A socket is nothing more magical than a logical address on a computer system. By convention, sockets are typically associated with a specific process, daemon, service or program running on a specific host.

When you combine the IP address of the host or client with the port number, you end up with the socket. The socket is a link to a process running on a particular host on a network.


Example:

Port #21 is (by convention) associated with 
              FTP, or File Transfer Protocol.


The particular computer on a network is identified by its IP address:

  10.10.28.234


Combine the two together, you get:

  10.10.28.234:21

This is the socket, or the exact process on a particular computer.

When you go surfing the Internet, you are typically using port #80. When you combine your computer's IP address with the port number, when the results of your click come back from the web server, it is addressed directly to you (your computer IP address) and it comes in on a particular port associated with web pages (#80). You don't add the :80 to the end of your requested page, it is done automagically when you hit the enter key or click a link.

Some of the more well-known ports are:


PORT #       PROCESS
-------------------------------
  7          Echo (think of the PING command)
 17          QOTD (Quote of the Day)
 21          FTP (Control, data flows on port 20)
 23          Telnet
 25          SMTP (Simple Mail Transport Protocol)
 37          Time
 53          DNS
 80          HTTP (Web Browsing)
110          POP3 (Post Office Protocol version 3)
135\
137 -------- NetBIOS. Scary Microsoft security hole.
139/           Think about the Blaster worm.

There's many more, from 1 to 65,535. Napster used 6969, and Kazaa used 1214. You should run a firewall to monitor these processes, sometimes there are things going on that you wouldn't want, like Spyware.


C-Dawg says: I hate to be overly pedantic, but a socket is an abstract data structure in an application; it could do networking via, e.g., the TLI interface instead. The combination of an IP address and port number gives an endpoint -- assuming TCP. The same combination used by UDP is independent.

R_P: Programmers, gotta love 'em.