Ports, SSH, HTTP, HTTPS and FTP

The concept

IP routes packets to an interface; a transport protocol and port help deliver data to the appropriate application. Ports range from 0 to 65535. TCP and UDP have separate port spaces. A TCP flow is identified by source IP, source port, destination IP, destination port and transport protocol. A web client normally chooses a temporary source port; the destination is commonly 443. TCP supplies an ordered byte stream with retransmission and flow control. UDP supplies datagrams without that reliability contract; applications can add reliability themselves. HTTP/1.1 and HTTP/2 commonly use TCP, while HTTP/3 uses QUIC over UDP.

SFTP is not FTP with a different port. FTPS is FTP protected with TLS; passive FTP needs an additional negotiated data-port range. Prefer SFTP for simple encrypted server file transfers.

Lab: inspect an HTTP conversation

curl -I https://example.com
curl -v https://example.com -o /dev/null
sudo ss -lntp
ss -tan

1. Find the response status, content type and server certificate verification in the output.
2. Locate listening sockets. 127.0.0.1:8000 accepts local traffic; 0.0.0.0:8000 listens on all IPv4 interfaces.
3. Compare the listening destination port with an established connection's client source port.

Connection sequence

DNS resolves a name. A TCP client sends SYN; the server answers SYN-ACK; the client sends ACK. With HTTPS, TLS then authenticates the server certificate and establishes encryption keys before the HTTP request. Encryption protects transport; it does not make an insecure application trustworthy.

Troubleshooting and lab boundary

Connection refused commonly means no listener or an active reject. Timeout commonly suggests a routing or filtering problem. A TLS name mismatch means the certificate does not match the hostname. Opening a security-group port cannot start the service; starting the service cannot add the firewall rule. Run these diagnostics only against your own lab or permitted targets.

Check yourself

If the server listens on 8080, will opening 80 make it work? No. The browser URL, service listener and firewall must agree, or a proxy must forward 80 to 8080.

Official reference

curl manual

Interview and revision check

Why can ping work while HTTPS fails?

ICMP and HTTPS use different traffic paths/rules. The HTTPS listener, TCP/UDP port rules, TLS configuration or application may still fail.