In a nutshell Once a packet reaches the right machine, two questions remain: which program gets it, and should delivery be guaranteed. Ports answer the first — a numbered door per program. TCP and UDP answer the second — reliable-but-slower, or fast-but-lossy. This is the transport layer (L4), and port scanning lives right here.
Ports — a door number per program
One machine, one IP, but dozens of programs wanting the network at once: browser, mail, database, game. A port (0–65535) is the number that says which program a packet belongs to. The IP gets you to the building; the port says which door to knock on.
| Range | Name | Example |
|---|---|---|
| 0–1023 | well-known (fixed for standard services, admin to bind) | 80, 443, 22, 53 |
| 1024–49151 | registered (assigned to particular apps) | 3306, 8080 |
| 49152–65535 | ephemeral (temporary, for outgoing connections) | your browser's side of a connection |
TCP — reliable, connection-based
TCP guarantees delivery: it numbers every chunk, re-sends anything lost, and reassembles in order. Used where you can't drop a byte — web, files, SSH. It opens with the three-way handshake:
That handshake is exactly why a port scanner can read a port's state: a SYN to an open port gets SYN-ACK; to a closed port gets RST ("go away"); to a filtered port (firewall) gets silence.
UDP — fast, fire-and-forget
UDP just sends. No handshake, no delivery check, no reordering. Lost is lost. Used where speed beats perfection — video calls, live streams, games, DNS. Better to drop one video frame than freeze waiting for it.
TCP — the phone call
- handshake first, then talk
- guaranteed, ordered delivery
- slower (overhead, acks)
- web, SSH, files, email
UDP — the postcard stack
- no setup, just send
- no guarantee, no order
- fast and lightweight
- DNS, video, games, VPN data
Analogy. TCP is a phone call: you both confirm you can hear each other, and if the line garbles you say "what?". UDP is a stack of postcards flung out the window — most arrive, nobody checks.
Why this matters to an attacker
Port scanning (nmap) is transport-layer work — it plays with SYN/ACK/RST to learn which doors are open without fully connecting:
nmap -sS target # SYN scan: send SYN, read the reply, never finish the handshake
nmap -sU target # UDP scan: slower, noisier — no handshake for a clean yes/no
An open port means a service is listening — and a service is something you can talk to, fingerprint, and possibly attack.
filtered) doesn't mean nothing's there — a firewall may be dropping your probe while the service runs fine behind it. Never write a host off on one quiet scan; that's the same trap as a silent ping.