5

Process is a program in execution. E.g. Firefox. I don't understand the relationship and the differences between the terms "process" and "ports".

When I run netstat -no -p -TCP on cmd I can see multiple port numbers are associated with each process as shown below. However the relationship between ports and processes is unclear to me.

screenshot: cmd output of "netstat -no -p -TCP"

4
  • 8
    The same as the difference between an employee ID number and an office number. Jan 4, 2018 at 17:01
  • in reply to MaQleod according to en.wikipedia.org/wiki/Network_socket a socket is characterised by at least a local socket and a port.
    – barlop
    Jan 5, 2018 at 0:16
  • BTW OP, the text in your CMD window looks squashed. I see this on a lot of PCs that have upgraded to Windows 10 from 7 or 8. You can fix it by changing the font size, saving, then changing it back.
    – wjandrea
    Jan 5, 2018 at 2:06
  • @wjandrea I notice it gets squashed if choosing raster and then with raster you get some funny dimensions options and that you can even preview and look funny. But if choosing courier new then you don't get ridiculous dimension options, and with some possibly some slight fiddling you can ensure the setting is right.
    – barlop
    Jan 5, 2018 at 6:21

5 Answers 5

36

To answer the question directly: there is no connection between the process ID and the port number. They enumerate entirely different things.

The PID identifies a process (eg a Firefox session: each tab may run as a different process), and the port number identifies which port that process is using to communicate. Specific port numbers do have customary uses: 80 is generally used for HTTP and 443 for HTTPS. But a process could get any PID number, depending on when it is started.

As you can see, your local port numbers are used sequentially and are related to neither destination port number or to the PID of the process using them.

7
  • 8
    Metaphorically if perhaps not literally, they are indices into different arrays. Jan 4, 2018 at 12:55
  • Technically speaking, init is reserved PID 1 these days. But beyond that, there shouldn't be a way to know which PID a process will get.
    – Kat
    Jan 4, 2018 at 18:05
  • I would state that last sentence as "your source port numbers are used sequentially". It appears this is a workstation that doesn't listen on any ports, but for others looking at the answer who might be talking about servers, it's an important distinction to make. Jan 4, 2018 at 19:19
  • "your local port numbers are used sequentially" - it doesn't look particularly sequential to me, there are a few gaps and we also don't know the times at which the connections were opened. They're just listed in ascending order in that particular screenshot.
    – Bergi
    Jan 4, 2018 at 19:27
  • And for completeness, it should be noted that there will be many processes won't use any ports at all (although by definition these won't be listed by a netstat command).
    – TripeHound
    Jan 5, 2018 at 11:13
12

The PID is shown only so that you can identify the specific process doing the communication and is unrelated to the port number.

If you had multiple copies of one program running and they were all communicating over the network then showing the program name would not be enough to uniquely identify which port belonged to which copy of the program.

If you were wanting to kill a particular connection but not all copies of the program the you would need to know the PID rather than the program name.

1
  • if you are defining process simply as "copy of a program" that is not a clear definition. There is a big difference between a program copied into two different directories, or a program file copied elsewhere or with another name.. Or an instance of a program in RAM.
    – barlop
    Jan 5, 2018 at 0:11
10

Process

What is a process?

A process is basically a copy of a program. So, if you run a program like Notepad multiple times, each specific time will get its own Process. A process uses resources, such as available RAM on your computer. If you look at Task Manager and you see the program running multiple times, each different occurrence of the program can be a different process.

How are processes assigned?

The PID ("process ID") numbers are assigned by the operating system each time a new process is made.

What are processes good for?

Using the process ID (which identifies an exact, specific copy of a running program), you can determine which software program that process is an instance of. You can do this using TaskList (from the command line), WMIC PROCESS GET /FORMAT:LIST (from the command line), or Task Manager. In Task Manager, on some newer versions of Microsoft Windows, you may need to go to the "Details" tab. If there isn't a column for showing the PID, you can add it. (In Windows 10, at least, you right-click on a column name, and then can select visible columns. As memory serves me, older versions of Windows had a menu option for this.)

Another command that you may find useful is netstat. I see you're using netstat. Try adding the "-b" parameter. (This option is rather specific to Microsoft Windows, which I presume you are using based on the C:\Users\User> in your prompt.) That will have Netstat try to use the PID to figure out the name of the executable file, and print that on the next line.

All of this is entirely unrelated to the port number.

Port Numbers

What is a port number

A port number is used as part of a network connection. Not all network communication uses port numbers. For instance, ICMP, used by TraceRoute (named "TRACERT" on Microsoft Windows) and the Microsoft Windows "ping" command, doesn't use port numbers. The most common protocols that do are UDP and TCP. (Maybe SCTP is the next-most-common?) Many protocols, including HTTP(S) and SMTP (for E-Mail) use TCP, so port numbers are used.

What are port numbers good for?

It is possible to have multiple TCP connections between the same computers, and port numbers are used to identify those connections. For instance, if your E-Mail program is getting E-Mail, the network connection may be between [LOCAL PORT 52534, REMOTE/FOREIGN PORT 25], while your web browser can create a connection using [LOCAL PORT 54499, REMOTE/FOREIGN PORT 443]. That way, when the remote computer responds and the incoming traffic is defined as [LOCAL PORT 54499, REMOTE/FOREIGN PORT 443], your computer knows that traffic is not meant for your local E-Mail program. Actually, your web browser could create multiple TCP connections in order to do something like downloading multiple graphics at the same time. When your computer receives graphical data, the port numbers can help your web browser know which connection the data is meant for, so the web browser can know which graphic the received data was meant for.

(Note: The square brackets are just a notation I made up to make that paragraph a bit easier to read. In Netstat's output, the port numbers are shown after the colon. I don't typically prefer to use the term "foreign" to describe port numbers, but I did in this case because that was the term used by netstat.)

How are port numbers assigned?

In general, most software simply tells the "network stack" that it wants to make a network connection. In modern operating systems, the "network stack" is built in as part of the operating system (although back in the days of Windows 3.1, a network stack was typically added during the installation of a software program like Microsoft Internet Explorer or Trumpet Winsock). The software program will typically tell the network stack something like, "Create a new TCP connection to remote port 443." The network stack will determine what source port number it wants to use.

Summary

Processes and port numbers are very different things. I agree with most or all of the information in the other answers here. (However, I added my own answer here because I thought a bit more detail, like where the numbers are assigned from, might help to make the distinction a bit more clear.)

2
  • this answer is kind of nice but i think it would be better to tell how software gets some specific number even though they are using protocol with assigned port number but +1 nevertheless Jan 5, 2018 at 2:12
  • @DreadfulWeather : First, what does the word "they" refer to? And second, doesn't my answer do exactly that, e.g. the "How are port numbers assigned?" section. I read your comment four times to see if I could grasp what you're trying to communicate, but I'm sorry to say that I just have not been able to understand your comment.
    – TOOGAM
    Jan 5, 2018 at 9:48
2

Somewhat simplified:

The PID is the number used internally in your computer to refer to any specific process. A processor can only do one thing at a time, but it has multiple tasks to do, so it alternates between working for different processes, and the PID is the tag that the processor uses to identify each process.

The port number is a tag given to all network communications so that when an answer returns from the network, the router on your home network knows what computer awaits that answer, and when the answer arrives to the computer, the computer knows which process awaits the message.

For instance, the port tag makes sure that when you request this page from the servers of Stackexchange, and the site data arrive at your router, then your router knows that it is your computer, and not your brother's smartphone or any other device that wants them. And when they arrive at your computer, your computer can tell that it is Firefox that wants them, not Word.

0
2

A process is a running program, in most cases. A program like Firefox can actually consist of multiple processes working together, but as far as the operating system is concerned, they are the basic unit of work: every process has an image (the executable file that is running), a working directory, handles (resource assignments), memory address space, CPU and I/O priority, and so on. If you run notepad, a process is started using notepad.exe, and it opens a window for you to interact with.

A port is a resource. The operating system has a certain number of ports available (65535), and a process can request a handle to obtain exclusive use of a port. A process can obtain handles to any number of otherwise unused ports. A port is required for network communication. The port numbers chosen for outgoing connections (like the browser connecting to a web server) are essentially arbitrary; they bear no significance you need to care about.

This is all a simplified overview, so don't take it as being super accurate.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .