What is a Socket?
What is a network socket? Learn how IP, port, and protocol identify connections, plus TCP vs UDP sockets with real examples.
Expected Interview Answer
A socket is an endpoint for network communication, uniquely identified by the combination of an IP address, a port number, and a transport protocol (TCP or UDP), which an application uses to send and receive data over a network.
When a process wants to communicate over a network, the operating system creates a socket and binds it to an address and port; a client socket connects out to a server’s listening socket, and once connected, both sides read and write bytes through that socket as if it were a file. A TCP socket maintains a stateful, ordered connection between exactly two endpoints, while a UDP socket is stateless and simply sends or receives individual datagrams. The operating system tracks each active connection using a tuple of source IP, source port, destination IP, destination port, and protocol, which is how a server can distinguish thousands of simultaneous client connections all arriving on the same listening port. Sockets are the fundamental abstraction that every higher-level protocol, including HTTP, is built on top of.
- Provides a simple read/write abstraction over raw network communication
- Uniquely identifies a connection via IP, port, and protocol tuple
- Lets a server handle many simultaneous client connections on one port
- Forms the foundation every higher-level protocol is built on
AI Mentor Explanation
A socket is like a specific fielding position marked by a numbered cone on the ground where a particular player is assigned to receive throws — the combination of the ground (IP address) and the cone number (port) uniquely identifies who catches what. Multiple players can stand on the same ground with different cone numbers, each handling their own stream of throws without confusion. The captain (operating system) tracks exactly which thrower is sending to which cone, letting many separate throw-and-catch exchanges happen on the same field at once.
Step-by-Step Explanation
Step 1
OS creates the socket
An application requests a socket, which the OS binds to a local IP address and port.
Step 2
Connection established (TCP)
A client socket connects to a server’s listening socket, forming a stateful, unique connection tuple.
Step 3
Data flows through it
Both sides read and write bytes through the socket like a file descriptor or handle.
Step 4
Many connections, one port
The OS distinguishes simultaneous connections via the full 5-tuple: src IP, src port, dest IP, dest port, protocol.
What Interviewer Expects
- Clear definition: IP + port + protocol as the identifying tuple
- Distinction between TCP (stateful) and UDP (stateless) sockets
- Understanding how a server handles many clients on one listening port
- Recognizing sockets as the base abstraction beneath protocols like HTTP
Common Mistakes
- Saying a socket is just a port number
- Confusing socket with connection at the application-protocol level
- Forgetting UDP sockets exist and are connectionless
- Not explaining how multiple clients share one server port
Best Answer (HR Friendly)
“A socket is the endpoint an app uses to send and receive data over the network — it is identified by an IP address, a port number, and whether it is TCP or UDP. This is how a server can handle thousands of different client connections all coming into the same port without mixing them up.”
Code Example
# List all listening TCP sockets with process info
sudo ss -tlnp
# Show established connections and their 5-tuple
sudo ss -tnp state established
# Watch a raw socket connection being made
nc -v example.com 443Follow-up Questions
- What is the difference between a listening socket and a connected socket?
- How does the OS handle port exhaustion under high connection load?
- What is a Unix domain socket and how does it differ from a network socket?
- How do SO_REUSEADDR and SO_REUSEPORT affect socket binding?
MCQ Practice
1. A socket is uniquely identified by which combination?
The full identifying tuple is IP address, port, and transport protocol (TCP or UDP).
2. How does a server distinguish thousands of clients connecting to the same listening port?
The OS tracks each connection via its unique 5-tuple, allowing many clients to share one listening port.
3. Which type of socket is stateless?
UDP sockets are connectionless and stateless, unlike TCP sockets which maintain connection state.
Flash Cards
Socket in one line? — A network communication endpoint identified by IP, port, and protocol.
What is the 5-tuple? — Source IP, source port, destination IP, destination port, protocol.
TCP socket vs UDP socket? — TCP is stateful and connection-oriented; UDP is stateless and connectionless.
How does one port serve many clients? — Each client connection has a distinct 5-tuple even though the server port is the same.