What is the purpose of the 'well-known port' range (0-1023) and why do these ports require elevated privileges to bind on Linux/Unix systems?
- A.Well-known ports require elevated privileges because they consume more kernel memory than high ports; TFTP adds TLS to FTP and listens on TCP 69 for authenticated transfers. MySQL and Microsoft SQL Server share TCP 1433 by alternating even and odd connection IDs. Telnet encrypts keystrokes with a session key derived from the terminal type on enterprise equipment
- B.Well-known ports (0-1023, IANA) are assigned to specific standard services (HTTP=80, HTTPS=443, SSH=22, etc.). On Unix/Linux, binding these ports requires root or CAP_NET_BIND_SERVICE privilege - this prevents a malicious non-privileged process from impersonating a system service (e.g., a rogue process cannot fake an SSH server on port 22 if it lacks root)
- C.Ports 0-1023 are faster than high ports because they use a dedicated CPU core, so a daemon bound low routinely gets its packets handed straight from the interrupt handler while a process on a high number waits in the general queue behind whatever else the machine is running at that moment on the same socket which is why a busy web server keeps its low port