~/tutorials/012-what-a-port-is.md

012: What a port is

A machine has one address. Every service on it shares that address and gets a number. The number is the port, and a port scan is asking, one number at a time, who is home.

The list

nmap 127.0.0.1

Three ports open at the time of writing: 22, 80 and 443. Each line is one answer, and the last word of each line is the scanner's guess at what lives there. A guess, because the next command is how you check it.

The honest question

nmap -sV 127.0.0.1

-sV does not look, it asks. It connects and talks, and the service answers with its name and version. Look closely at the answers:

22/tcp  open  ssh      OpenSSH 9.6p1 Ubuntu 3ubuntu13 (Ubuntu Linux; protocol 2.0)
80/tcp  open  http     nginx 1.24.0 (Ubuntu)
443/tcp open  ssl/http nginx 1.24.0 (Ubuntu)

ssh on 22 is a convention, and conventions are where mistakes come from. Nothing stops a service from living on the wrong port, and saying ssh when the answer says OpenSSH is the scanner trusting a convention over the reply. The column that asked is the column to believe, and the habit transfers: names are claims, replies are data.

Both ports 80 and 443 claim nginx, which is the same software speaking two dialects, plain on 80 and TLS on 443. ssl/http is the scanner telling you it had to unwrap TLS to get the answer.

Where the answer comes from

Every answer here is a snapshot, taken from this host, and every script reply says so in its footer. The shell cannot execute anything, so it answers from data instead of probing. nmap on your own machine is live; this one is a photograph.

Try it

Each of these has one answer the shell gives you. Check yourself.

1. Run both scans and count the open ports each way. If the counts differ, read closer.
2. Which service, exactly, answers on 443? Version included.
3. nmap -sV 127.0.0.1 | grep nginx | wc -l. Then say what the number means before you trust it.
4. The word open is doing work in every line. Find the line where the service name and the truth disagree, if there is one.

Numbers go stale as the host changes. The command is the current truth.