0

I stumbled upon a strange looking incrementing port-number right after my loopback ip when using the PHP development server, that i am unfamiliar of and can't really find information on the web about it.

$ php -S 127.0.0.1:3000 which logs requests like this:

[Tue Aug 17 16:18:19 2021] 127.0.0.1:65533 [200]: GET /
[Tue Aug 17 16:18:19 2021] 127.0.0.1:65533 Closing
[Tue Aug 17 16:18:19 2021] 127.0.0.1:49152 Accepted
[Tue Aug 17 16:18:19 2021] 127.0.0.1:65534 [200]: GET /
[Tue Aug 17 16:18:19 2021] 127.0.0.1:65534 Closing
[Tue Aug 17 16:18:19 2021] 127.0.0.1:65535 Accepted
[Tue Aug 17 16:18:19 2021] 127.0.0.1:49152 [200]: GET /
[Tue Aug 17 16:18:19 2021] 127.0.0.1:49152 Closing
[Tue Aug 17 16:18:19 2021] 127.0.0.1:49153 Accepted

At first i've thought that this incrementing port represents a line number in a hidden log file that i unsuccessfully tried to find - you can call me stupid ;)

Then, after trying to overflow that counter by spamming it with hey i've noticed that it overflows on 65535 which tells me it's a 16-Bit integer of some sort.

Can you explain to me what this port number stands for / why php shows me this number in the first place? - I have a JavaScript Frontend background, so i'm quite unfamiliar how this TCP magic works and never seen it in Express/Fastify Application-Logs.

wavedeck
  • 3
  • 1
  • 2
    have you any issue or what do you really want to know? – djdomi Aug 17 '21 at 14:52
  • i don't have an issue about it - i'm just curious what this number behind the ip refers to ^^ since i'm coming from the frontend and want to do more in backend i want to understand how servers communicate with clients and this number eg "49153" seems to be important – wavedeck Aug 17 '21 at 14:56
  • 1
    The client ports can be different, that's not unusual – djdomi Aug 17 '21 at 15:01
  • 1
    It’s the port number. TCP communication goes from port to port - outgoing connections go out a port, TO the port they need to communicate in. What you’re seeing is the outgoing port. This can be random, which is why it varies. It is important for debugging/troubleshooting so you can accurately see requests and where specifically they’re coming from. – Ackack Aug 17 '21 at 15:08

1 Answers1

2

Can you explain to me what this port number stands for

If are somewhat familiar with TCP/IP, you know that computers are referred to by their IP address. Now when a packet comes in, how does the computer know which program the packet should be forwarded to? That's where ports come in.

Ports range from 1 to 65535, and are split into three categories:

  • Well known 0-1023 (80 -> HTTP, 443 -> HTTPS, 53 -> DNS, etc...)
  • Registered 1024-49151 (1194 -> OpenVPN, 2195 -> Apple push notifications, etc...)
  • Dynamic/private 49152–65535

If you're running a service, like a web server, you will listen on the well known ports 80 and/or 443. That way all users have a standardized way of accessing your service.

If you're a user, and you navigate to google.com, your operating system will choose a port from the dynamic/private range to use as the source port when communicating with Google's web server. This port doesn't need to be well known or registered since the client is the one initiating the connection, and is telling the web server which port they should communicate on. When Google sends their response, they will send their TCP/IP packet to port the client used, thus the client's OS will know to forward that packet to the correct browser tab.

why php shows me this number in the first place?

Seeing client port numbers can be helpful and informative in many cases.

Let's say there's another service that queries your web server, and that server runs on port 5000. You can search your logs for client port 5000 to see the request logs from just that service.

Or if someone is scanning your website, usually they will use a tool that spins up multiple threads, with each thread having a unique port. When you look at your logs you will see heavy traffic from the same IP but from multiple ports, this is an obvious indicator that you're getting scanned using some tool.

slightly_toasted
  • 804
  • 5
  • 14