Wanted to know the meaning of source and destination port. (wireshark)

Question

On my package 1, under the info it says (source)54841 > 80(destination). May I know what are these terms mean and why these particular ports are being used. i know that for tcp, they uses 80 for destination port. but is there a particular reason? Thank you

Answer 1

In fact, there are two questions with two different answers.

Firstly, you have to be exact: The port definition is part of the Internet Proctocol (commonly called TCP/IP) application layer. The tcp protocol is a protocol of the underlying transport layer, so the definition / use of port 80 is not defined for tcp, but rather for the http application protocol (while the actual port usage takes place in the transport layer).

Regarding the destination port, you nearly gave the answer yourself: For well defined application protocols, there were defined well known ports. The list is maintained by IANA (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml). Usually, the ports were defined in the privileged low number range (up to 1024). When that range became too full, there were also higher port numbers assigned.

The reasoning behind the well defined port numbers is, that services can only listen on specific ports, and if the numbers were not known by convention, you had to memorize them along with the server adress. For your example, HTTP, that means, that if you start a request for http://www.example.com, your browser (or other software) knows that http usually uses port 80, connects to that port to get the html page. You can still run http servers on different ports (say, 12345), but than, the user had to enter http://www.example.com:12345 to reach the server. You can see that using well defined ports is helpful here.

For the source port, it is a completely different story. As transport layer connections usually use ports for multiplexing/demultiplexing on both source and destination, every connection must also have a source port. The lower port numbers can not be used for this purpose, as on one hand, they are often used for listening services, and on the other hand, their usage is privileged on some operating systems, so normal users cannot use them at all. For this reasons, IANA assigned the port range from 49152 to 65535 (2^15+2^14 to 2^(16−1)) for that purpose. Most operating systems will select one of this ports for outgoing connections source port. The selection is, however, short lived - when the connection is closed, the port is released, and the next connection can use an other port.