Is the same port acting as both client and server?

Question

i find something strange in this netstat output. the output is taken using netstat -a -n -o -p TCP command on win 7.

 Proto  Local Address          Foreign Address        State           PID
 TCP    127.0.0.1:55486        127.0.0.1:55487        ESTABLISHED     5808
 TCP    127.0.0.1:55487        127.0.0.1:55486        ESTABLISHED     5808

Please note these two lines. both local and foreign address is localhost. but how come the ports are paired? out of two ports 55486 and 55487 which one is the server port and which one is the client port?

from what i understand, the local-address column denotes the client side of a TCP connection and the foreign-adress column denotes the server side. From this output it seems that the same port is behaving as both client and server.

I dont understand how is this possible with TCP?

Solution 1

Line: TCP 127.0.0.1:55486 127.0.0.1:55487 ESTABLISHED 5808

Is stating the client is connecting to the port on 55487 for the server while the client uses port 55486.

Line: TCP 127.0.0.1:55487 127.0.0.1:55486 ESTABLISHED 5808

is stating the server is connecting back to the client on port 55486 from 55487.

TCP requires the "3-way handshake" to set up the connection between a client and server.

The client connects to the a server (part 1 of the 3 way handshake). The server responds acknowledging the connection (part 2). The client responds to the acknowledgement with its own acknowledgement (part 3).

TL;DR - Client generally uses random port to connect to a server with a specific port. The server responds back to that machine using the random port. The client and server are NOT on the same port.

Solution 2

I can’t quite tell how much of this you understand now, so allow me to be a little bit pedantic.

Clearly you understand the concept of client and server, so it surprises me that you write, “the Local Address column denotes the client side of a TCP connection and the Foreign Address column denotes the server side.”  That’s wrong; the Local Address column denotes the local side of a TCP connection and the Foreign Address column denotes the foreign (or remote) side.  In other words, the Local Address column denotes the (TCP) socket that a process on your computer is using (i.e., a socket that your computer owns), and the Foreign Address column denotes the socket that the local socket is connected to.  As you seem to understand, processes on your computer can function as servers, so local sockets can be server sockets -- and then the corresponding client socket would be listed as “foreign”.

Things start to get confusing when a client process on your computer connects to a server process on your computer.  Now, this one connection represents two local sockets -- and netstat reports one line for each; one showing the client as local and the server as foreign (even though it really is a local socket), and one the other way around.

Your situation is just a little bit more confusing.  Your jetty server (process 5808) is, of course, creating sockets and accepting connections on them -- that’s what servers do.  But it is creating many sockets at once.  (By necessity, they are on different port numbers; the OS won’t allow multiple sockets with the same protocol and port number to co-exist.)  And it seems to be using random (OS-assigned) port numbers.  For example, as you pointed out, it is listening on port 55484.  I’m not familiar with jetty, so I don’t know whether that is normal.

If you examine your netstat output closely, you’ll see that local process 184, using a socket on port 8081, has a connection to process 5808 / port 55482.

The part that I find really weird is that process 5808 has connected to itself on several of these sockets.  So you have several TCP connections where both sockets are held, not just on the same host, but in the same process.  I don’t think we can tell for sure which end is the client and which is the server.  I would actually guess that the lower port number is more likely to be the server, but that is just a guess.

Comments

[Scott - Слава Україні]

What is process 5808?

[inquisitive]

@Scott, 5808 is javaw.exe, it it hosting a jetty server. listening on 127.29.232.39:55484. plz see the second last line in screenshot.

[inquisitive]

well it didnt make sense then. but guess it does now. thanks.

[inquisitive]

... is stating the server is connecting back to the client on port 55486 from 55487 ... somehow i missed this. thanks

[falconspy]

No problem. Glad I was able to help you understand :)

[inquisitive]

i really appreciate your being pedantic, i believe now i have a much clear picture. the part where process 5808 connects to itself, the process hosts a server and a client i should have made two JARs, but packaging required one, so i packed both of them in one JAR. This is not normal for jetty, but for my application. i expected to see one line for each of the connections, but got confused when saw two. it is unfortunate that we can mark only one as answer and upvote only once, but i'll do what i can.

[eigenfield]

Once the connection is made, is it correct to say that the concept of client/server fades away? I mean, since both processes are now established then both processes are now client and server at the same time. I also want to mean, that the client / server concept is only up to at the beginning when the client is connecting to the server.

[VL-80]

@daixtr, It does not fade away. Client/server model is applicable regardless of state of connection. As long as server is running and ready to accept new connections from clients, it is providing service to them. This is why it's called server. For example, a client could connect to a database server, send it queries and receive results. They both are sending and receiving data, but the server continues to be the server, and the client continues to be the client.