Networks, addresses and ports

Every connection on a network needs two things: an address that says which device, and a port that says which program on it. By the end of this lesson you can find both on your own computer and read the error you get when one of them is wrong.

IP addresses: which device

An IP address is a device's number on a network. Data sent across a network is addressed to it, like a letter to a house.

There are two kinds in use:

Kind	Looks like	Notes
IPv4	192.168.1.20	Four numbers from 0 to 255, separated by dots. Still the one you type most often.
IPv6	2001:db8::20	Eight groups of hexadecimal digits separated by colons. :: stands for a run of zeros.

Most home networks run both at once. This track uses IPv4 in its examples because the addresses are shorter.

Addresses with a special meaning

Some addresses are reserved for particular jobs. These are worth knowing by heart:

Address	Meaning
127.0.0.1, ::1	Loopback: this device, talking to itself. The name localhost points here.
10.0.0.0 – 10.255.255.255	Private range
172.16.0.0 – 172.31.255.255	Private range
192.168.0.0 – 192.168.255.255	Private range, the one most home routers use
169.254.x.x, fe80::…	Link-local: a device gives itself one of these when nothing hands it an address. A 169.254 address on Wi-Fi usually means something went wrong.
0.0.0.0	When a program listens: "every address this device has". It is not an address you connect to.

Private addresses work only inside a local network. Thousands of homes use 192.168.1.20 at the same time without clashing, because those addresses never travel across the internet. A public address is unique on the whole internet; your router has one.

localhost is always "me"

localhost means "the device I am typing on". Typed into a phone's browser, it is the phone, not your computer. To reach your computer from the phone, use the computer's private address, such as 192.168.1.20.

Your home network

Here is a typical home network:

            Internet
               │
     public address 203.0.113.7
        ┌──────┴───────┐
        │    Router    │  192.168.1.1
        └──┬────┬────┬─┘
  Wi-Fi /  │    │    │
  cable    │    │    │
   ┌───────┴┐ ┌─┴─────┐ ┌┴─────────┐
   │ Laptop │ │ Phone │ │ Printer  │
   │ .1.20  │ │ .1.35 │ │ .1.50    │
   └────────┘ └───────┘ └──────────┘
        local network (LAN) 192.168.1.0/24

The devices that share your Wi-Fi or cables form a LAN (local area network). The router connects that LAN to the internet and does several jobs at once:

• DHCP: hands each device an address when it joins. Addresses are lent for a while, so a device can get a different one next week. For a computer you connect to often, set a DHCP reservation in the router's settings so it always gets the same address.
• NAT (network address translation): every device on the LAN shares the router's one public address. Replies to your requests find their way back, but a device out on the internet cannot start a connection to your laptop, because the router does not know which device it is for.
• Firewall: drops unexpected traffic from the internet.
• DNS forwarding: answers "what is the address of this name?" for the devices on the LAN.

192.168.1.0/24 describes the whole LAN. The /24 means the first three numbers (24 bits) are the same for every device, so the network runs from 192.168.1.0 to 192.168.1.255.

NAT explains a common surprise: your phone reaches your home computer on Wi-Fi, but not on mobile data. On mobile data, the phone is outside the router.

Good to know

Guest Wi-Fi networks and many café, hotel, school and office networks turn on client isolation: devices can reach the internet but not each other. Two devices on such a network cannot connect to each other, whatever you do on the devices themselves.

Ports: which program

One computer runs many programs that use the network. A port is a number from 1 to 65535 that says which program a connection is for. The address picks the building; the port picks the door.

A program that waits for connections listens on a port. That program is the server. The program that connects is the client, and it gets a random high port of its own for the reply.

Ports come in two flavours: TCP, for connections that must arrive complete and in order (web pages, SSH, file transfers), and UDP, for quick messages where speed matters more (DNS lookups, video calls, device discovery).

Port	Protocol	Used for
22	TCP	SSH, SFTP, scp
53	UDP and TCP	DNS
80	TCP	HTTP (unencrypted web)
443	TCP	HTTPS (encrypted web)
3389	TCP	Windows Remote Desktop
5353	UDP	mDNS (finding devices on the LAN)
5432	TCP	PostgreSQL
8080	TCP	A common choice for development web servers
4010	TCP	The Mock Studio Todo API sample in this site's labs

On Linux and Android, ports below 1024 are privileged: a normal program cannot listen on them without administrator rights. That is why development servers and tunnels use ports such as 8080 or 14010.

A port can only have one listener per address. If a program fails with "address already in use", something else is already listening on that port.

Listening on 127.0.0.1 or on 0.0.0.0

When a program listens, it also chooses which of the device's addresses to listen on. This one choice decides who can reach it.

Here is the same small web server, started twice on a Linux laptop. First on loopback only:

python3 -m http.server 4998 --bind 127.0.0.1

$ ss -tln 'sport = :4998'
State  Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0      5          127.0.0.1:4998      0.0.0.0:*

Then on every address:

python3 -m http.server 4997 --bind 0.0.0.0

$ ss -tln 'sport = :4997'
State  Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0      5            0.0.0.0:4997      0.0.0.0:*

Listening on	Who can connect
127.0.0.1 or ::1	Only programs on the same device
192.168.1.20	Devices that can reach that one address
0.0.0.0 or ::	Anything that can reach the device on any network, unless a firewall stops it

A Mock Studio server, for example, listens on all interfaces while it runs, which is why a phone on the same Wi-Fi can call it. See Share on LAN or the internet. The SysVitals Ports tab colours every all-interfaces row yellow so you can spot them; see Network connections and ports.

Names: DNS and mDNS

People remember names; networks need numbers. DNS (Domain Name System) turns a name such as server.example.com into an address such as 203.0.113.10. Your device asks the router, and the router asks DNS servers on the internet.

Some names never leave your device. localhost is written in a small file on the computer itself:

$ getent hosts localhost
::1             localhost

On a LAN there is often no DNS server that knows your devices' names. mDNS (multicast DNS) fills the gap: a device asks the whole LAN "who is maya-desktop.local?" and that device answers with its address. Names ending in .local use mDNS, on UDP port 5353. Ubuntu Desktop answers mDNS out of the box, and NearShare uses mDNS to find phones and PCs nearby; see NearShare troubleshooting.

Not every device can look up .local names. If one fails, use the IP address instead.

Firewalls

A firewall decides which incoming connections a device accepts. It can reject a connection, which tells the caller "no" straight away, or drop it, which says nothing, so the caller waits until it gives up.

On Windows, every network is either Private (home, work) or Public (cafés, airports). The first time a program tries to listen, Windows Defender Firewall asks whether to allow it, with a choice of private networks, public networks or both. Allow private networks only, unless you have a reason for more. You can see and change a network's type in Settings › Network & internet, in the network's properties.

On Ubuntu, the firewall tool is ufw. It is installed but turned off on a fresh desktop install. Check it with:

sudo ufw status

When it is on, it drops incoming connections unless a rule allows them. A rule that lets only your own LAN reach SSH looks like this:

sudo ufw allow from 192.168.1.0/24 to any port 22 proto tcp

See it for yourself

Find your computer's address on Linux:

$ hostname -I
192.168.1.20

$ ip -brief address
lo               UNKNOWN        127.0.0.1/8 ::1/128
wlp0s20f3        UP             192.168.1.20/24 fe80::…/64

lo is the loopback interface; wlp0s20f3 is the Wi-Fi card, and its /24 is the size of the LAN. To find the router:

$ ip route
default via 192.168.1.1 dev wlp0s20f3 proto dhcp src 192.168.1.20 metric 600
…

default via 192.168.1.1 is the router: anything not on the LAN goes there.

See what is listening (-t TCP, -l listening, -n numbers instead of names):

$ ss -tln
State  Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0      4096         0.0.0.0:22        0.0.0.0:*
LISTEN 0      4096       127.0.0.1:631       0.0.0.0:*
LISTEN 0      4096            [::]:22           [::]:*
…

This computer accepts SSH (port 22) from any network, and the printing service (631) only from itself. Add -p and run it with sudo to see which program owns each port, or open the SysVitals Ports tab.

On Windows, run ipconfig in a terminal and look for IPv4 Address under your Wi-Fi or Ethernet adapter. On Android, the address is in the details of the Wi-Fi network you are connected to, in Settings.

Test whether a web server answers with curl:

$ curl -sS http://127.0.0.1:4998/ -o /dev/null -w '%{http_code}\n'
200

When a connection fails, read the message

The error tells you how far the connection got. These come from ssh; browsers and other tools say the same things in their own words.

$ ssh maya@nosuchhost.invalid
ssh: Could not resolve hostname nosuchhost.invalid: Name or service not known

$ ssh -p 4999 maya@localhost
ssh: connect to host localhost port 4999: Connection refused

$ ssh -o ConnectTimeout=3 maya@192.0.2.1
ssh: connect to host 192.0.2.1 port 22: Connection timed out

Message	How far it got	Check
Could not resolve hostname	Not even started: the name has no address	Spelling; use the IP address; for .local, the device may not support mDNS
Connection refused	Reached the device, but nothing listens on that port, or a firewall rejected it	Is the server running? Right port?
Connection timed out	No answer at all	Right address? Device switched on? Same network, not guest Wi-Fi? Is a firewall dropping it?
No route to host	The device could not be found on the network	Address, cable or Wi-Fi

Recent versions of curl say Could not connect to server for a refused connection and Connection timed out for a timeout.

Stay safe

• Listen on 127.0.0.1 unless others need it. A development server, database or mock that listens on all interfaces is open to everyone on the same Wi-Fi.
• Mark café and hotel networks as Public on Windows, and say no when a program asks to listen on public networks.
• Do not open ports on your router to reach a home computer from outside. That puts it in front of the whole internet. Lesson 4 shows safer ways.
• Stop servers when you are done. A stopped server cannot be reached by anyone.

Check yourself

QuizNetworks, addresses and ports

Question 1 of 6

Your laptop runs a web server at http://localhost:8080. You type that same address into your phone's browser and nothing loads. Why?

Score: 0

What you learned

• An IP address picks the device; a port picks the program on it.
• 127.0.0.1 and localhost mean "this device"; 192.168.x.x, 10.x.x.x and 172.16–31.x.x are private LAN addresses.
• The router hands out addresses (DHCP) and hides the LAN behind one public address (NAT).
• A program listening on 0.0.0.0 can be reached from the network; on 127.0.0.1, only from the same device.
• "Refused" means you reached the device but nobody answered at that port; "timed out" means nothing answered at all.

Next steps

• SSH: sign in to another computer
• Network connections and ports in SysVitals
• Share on LAN or the internet in Mock Studio