Who decided the port numbers 3389, 5005, and 8080? Please explain port mapping and port conflicts clearly at once.

Last month, I helped my cousin set up a remote desktop. port mapping I asked him to fill in 13389 for the external port in the table and 3389 for the internal port. He asked me something: Why don't they fill in the same number and make me remember four more digits? I opened my mouth and said "for safety". He asked where the safety was, and I got stuck. When I got home, I turned on my computer and typed netstat. I looked at the numbers on the screen and went through the matter all over again - I have been using port numbers for so many years, but I still only half understand them. This article will pierce this layer of window paper.

Make it clear first: IP finds the building, port finds the room

A piece of data needs to be sent to a certain place online, and the address is written in two paragraphs. The previous paragraph is the IP address, which is responsible for finding the machine. ； The latter section is the port number, which is responsible for finding the specific program on this machine. Use a community analogy: The IP is the building number and the port is the room number. If the express delivery form only says "Building 3", it will not be delivered to the recipient. It must be followed by the room number.

Why is such a layer needed? Your mobile phone is connected to WiFi, WeChat, Bilibili, and games are online at the same time, and the data from the three lines are all flowing to the same IP. If there is no port and the data reaches the door of the mobile phone, no one knows whether this package should be given to WeChat or the game. Therefore, every networked program will obtain one or several port numbers from the system before starting, which is equivalent to hanging a mailbox in this building. The header of the data packet says "Send to mailbox No. 5005 on 31.10", and the system sorts them accordingly. Whoever receives the letter will receive it without visiting each other.

The port number is a 16-bit number, so the range is 0 to 65535. There are more than 65,000 numbers in total, which is enough for one machine. You type on your home computer netstat -ano , the number after the colon in the local address column is the port, and you can see dozens of entries working at the same time. The complete identity of a connection is "source IP + source port + destination IP + destination port + protocol". I am writing The difference between TCP and UDP That article mentioned it briefly, but this article specifically explains the port aspect thoroughly.

There are 65535 numbers, divided into three, six and nine levels.

These more than 60,000 numbers are not caught casually. There is an international organization that manages the registration book. It is divided into three levels, each with its own rules.:

The first two levels are the server ports of "waiting for people to come". The numbers are fixed, and others can come to the door according to the number. The third level is the client port of "actively going out". You click on a video, and the system grabs an account from this level and uses it as a reply mailbox. You return it when you use it and change it next time. So when you see the connection of the mobile phone in the router device list, the five digits of the local port keep changing. That is a normal phenomenon and it is not hacked.

There are local rules for selecting ports when setting up services at home.: Avoid the first 1024, and don’t use numbers registered with big software. Choose numbers from 10,000 upwards. It was the first time I configured WebDAV for my NAS at home, and I casually filled in 8080. As a result, it had a conflict with another tool. I’ll talk about conflict troubleshooting in detail later.

I compiled a list of numbers that I often deal with at home and put it in the weak current box.

I have been working in this business for several years, and there are quite a few port numbers scattered in various articles. I put the ones that I really encounter in household scenes into a table, printed it out and pasted it on the inside of the weak current box cover. I don’t have to read the article when configuring the mapping.:

There is a detail in this table worth mentioning.: 1900 and 5353 rely on multicast. When searching for TV or printer on mobile phones, they are the ones broadcasting all over the room. I wrote The group broadcast article Capture packets from time to time to see how many megabytes they ran. This is also why after turning on AP isolation or demarcating VLAN, the screen cannot be found - I found that this step was blocked, and all subsequent processes were interrupted.

8080 is occupied? Find out the real culprit in three steps

Port conflicts are the most frustrating pitfalls I have ever encountered. Once when I started a local gadget, the log said "The port is occupied and the program exited." It was gone. Who owns it? It doesn't say. In this case, the case can be solved in three steps:

The first step is to type in the command line netstat -ano | findstr :8080 , replace 8080 with the number you conflict with. The last column in the output is PID, the process number. The second step is to open the task manager, switch to the "Details" column, find the PID column and click on it to sort by number. You will know which process it is by matching the number. The third step is to either right-click to end it or change the port of your tool. That time I found out that a download tool that had not been cleared the day before was occupying 8080. The process name was hanging there and I was puzzled for a long time - it turned out that it was resident in the background.

Changing the port is usually less troublesome than killing the process, especially if the other party is a service that the system cannot do without. When choosing a number, follow the local rules mentioned above, starting from 10,000 upwards. In addition, the same command on Linux is ss -tlnp , useful when troubleshooting Docker container port conflicts on NAS, I Docker article I mentioned that there are two sets of paths for the internal and external ports of the container. If there is a conflict, consider this layer first.

TCP's 443 and UDP's 443 are two different doors.

This is the most counter-intuitive point: TCP and UDP each manage their own port tables. TCP Gate 443 and UDP Gate 443 are two different rooms in the same building and cannot communicate with each other. You are port forwarding Or when configuring mapping in the backend of Mercury and Tenda, the "Protocol" drop-down menu selects TCP, UDP or ALL, which is essentially deciding which door to open. Choosing ALL does not mean ambiguity, but one for TCP and one for UDP, and the two rules are combined into one.

If you can't connect after configuration, in addition to checking the public network IP and other common problems, go back and check the agreement first. Game consoles are the most typical: PS5 online The official table is divided into two columns: TCP and UDP. TCP's 1935 and UDP's 3074 are two entries. You only switch the TCP door, and the UDP door is still closed. In the game, the yellow light should still be yellow. The same goes for the download tool for my NAS. BT’s tracking and node interoperability are mostly based on UDP. Only turning on TCP is half a leg lame.

Let’s go back to the complete answer to my cousin’s question.: Why does the external port need to fill in a high number like 13389? There is a dictionary for online crawlers to scan doors. Common numbers such as 22, 3389, and 8080 are in the first echelon and knock on the door one by one. If you move the external port up to 13,000, the dictionary will not hit it, and the knocking on the door will be reduced by a lot. I forwarded it on the NAS on the 22nd, and there were thousands of explosion records in the log for half a month. Later, I changed the high-level port and the world became much cleaner. The port is not a safe. The password should be 16 digits or 16 digits. It only counts if the two locks are locked together.

Is it safe to close all ports? Don’t worry about home use, just keep an eye on three places.

Some people may start to panic after seeing this: Is it dangerous to have so many doors open in my house? Quite the opposite. The NAT of your home router is naturally a gatekeeper that only blocks people in and out. If you haven’t taken the initiative to do the mapping, no one from the outside can knock on any door of your home. What you really need to keep an eye on are the three places that will open the door.:

There is a pre-action before mapping the device. Don’t skip it.: Give equipment first Bind a static IP . The house number is opened based on IP + port. After the device is restarted, the IP changes and the mapping is opened to someone else's house. This is the root cause of my first trip to the wrong house. I have written the mapping entrances for the two backends of Mercury and Tenda respectively. Mercury Edition and Tenda version , there are only four fields, just fill them in facing each other.

Give an order at the end: First remember the numbers that are commonly used at home (the table attached to the weak current box). If there is a conflict, use netstat to find out by PID. Choose a high number above 10,000 for your own service. For mapping, check the protocol first and then the internal and external ports. Finally, check the UPnP list every quarter. After listening to this, my cousin changed the external port to the last four digits of his birthday plus ten thousand - okay, the dictionary can't hit it anyway, so he can barely count as a graduate.