6.1 Transport Layer Services & Port Addressing Architecture

Back to Computer Networks Notes

📚Module 06: Transport Layer: UDP, TCP & Connection FlowTopic 6.1⏱️22 min read

🎯High-Yield For:Semester Exams (All Universities) • Placement Technical Rounds • Engineering Foundations

💡 Core Intuition: The Corporate High-Rise Mailroom

🍳 The Everyday Analogy: Street Address vs Office Suite

Imagine a postal carrier delivering mail to a sprawling 50-story commercial office building:

• The Street Address (100 Tech Boulevard): Represents the Network Layer (IP Address). It uniquely identifies the physical building on the globe, ensuring the postal truck routes the mail to the correct loading dock.
• The Floor & Suite Number (Suite 402 - Legal Department): Represents the Transport Layer (Port Number). The mail carrier does not just drop packages on the sidewalk; the building's internal mailroom sorting clerk examines the suite number on the envelope and places it into the exact mail slot of the specific department.
• The Individual Recipient: Represents the running Operating System Process (Application Socket) listening inside that office.

💻 Bridging to Computer Science: Bridging Host Routing to Application Sockets

Without the suite number, a delivery truck could find the building, but hundreds of corporate offices inside would never receive their letters. Similarly, in operating systems, an IP address delivers packets to the host machine, but the port number delivers the data to the specific application process running inside that machine! The transport layer acts as the kernel's internal mailroom sorter.

---

📑Table of Contents

• 🏗️ The Architectural Hierarchy: Three Levels of Delivery
  • 1. Hop-to-Hop (Node-to-Node) Delivery
  • 2. Host-to-Host Delivery
  • 3. Process-to-Process Delivery (End-to-End)
• 🔀 Transport Multiplexing and Demultiplexing
  • 1. Multiplexing at the Sender Site
  • 2. Demultiplexing at the Receiver Site
• 🔢 Port Number Architecture & IANA Ranges
  • 1. Well-Known Ports (0 - 1023)
  • 2. Registered Ports (1024 - 49,151)
  • 3. Dynamic / Ephemeral Ports (49,152 - 65,535)
• 🔌 Socket Addressing Architecture
  • The Complete Connection 5-Tuple
• ⚖️ Service Models: Connectionless vs Connection-Oriented
• 🏭 Real-World Production Context: Linux Kernel Socket Inspection & Port Allocation
  • Breakdown of Socket Fields:
• 📐 Numerical Applications & Worked Examples
  • Example 1: Application Layer Payload Passing Constraints
  • Example 2: Sequence Number Allocation Granularity
  • Example 3: Multi-Network MTU Fragmentation and Header Overhead
• 🎯 Exam & Interview Pitfall Check

---

🏗️ The Architectural Hierarchy: Three Levels of Delivery

Computer networks operate three fundamentally distinct tiers of data delivery across the protocol stack:

Architecture Flow

The Three Levels of Network Delivery Hierarchy

End-to-end scope across Data Link, Network, and Transport protocol layers

🔗Level 1

Hop-to-Hop Delivery (L2)

Data Link Layer / 48-bit MAC addresses transport frames between adjacent physical nodes.

→

Hardware Medium

🌐Level 2

Host-to-Host Delivery (L3)

Network Layer / 32-bit IP addresses route datagrams across autonomous networks.

→

OS Kernel Boundary

🎯Level 3

Process-to-Process Delivery (L4)

Transport Layer / 16-bit Port numbers deliver segments directly to running application sockets.

1. Hop-to-Hop (Node-to-Node) Delivery

• Operated by: Data Link Layer (Layer 2).
• Identifier: 48-bit MAC Addresses (00:1A:2B:3C:4D:5E).
• Scope: Moves a frame across a single physical medium between two directly connected interfaces (e.g., Host $\to$ Router, or Router $\to$ Router). The MAC addresses mutate at every intermediate hop.

2. Host-to-Host Delivery

• Operated by: Network Layer (Layer 3).
• Identifier: 32-bit IPv4 or 128-bit IPv6 Addresses (198.51.100.14).
• Scope: Routes packets end-to-end across interconnected autonomous systems. However, an operating system is a multitasking environment executing dozens of concurrent network processes (web browser, Spotify, SSH client, Zoom). The Network Layer simply delivers the packet to the destination operating system kernel and stops there.

3. Process-to-Process Delivery (End-to-End)

• Operated by: Transport Layer (Layer 4).
• Identifier: 16-bit Port Numbers (80, 443, 53, 52144).
• Scope: Guarantees that the bytes received by the operating system kernel are dispatched to the exact process thread that initiated or requested the communication.

---

🔀 Transport Multiplexing and Demultiplexing

An end host typically possesses only one or two physical network interface cards (NICs) with a single IP address, yet runs hundreds of concurrent network threads. The transport layer bridges this gap through multiplexing at the sender and demultiplexing at the receiver.

Process-to-Network Transport Multiplexing & Demultiplexing

Hierarchical abstraction from application sockets down to physical IP datagram transit

Layer 7 / 5

Application Layer (Processes & Sockets)

🌐

User-space processes generate discrete application payloads (HTTP requests, DNS queries, SSH sessions).

Web Browser (Port 51234)DNS Resolver (Port 49811)SSH Terminal (Port 58210)Web Server (Port 80)

↓Application Payload Bytes passing to Sockets

Layer 4

Transport Layer (Multiplexing / Demultiplexing Engine)

🔀

Aggregates streams, appends 16-bit Source/Destination Port headers, and performs socket demultiplexing.

TCP Demux: 4-Tuple (Src IP, Src Port, Dst IP, Dst Port)UDP Demux: 2-Tuple (Dst Port) Direct Delivery

↓Transport Segments / Datagrams passing to IP

Layer 3

Network Layer (Host-to-Host Delivery)

🌍

Encapsulates transport segments into IP datagrams with Source and Destination IP addresses for global routing.

IPv4 / IPv6 Routing EngineAutonomous System Packet Forwarding

1. Multiplexing at the Sender Site

When multiple user-space processes concurrently transmit data:

1. The transport layer collects payload bytes from each application socket.
2. It encapsulates each chunk inside a transport segment, stamping:
   • Source Port Number: The ephemeral port assigned to the originating process.
   • Destination Port Number: The well-known or registered port of the target service.
3. It hands the assembled transport segment down to Layer 3 (IP), which attaches the IP header and dispatches it over the physical wire.

2. Demultiplexing at the Receiver Site

When an IP datagram arrives at the destination host's NIC:

1. The Network Layer strips the IP header and passes the transport segment payload up to the Transport Layer.
2. The Transport Layer inspects the port fields within the transport header to determine which application socket must receive the data:
   • Connectionless (UDP) Demultiplexing: The destination socket is identified primarily by the Destination Port Number (along with destination IP). Two UDP datagrams arriving from different source IP addresses or different source ports directed to the same destination port (e.g., 53) are delivered to the exact same UDP socket.
   • Connection-Oriented (TCP) Demultiplexing: A TCP socket is identified by a full 4-tuple: $\text{TCP Socket Identifier} = \Big( \text{Source IP}, \; \text{Source Port}, \; \text{Destination IP}, \; \text{Destination Port} \Big)$ If Host A and Host B both connect to an Nginx web server on Port 80, the server kernel creates two distinct connected socket descriptors, routing each segment to its dedicated socket thread based on the 4-tuple!

---

🔢 Port Number Architecture & IANA Ranges

Port numbers are unsigned 16-bit integers, providing a total addressing space of: $\text{Total Port Range} = 2^{16} = 65,536 \text{ ports } (0 \text{ through } 65,535)$

The Internet Assigned Numbers Authority (IANA) and ICANN categorize this 16-bit universe into three standardized functional tiers:

Port Tier	Numerical Range	Governing Authority	Primary Function & Usage
Well-Known Ports	$0 \text{ to } 1023$	Assigned & strictly controlled by IANA	Standard internet server daemons (e.g., HTTP, SSH, DNS). Privileged root access required on Unix systems.
Registered Ports	$1024 \text{ to } 49,151$	Registered with IANA to avoid conflicts	Third-party server applications, databases, and enterprise services (e.g., MySQL, Redis). Non-privileged users can bind.
Dynamic / Ephemeral Ports	$49,152 \text{ to } 65,535$	Neither controlled nor registered	Short-lived, randomly allocated client-side outbound connections assigned dynamically by the OS kernel.

1. Well-Known Ports ($0 - 1023$)

These universal port numbers are permanently allocated to standard system services. Because client processes initiate contact without prior coordination, the server's listening port must be fixed and globally known:

• TCP Port 20 / 21: FTP (File Transfer Protocol - Data / Control)
• TCP Port 22: SSH (Secure Shell) & SFTP
• TCP Port 23: Telnet (Unencrypted remote terminal)
• TCP Port 25: SMTP (Simple Mail Transfer Protocol - Mail relay)
• UDP/TCP Port 53: DNS (Domain Name System)
• UDP Port 67 / 68: DHCP (Dynamic Host Configuration Protocol - Server / Client)
• UDP Port 69: TFTP (Trivial File Transfer Protocol)
• TCP Port 80: HTTP (Hypertext Transfer Protocol)
• TCP Port 110: POP3 (Post Office Protocol v3)
• UDP Port 123: NTP (Network Time Protocol)
• TCP Port 143: IMAP4 (Internet Message Access Protocol)
• UDP Port 161 / 162: SNMP (Simple Network Management Protocol)
• TCP Port 443: HTTPS (HTTP over TLS/SSL)

Security Invariant: Privileged Ports

In Unix-like operating systems (Linux, macOS, BSD), binding to a well-known port ($< 1024$) requires administrative superuser privileges (CAP_NET_BIND_SERVICE or root). This prevents unprivileged malicious users on a shared multi-user server from spoofing legitimate services like SSH or HTTP.

2. Registered Ports ($1024 - 49,151$)

Companies and open-source developers register these port numbers with IANA to avoid conflicts when deploying common server software:

• TCP 1433: Microsoft SQL Server
• TCP 1521: Oracle Database
• TCP 3306: MySQL Database
• TCP 5432: PostgreSQL Database
• TCP 6379: Redis In-Memory Data Store
• TCP 8080 / 8443: Alternative HTTP / HTTPS (Development & Tomcat)
• TCP 27017: MongoDB Server

3. Dynamic / Ephemeral Ports ($49,152 - 65,535$)

• The term ephemeral derives from the Greek word ephemeros, meaning "lasting only a single day" or "short-lived".
• When your web browser initiates an outbound connection to a server at 142.250.190.46:443, your local operating system kernel dynamically assigns an unused ephemeral port (such as 54321) to your browser tab.
• As soon as the browser tab closes and the connection terminates, the port is recycled after the TIME_WAIT period expires.

Linux Kernel Tuning Note

While IANA specifies $49,152 - 65,535$ as the ephemeral range, many modern Linux distributions expand the ephemeral allocation pool to $32,768 - 60,999$ by default. You can inspect or tune this on any Linux server via:

sysctl net.ipv4.ip_local_port_range
# Output: net.ipv4.ip_local_port_range = 32768 60999

---

🔌 Socket Addressing Architecture

A single port number is meaningless without an associated host. A Socket Address represents the concrete software endpoint of a communication channel:

$\textbf{Socket Address} = \Big( \text{IP Address} \; : \; \text{Port Number} \Big)$

For instance, if a server possesses IP 198.51.100.25 and hosts an HTTPS server on port 443, its socket address is 198.51.100.25:443.

The Complete Connection 5-Tuple

To uniquely differentiate every active network conversation across the entire global internet, the operating system kernel maintains a state table keyed by the Connection 5-Tuple:

$\text{Session 5-Tuple} = \Big\{ \text{Source IP}, \; \text{Source Port}, \; \text{Destination IP}, \; \text{Destination Port}, \; \text{Protocol (TCP/UDP)} \Big\}$

The Live Connection 5-Tuple Invariant

$\textbf{Client Socket: } 203.0.113.10 : 52140 \quad \longleftrightarrow \quad \textbf{Server Socket: } 198.51.100.25 : 443 \quad \Big( \textbf{Protocol: TCP [6]} \Big)$

Because of the 5-tuple abstraction:

1. A web server listening on port 80 can simultaneously service tens of thousands of concurrent client connections, as long as each client originates from a unique (Client IP, Client Port) pair!
2. A single client can open multiple parallel connections to the exact same server IP and port (e.g., downloading multiple images on a web page), because the client kernel assigns a distinct ephemeral port to each parallel socket.

---

⚖️ Service Models: Connectionless vs Connection-Oriented

Transport layer protocols are broadly divided into two architectural paradigms based on how state is maintained between endpoints:

---

🏭 Real-World Production Context: Linux Kernel Socket Inspection & Port Allocation

To inspect the live socket table, listening ports, and active 5-tuples on any production Linux machine, systems engineers use ss (Socket Statistics) or lsof:

# List all listening TCP and UDP sockets with numeric ports and owning processes
ss -tulnp

Netid  State   Recv-Q  Send-Q     Local Address:Port       Peer Address:Port   Process
udp    UNCONN  0       0                0.0.0.0:53              0.0.0.0:*       users:(("named",pid=1024,fd=512))
udp    UNCONN  0       0                0.0.0.0:68              0.0.0.0:*       users:(("dhclient",pid=789,fd=6))
tcp    LISTEN  0       128              0.0.0.0:22              0.0.0.0:*       users:(("sshd",pid=1120,fd=3))
tcp    LISTEN  0       511              0.0.0.0:80              0.0.0.0:*       users:(("nginx",pid=1450,fd=6))
tcp    ESTAB   0       0         192.168.1.15:52144      140.82.112.4:443      users:(("chrome",pid=3842,fd=48))

Breakdown of Socket Fields:

• Local Address:Port: The local IP and port binding. 0.0.0.0:80 means Nginx is listening on port 80 across all network interfaces attached to the machine.
• Peer Address:Port: The remote socket endpoint. For listening sockets, this is 0.0.0.0:* (accepts connections from any remote endpoint). For established sockets (ESTAB), this reflects the remote server's exact socket 140.82.112.4:443.
• Recv-Q / Send-Q: For established sockets, indicates bytes queued in the kernel buffer waiting to be read by the application or transmitted over the wire.

---

📐 Numerical Applications & Worked Examples

Example 1: Application Layer Payload Passing Constraints

Problem Statement:
What is the theoretical and architectural maximum size of application data that a user-space application can pass to the transport layer (TCP) for network transmission?

Step-by-Step Solution:

1. Analyze Transport Layer Service Abstraction: TCP provides an unbroken byte-stream service to the application layer. The application layer program does not interact with discrete packet or datagram boundaries; it writes continuous bytes into a stream via system calls like write() or send().
2. Buffer Segmentation Mechanics: When an application process passes a massive data payload (such as a multi-gigabyte stream) to TCP, the transport layer places those bytes into the socket send buffer in kernel memory. TCP then autonomously slices the data stream into manageable chunks called Maximum Segment Size (MSS) (typically $1460\text{ bytes}$ for standard Ethernet) and encapsulates each chunk inside individual TCP segments.
3. Conclusion: The application layer is never restricted to the size of a single IP datagram ($65,535\text{ bytes}$) or Ethernet MTU ($1500\text{ bytes}$). An application can pass an arbitrary payload size ("any size") to the TCP layer.

---

Example 2: Sequence Number Allocation Granularity

Problem Statement:
In TCP, what fundamental unit of data is assigned a unique sequence number, and why does this differ from data link layer framing?

Step-by-Step Solution:

1. Byte-Oriented Numbering: TCP treats application data as an unformatted, continuous stream of octets (bytes). Unlike Data Link Layer protocols (such as HDLC or Go-Back-N) which assign sequence numbers to entire frames ($0, 1, 2, 3\dots$), TCP's sequence number field tracks individual bytes of data.
2. Sequential Mapping: If a segment carries $1000\text{ bytes}$ of data and its sequence number is $5001$, the bytes inside that segment are sequentially numbered from $5001$ to $6000$. The subsequent segment will carry sequence number $6001$.
3. Conclusion: In TCP, a unique sequence number is assigned to each byte.

---

Example 3: Multi-Network MTU Fragmentation and Header Overhead

Problem Statement:
A transport layer message consisting of $2100\text{ bytes}$ is passed to the IP layer for delivery across two networks:

• The first network can carry a maximum payload of $1200\text{ bytes}$ per frame (excluding network overhead).
• The second network can carry a maximum payload of $400\text{ bytes}$ per frame (excluding network overhead).
• Assume that the IP header overhead per packet is $20\text{ bytes}$. Compute the total accumulated IP header overhead in the second network for this transmission.

Step-by-Step Solution:

1. Determine Payload in Network 1:
   Total data payload $= 2100\text{ bytes}$.
   First network maximum payload capacity $= 1200\text{ bytes}$ per frame (divisible by $8$: $1200 / 8 = 150$).
   • Fragment 1 data payload $= 1200\text{ bytes}$.
   • Fragment 2 data payload $= 2100 - 1200 = 900\text{ bytes}$.
2. Fragmentation in Network 2:
   Both fragments must traverse Network 2, which has a maximum frame payload capacity of $400\text{ bytes}$ (divisible by $8$: $400 / 8 = 50$).
   • Fragmenting Fragment 1 ($1200\text{ bytes}$):
     $\frac{1200\text{ bytes}}{400\text{ bytes/frame}} = 3\text{ frames}$
   • Fragmenting Fragment 2 ($900\text{ bytes}$):
     $\lceil 900 / 400 \rceil = 2\text{ frames of } 400\text{ bytes} + 1\text{ frame of } 100\text{ bytes} = 3\text{ frames}$
3. Calculate Total IP Overhead in Network 2:
   Total frames traversing Network 2 $= 3 + 3 = 6\text{ frames}$.
   Each frame carries a $20\text{ byte}$ IP header.
   $\text{Total IP Overhead} = 6 \times 20\text{ bytes} = \mathbf{120\text{ bytes}}$

---

🎯 Exam & Interview Pitfall Check

Core Conceptual Questions

• Why can't two applications share the exact same port on the same IP interface?
  The operating system kernel uses the destination port to demultiplex incoming transport segments. If two unrelated processes listened on the exact same port without special kernel flags (like SO_REUSEPORT), the kernel would have an ambiguous routing path and would not know which process to wake up.
• Does a client application have to use an ephemeral port?
  No, a client can theoretically bind to a specific local port before calling connect(), but this is strongly discouraged in practice because if that specific port is already in use by another local application, the connection attempt will fail immediately.

Common Interview Traps

• Trap: Assuming TCP sequence numbers count segments rather than bytes.
  Debunked: Unlike Data Link Layer protocols (like Go-Back-N) which number packets $0, 1, 2, 3\dots$, TCP sequence numbers count individual bytes. A segment carrying $1460$ bytes consumes $1460$ sequence numbers.
• Trap: Believing port numbers are visible to Layer 3 routers.
  Debunked: Standard Layer 3 routers only inspect the IP header (Source/Destination IP and TTL). Port numbers reside within the transport layer payload and are invisible to routers (except stateful firewalls and NAT middleboxes).

---

🗺️View Complete Computer Networks Roadmap & Syllabus

← Previous Topic5.6 Address Resolution Protocol (ARP) & Reverse ARP (RARP)Next Topic →6.2 User Datagram Protocol (UDP): Header Format & Lightweight Delivery