What is a source port and when do I need it?¶
title: "What is a source port and when do I need it?" card_id: "IP-027" status: "complete" source_document: "https://docs.google.com/document/d/14FkugP0BBpaKQlyZ5rvah4jlXqXlk3NeFjPGoOgT8_A/edit?usp=drivesdk"
What is a source port and when do I need it?¶
An IP address tells you which network connection was visible, but it may not be enough to identify which customer was using it. Sometimes you also need the source port.
A port is a number used to keep network conversations separate. When a device connects to an online service, the connection normally has a source IP address and source port at the device’s end, plus a destination IP address and destination port at the service’s end.
The destination port usually describes the service being contacted. For example, web traffic commonly goes to port 443. The source port is different. It’s normally a temporary number chosen for that particular connection.
Why does that matter? Because one public IP address can be shared. A home router may let several private devices use one public address. A mobile or broadband provider may also use carrier-grade NAT, allowing many customers to share the same public address at the same time.
To keep those connections apart, the translating system records a combination that can include the public IP address, translated source port, protocol and time. If you provide only the public IP address and timestamp, the provider may find several possible customers or none it can identify reliably.
So preserve the source port whenever the originating service records it. Also preserve the full timestamp, including seconds or finer precision, the time zone, and whether the traffic used TCP or UDP. Don’t assume a destination port, account number or event identifier can substitute for the source port. They describe different things.
Be careful about which port you request. The device may have used one source port internally, while NAT changed it to another public-facing source port. The service at the far end normally records the translated port it actually saw. That public-facing value is usually the one an internet provider needs for a shared-address lookup.
A source port doesn’t identify a person. It helps a provider distinguish one translated connection from others using the same public IP address. Any result still needs to be linked through the provider’s records, then corroborated with account, device and other evidence.
The practical rule is simple: if an address might have been shared, preserve and supply the public source IP address, public source port, exact time and time zone, and protocol. Missing one of those fields can break the attribution chain.