NETWORK
Ephemeral portsClient-side source ports and the dynamic range
Ephemeral ports are the temporary source ports an operating system picks for the client side of each outbound connection. Windows uses 49152–65535 by default (the IANA dynamic range); Linux uses 32768–60999. When the range is exhausted, new connections fail, a classic problem on busy proxies and NAT devices.
What happens on every connection
A connection is identified by four values: source IP, source port, destination IP and destination port. The destination side is fixed (the server's address and its well-known port). The source port is chosen by the client's operating system from the ephemeral range, at random within it (RFC 6056), so that each connection to the same server is distinguishable and so that the port is hard to guess.
192.168.1.20 : 51876 → 203.0.113.5 : 443
192.168.1.20 : 51877 → 203.0.113.5 : 443When the connection closes, the port returns to the pool, after a TIME_WAIT period on the side that closed first (typically 30–120 seconds).
Ranges by operating system
| System | Default range | Change with |
|---|---|---|
| Windows Vista and later | 49152–65535 | netsh int ipv4 set dynamicport tcp start=N num=M |
| Windows XP / Server 2003 | 1025–5000 | Registry MaxUserPort |
| Linux | 32768–60999 | sysctl net.ipv4.ip_local_port_range |
| macOS / BSD | 49152–65535 | sysctl net.inet.ip.portrange.first/last |
Windows applies the same range to RPC dynamic endpoints (see port 135), which is why firewalls between management hosts and servers must allow 49152–65535 or a narrowed equivalent.
Port exhaustion
A machine that opens many short connections to one destination can run out: a load balancer or NAT gateway fronting a busy API, a monitoring server polling thousands of targets, a badly written application that opens a connection per request and never reuses it. Symptoms are new connections failing with WSAEADDRINUSE / "address already in use" or EADDRNOTAVAIL, while established ones keep working.
Fixes, in order of preference: reuse connections (keep-alive, pooling); reduce TIME_WAIT impact with reuse settings on the server side; widen the range; add source IP addresses to the NAT pool.
Viewing on Windows
netsh int ipv4 show dynamicport tcp
netstat -ano -p tcp | find /c "TIME_WAIT"The first shows the configured range; the second counts sockets waiting to be reclaimed. Get-NetTCPConnection -State TimeWait gives the same in PowerShell. See netstat, netsh and Get-NetTCPConnection.
Security note
Randomised ephemeral ports make it harder for an off-path attacker to inject packets into a connection or poison a DNS resolver's cache. The DNS cache-poisoning attacks of 2008 were mitigated largely by resolvers randomising their source ports.
Frequently asked questions
Why does netstat show connections from ports like 51234?
That is the ephemeral source port your PC chose for the connection. The destination port (443, 22, 3389) identifies the service; the source port only needs to be unique on your machine for that destination.
How many connections can a client make to one server?
One per available ephemeral port to the same destination IP and port, about 16,000 on Windows by default. The limit applies per destination, so a client can have 16,000 connections to each of many servers. TIME_WAIT sockets count against it for a while after closing.
How do I change the range on Windows?
netsh int ipv4 set dynamicport tcp start=10000 num=55000 (run as administrator) sets the range to 10000–64999. Do the same for udp and ipv6 as required. Only do this to solve a measured exhaustion problem or to satisfy a firewall policy.