections — not permanently assigned to any service |
Well-known ports: the ones worth memorizing
This bottom range covers the services that show up constantly in networking and development work:
- 22 — SSH (secure remote shell access)
- 80 — HTTP (unencrypted web traffic)
- 443 — HTTPS (encrypted web traffic)
- 25 — SMTP (email sending)
- 53 — DNS (domain name resolution)
- 3306 — MySQL (a registered-range port, technically, but ubiquitous enough to know)
On most systems, binding to a well-known port (0–1023) requires elevated/administrator privileges — a deliberate restriction, since these are the ports users and other systems implicitly trust to be running the expected standard service, and unprivileged processes shouldn't be able to freely impersonate them.
Dynamic/private ports: where your browser's outgoing connections live
When your browser opens a connection to a web server on port 443, it doesn't connect from port 443 on your machine — it picks an arbitrary port from the dynamic/private range (49152–65535) as its own local endpoint for that specific connection. This is why you'll see seemingly random high port numbers in network diagnostic tools for outgoing connections — they're temporary, assigned per-connection, and released once the connection closes, not tied to any specific persistent service.
Common mistakes
- Assuming every port below 1024 is actually in active standardized use. Many well-known-range numbers are formally reserved but rarely seen in practice — the range is a reservation ceiling, not a claim that all 1024 slots are meaningfully assigned.
- Trying to bind an unprivileged process directly to a well-known port and being surprised by a permissions error — this restriction is deliberate, not a bug.
- Confusing the port a server listens on with the port a client's outgoing connection uses. A web server listens on 443; the client's side of that same connection uses an arbitrary dynamic-range port, not 443 itself.
FAQ
Why do I need administrator privileges to run a server on port 80 or 443?
Ports 0–1023 are well-known ports reserved for standard services, and most operating systems restrict binding to them to privileged processes — a deliberate security measure preventing unprivileged software from impersonating trusted standard services.
What port does my browser use when it connects to a website?
The server listens on a well-known port (typically 443 for HTTPS), but the browser's own local endpoint for that connection is an arbitrary port from the dynamic/private range (49152–65535), assigned temporarily just for that connection.
Are all ports below 1024 actually assigned to a real, active service?
No — the well-known range is a reservation ceiling recognized by IANA; many specific numbers within it are formally reserved but rarely encountered in everyday use.
Look up any port number's registered use with the Port Number Lookup — entirely client-side.