Addressing Across Layers

TCP/IP uses four distinct address types, one per relevant layer: (1) Physical/MAC address - 48-bit (6-byte), at the Data Link layer, e.g., 00:1A:2B:3C:4D:5E, used for node-to-node delivery on a LAN. (2) Logical/IP address - 32-bit (IPv4) or 128-bit (IPv6), at the Network layer, for host-to-host delivery across networks. (3) Port address - 16-bit (0-65535), at the Transport layer, identifies the specific process/application. (4) Specific/Application address - e.g., email addresses or URLs, at the Application layer, human-friendly. Memory aid (bottom-up): MAC -> IP -> Port -> Name, mirroring Physical -> Network -> Transport -> Application.

MAC address: 48 bits, globally unique (assigned by manufacturer OUI), flat addressing, changes hop-by-hop in a packet's journey (rewritten by each router). IP address: 32 bits (IPv4) / 128 bits (IPv6), hierarchical, generally constant end-to-end (except with NAT). Port number: 16 bits; well-known ports 0-1023, registered 1024-49151, dynamic/ephemeral 49152-65535. Key exam insight: during routing, the source/destination IP addresses remain unchanged across hops, but the source/destination MAC addresses are rewritten at every router. The combination of IP address + Port + protocol forms a socket, the endpoint of a connection.

Every time your browser opens a webpage, every time an SSH client reaches a remote server, every time your mail app picks up a new message — a small unsigned 16-bit number is at the centre of the action. That number is the port number. For GATE CSE, a handful of these numbers are practically free marks if memorised cleanly.

Definition: A port number is a 16-bit unsigned integer (0 to 65535) used by the transport layer (TCP or UDP) to identify a specific application or service on a host. Together with an IP address, it forms a socket.

Definition: A well-known port is one in the range 0–1023 that is reserved by IANA for standard services (HTTP, SSH, DNS, etc.). On Unix-like systems, binding to a well-known port traditionally requires root / privileged access.

The list you must memorise

GATE has historically asked the actual port numbers in MCQ form. Drill these until they are automatic:

Service	Port	Transport
FTP — Data	20	TCP
FTP — Control	21	TCP
SSH	22	TCP
TELNET	23	TCP
SMTP	25	TCP
DNS	53	UDP (queries) + TCP (zone transfers / large)
DHCP — Server	67	UDP
DHCP — Client	68	UDP
HTTP	80	TCP
POP3	110	TCP
IMAP	143	TCP
SNMP	161	UDP
HTTPS	443	TCP / TLS

Useful groupings to fix the table in memory

Trying to memorise thirteen random numbers is hard. Trying to memorise three clusters of three is easy.

• Remote access cluster: SSH 22, TELNET 23. (One letter and one number apart — easy.)
• Email cluster: SMTP 25 (send), POP3 110 (pull, deletes from server), IMAP 143 (sync, keeps on server).
• Web cluster: HTTP 80, HTTPS 443.
• FTP pair: 20 (data channel) and 21 (control channel). Mnemonic: "control is the boss → control gets the higher number 21."
• DHCP pair: 67 (server) and 68 (client). Mnemonic: alphabetical — Client is later in the alphabet than the server but has the higher number. Or: the server is the gatekeeper sitting on the lower port.
• Management: DNS 53, SNMP 161 — both UDP-leaning, both odd numbers.

Port number ranges

IANA splits the full 0–65535 range into three tiers:

• Well-known ports: 0–1023. Reserved for standard server services. Require privilege to bind on Linux/Unix.
• Registered ports: 1024–49151. Assigned by IANA to specific applications by request (e.g., 3306 for MySQL, 5432 for PostgreSQL, 8080 for HTTP-alt).
• Dynamic / private / ephemeral ports: 49152–65535. Used by client-side TCP/UDP for outgoing connections.

GATE has asked the size of each range. The well-known range is 2^10 = 1024 ports, and the dynamic range is 16,384 ports.

Sockets and the 5-tuple

A socket is the combination (IP address, port number). It uniquely identifies a communication endpoint on the network. So if a server is running at IP 10.0.0.5 listening on port 80, the socket is 10.0.0.5:80.

A TCP connection is uniquely identified by a 5-tuple:

(Source IP, Source Port, Destination IP, Destination Port, Protocol)

This is why a single web server on port 80 can handle thousands of simultaneous client connections — each client's source IP and source ephemeral port differ, so each 5-tuple is unique even though the server's IP, port, and protocol are constant.

A common GATE trick: "How many simultaneous TCP connections can a server hold on a single port?" Answer: in theory bounded only by the space of (source IP, source port) combinations and OS resources — not by the server's port count. Each connection is a different 5-tuple.

Worked example: identifying the service from a port

Question: A packet capture shows a TCP segment with destination port 25 travelling from a workstation to a mail relay. Which application-layer protocol is in use, and what is the workstation most likely doing?

Solution:

Step 1: Look up port 25 in the well-known list. Port 25 corresponds to SMTP (Simple Mail Transfer Protocol).

Step 2: SMTP is the protocol used to send outgoing email or to relay mail between mail servers.

Step 3: Because the workstation is the source and the mail relay is the destination on port 25, this is an outgoing-mail submission/relay.

Conclusion: The workstation is using SMTP (port 25) to send mail to the relay.

A useful sanity check: incoming mail to the user's mailbox is fetched via POP3 (110) or IMAP (143). If you see those ports, the direction is reversed.

Why it matters: The GATE CSE syllabus on Computer Networks reliably asks at least one direct port-number identification MCQ each year, often as a "match the following" between services and ports, or as part of a larger packet-capture/firewall-rule question. These are the most efficient marks per minute of preparation in the entire networks section.

Real-world example: When you configure a corporate firewall in India (whether at a TCS data centre or a CBI cybercrime unit), you write rules that allow outbound TCP to port 443 (HTTPS) for general web access while blocking port 23 (TELNET) because it is plaintext and dangerous. You also generally close inbound port 22 (SSH) from the public internet and expose it only through a bastion host. Every one of those rules is the well-known-ports list at work.

Common misconception: A frequent error is to claim "HTTPS uses port 80 with SSL". HTTPS uses port 443, not 80. Port 80 is plain HTTP. Confusing the two is a guaranteed mark-loss.

A second slip is to think DNS is purely UDP. DNS uses UDP/53 for normal queries because they are small and need to be fast, but it switches to TCP/53 for zone transfers and for responses larger than 512 bytes (or 4096 bytes with EDNS). GATE has asked this exact nuance.

A third trap is to flip the FTP ports: data on 20, control on 21. The control channel carries commands like USER, PASS, RETR; the data channel actually moves the file bytes. Many candidates remember "21 for FTP" and forget there are two ports.

A fourth trap is mixing the DHCP server (67) and client (68). The server listens on the lower number; clients send their broadcast DISCOVER messages from port 68 to port 67 on the broadcast address 255.255.255.255.

Cover the answer, recall, then check. 11 cards on addressing across the layers for GATE CSE.

Q1. State size and layer of MAC, IPv4, port and IPv6 addresses.
A1. MAC = 48-bit (Data Link); IPv4 = 32-bit (Network); Port = 16-bit (Transport); IPv6 = 128-bit (Network).

Q2. Why is a MAC address called "flat" and an IP address "hierarchical"?
A2. MAC has no location structure (just OUI + serial) so it can't be aggregated for routing. IP splits into network + host, enabling route aggregation.

Q3. What are the ranges of well-known, registered and dynamic ports?
A3. Well-known 0–1023, registered 1024–49151, dynamic/ephemeral 49152–65535. Total 16-bit space = 0–65535.

Q4. What is the broadcast MAC address?
A4. FF:FF:FF:FF:FF:FF — all 48 bits 1. A frame with this destination is delivered to every station in the LAN/broadcast domain.

Q5. How is a MAC address structured?
A5. 6 bytes: first 24 bits = OUI (vendor, assigned by IEEE), last 24 bits = NIC-specific serial. Bit-level: I/G bit (LSB of first byte) and U/L bit.

Q6. What do the I/G and U/L bits of a MAC address mean?
A6. I/G (Individual/Group) bit: 0 = unicast, 1 = multicast. U/L (Universal/Local) bit: 0 = globally unique (OUI), 1 = locally administered.

Q7. Which protocol resolves each mapping: name→IP, IP→MAC, MAC→IP?
A7. name→IP = DNS; IP→MAC = ARP; MAC→IP historically = RARP, now DHCP (which also gives IP by MAC).

Q8. Why do we need both IP and MAC addresses?
A8. IP gives global, hierarchical, routable identity (end-to-end). MAC gives local, hardware delivery on a single link (hop-by-hop). Each hop uses ARP to map next-hop IP → MAC.

Q9. What is a "specific/application" address? Give examples.
A9. A human-friendly identifier at the Application layer: email address (user@host), URL, hostname. Resolved down to IP/port for actual delivery.

Q10. During a multi-hop transfer, which addresses change and which stay?
A10. Source/destination IP stay end-to-end (barring NAT). Source/destination MAC are rewritten at every router to next-hop values. Ports stay end-to-end.

Q11. How many bits identify a socket end-to-end in IPv4/TCP?
A11. A socket = IP (32) + port (16) = 48 bits per endpoint. A TCP connection is identified by the 4-tuple (src IP, src port, dst IP, dst port) = 96 bits.

Worked Example

Problem: A packet is sent from host A to host B through one intermediate router R. At the network (IP), link (MAC), and transport (port) layers, state which addresses stay constant end-to-end and which change at each hop.

Solution:
Trace the addresses used on each hop (A → R, then R → B):

Network layer (IP addresses): the source IP (A) and destination IP (B) identify the ultimate endpoints and remain unchanged on every hop from A to B. (Unless NAT intervenes, IP addresses are end-to-end constant.)

Link layer (MAC addresses): these give node-to-node delivery on a single physical link, so they are rewritten at each hop:

• Hop A → R: source MAC = A's MAC, destination MAC = R's (incoming) MAC.
• Hop R → B: source MAC = R's (outgoing) MAC, destination MAC = B's MAC.
  The router uses ARP to find the next hop's MAC.

Transport layer (port numbers): source and destination ports identify the communicating processes and stay constant end-to-end (the router does not inspect or change them).

Answer: IP addresses and port numbers remain constant end-to-end (A↔B), while MAC (link-layer) addresses change on every hop.