What Is a TCP Port?

A TCP port is a number from 0 to 65535 carried in every TCP header that identifies which program on a device the data belongs to. The IP address gets a packet to the right device; the port gets it to the right service on that device. An IP address and a port together form a socket, and a TCP connection is defined by four values: the source address and port, and the destination address and port.

Servers listen on a fixed, published port so clients know where to find them. A SCADA server reading a PLC opens a connection to the PLC’s address on port 502, the Modbus TCP port. The client end uses a temporary port picked by its operating system, called an ephemeral port, which is how one computer can hold many connections to the same server at once.

UDP uses port numbers the same way, but TCP and UDP ports are separate sets. TCP port 2222 and UDP port 2222 are different endpoints, which is why port lists always state the transport. The bigger picture of addresses, layers and sockets is in our guide to the TCP/IP model.

The Internet Assigned Numbers Authority (IANA) keeps the official register of port numbers and splits the space into three ranges, set out in RFC 6335.

These are the default ports for the protocols most often found on machine and plant networks. Most devices let you change the port, so check the device configuration before writing a firewall rule.

EtherCAT and the real-time parts of PROFINET and IEC 61850 (GOOSE and sampled values) travel directly in Ethernet frames, so they have no port and are controlled with VLANs and switch settings instead of port rules. More on the register-based protocol behind port 502 is in our explainer on Modbus.

Port numbers are how a firewall between the business network and the plant decides what may pass. The usual approach, set out in IEC 62443 as zones and conduits, is to deny everything by default and then allow only named protocols, on their ports, between named devices: for example, TCP 4840 from one historian to one OPC UA server, and nothing else. Our comparison of IT and OT networks explains why the two sides are kept apart.

Inside the plant, close what you do not use. Many switches, HMIs and computers ship with Telnet (23), HTTP (80) or FTP (21) turned on, and these send passwords in clear text. Use SSH and HTTPS instead, and restrict management ports to a management VLAN. A port number on its own is not security: Modbus TCP on port 502 has no authentication, so anyone who can reach the port can write to the device.

A gateway or edge computer often uses ports in both directions at once. On the machine side it acts as a client, opening connections to PLCs on port 502 or 44818. On the business side it may act as a server, offering OPC UA on 4840 to a historian, or as a client again, publishing to an MQTT broker on 8883. Where possible, have the device open connections outwards rather than listen for them: an outbound MQTT or OPC UA connection needs no inbound port opened on the plant firewall, which removes one of the most common routes into an OT network. Our industrial IoT gateways sit at exactly this boundary.

On a computer, ss -tulpn on Linux and netstat -ano or Get-NetTCPConnection on Windows list listening ports and the programs behind them. On a switch or gateway, the management interface usually shows which services are enabled. Take care with network scanners on a live plant: aggressive scans have been known to stall older PLCs and controllers, so scan during planned downtime or use passive monitoring. Our managed industrial switches let you turn off unused management services and limit access to management addresses.

We supply industrial computers, IIoT gateways and managed switches with unused services closed and the protocol ports your system needs opened as standard, ready to drop into your firewall plan.