Why TCP/UDP Port Numbers Have Gaps and Strange Origins Explained

Every internet connection uses a 16-bit port number ranging from 0 to 65535, a ceiling set by the mathematical limit of 16-bit fields in TCP and UDP headers. IANA divides this range into three tiers: well-known ports (0–1023), registered ports (1024–49151), and dynamic ports (49152–65535), as defined in RFC 6335. The restriction preventing non-root processes from binding to ports below 1024 dates back to 4.1c BSD Unix and was originally designed to support primitive authentication in protocols like rlogin, not to protect services broadly. Some of the oldest assigned ports, such as Echo (7), Discard (9), Daytime (13), and Chargen (19), were useful diagnostic tools in the 1980s but are now largely disabled because their UDP versions can be exploited for DDoS amplification attacks. Port 0, while technically valid in the header format, is used by operating systems as a signal to self-assign an ephemeral port, and also appears in network scanning traffic because certain systems respond to it in ways that reveal OS information.