An IP address gets traffic to the right server; a port gets it to the right program on that server; the protocol decides how the data travels. Understanding these three pieces makes firewall rules, connection errors and performance problems much easier to reason about.
Before you start
This is a concept guide. It helps to know what an IP address is (IP addresses explained). For a full lookup table of port numbers, keep common server ports and what uses them open.
What a port is
A port is a number from 0 to 65535 attached to an IP address. A web server listens on port 443, SSH on 22, MySQL on 3306. The pair IP:port (for example 203.0.113.25:443) is called a socket. Your computer picks a random high port (49152–65535) as the source of each outgoing connection, so replies come back to the right browser tab.
- 0–1023: well-known ports (HTTP, HTTPS, SSH, SMTP, DNS). Only root/administrator can listen on them.
- 1024–49151: registered ports (MySQL 3306, cPanel 2083, WHM 2087, RDP 3389).
- 49152–65535: ephemeral ports used for outgoing connections.
TCP: reliable and ordered
TCP (Transmission Control Protocol) opens a connection with a three-way handshake (SYN, SYN-ACK, ACK), numbers every byte, re-sends anything lost and delivers data in order. If the network drops packets, TCP slows down to avoid congestion. That reliability costs a round trip to set up and makes TCP sensitive to latency and packet loss.
UDP: fast and connectionless
UDP (User Datagram Protocol) just sends packets. No handshake, no retransmission, no ordering. Applications that prefer a late packet to be skipped rather than waited for use UDP: voice and video calls, online games, DNS lookups, VPNs such as WireGuard, and HTTP/3, which builds its own reliability on top of UDP with QUIC.
Which protocol common services use
| Service | Port | Protocol |
|---|---|---|
| HTTP / HTTPS | 80 / 443 | TCP (HTTP/3 uses UDP 443) |
| SSH, SFTP | 22 | TCP |
| SMTP submission / IMAPS / POP3S | 587, 465 / 993 / 995 | TCP |
| DNS | 53 | UDP (TCP for large answers and zone transfers) |
| WireGuard | 51820 (default) | UDP |
| OpenVPN | 1194 | UDP or TCP |
| RDP | 3389 | TCP, plus UDP for better performance |
| NTP time sync | 123 | UDP |
Note: Firewalls treat TCP and UDP separately. Opening 51820/tcp does nothing for WireGuard, which needs 51820/udp. Always open the protocol the service actually uses.
How to see what is listening on a server
- Connect to your server over SSH (connect to your Linux VPS with SSH).
- List listening TCP and UDP sockets with the program that owns them:
sudo ss -tulpnThe Local Address:Port column shows where each service listens. 0.0.0.0 or [::] means every interface; 127.0.0.1 means local only. More detail in check which ports are open on Linux.
Testing a port from outside
TCP ports are easy to test because they answer the handshake:
nc -zv 203.0.113.25 443UDP ports are harder: a closed UDP port may answer with an ICMP error, but an open one often stays silent. Test UDP services with their own client (for example dig @server example.com for DNS, or a WireGuard handshake).
Troubleshooting
- Connection refused: the server answered, but nothing listens on that port. Start the service or check its port.
- Connection timed out: packets are being dropped, usually by a firewall on the server, at the provider or on your own network. See port open but still unreachable.
- Works on TCP, fails on UDP: many office and public Wi-Fi networks block UDP except DNS. Try another network to confirm.