Linux Network Ports, /etc/services & DNS Resolution Architecture Tutorial

An in-depth guide to TCP/UDP port classifications, the /etc/services protocol directory, Name Service Switch (/etc/nsswitch.conf), systemd-resolved, and DNS analysis using dig, nslookup, and host.

In modern computer networking, an IP address delivers packets to the physical host, but a Port Number determines which application daemon or background service receives that data. Meanwhile, because humans remember names (veewom.com) rather than numeric IP addresses (93.184.216.34), the Domain Name System (DNS) acts as the distributed directory service of the Internet.

This masterclass covers the three standard IANA port classifications, the standardized Linux /etc/services file, the exact internal pipeline the Linux kernel uses to resolve hostnames, and modern diagnostics using dig, nslookup, and systemd-resolved.

1. What is a Network Port?

A port is a 16-bit unsigned integer ranging from 0 to 65535 ($2^{16} = 65,536$ total ports) allocated in transport layer headers (both TCP and UDP). An IP address paired with a port number forms a network socket (e.g., 192.168.1.100:443). Sockets allow hundreds of concurrent services (Web, SSH, Mail, Database) to communicate across a single network card without data collision.

2. The Three Port Ranges (IANA Standard)

Linux Kernel Pro-Tip: You can check or tune your Linux system's ephemeral port range by running: cat /proc/sys/net/ipv4/ip_local_port_range (typically returns 32768 60999).

3. Master Cheat Sheet of Standard Linux Ports & /etc/services

Linux maintains a standardized system database file located at /etc/services that maps service protocol names to port numbers:

You can search /etc/services directly from your terminal using grep:

# Look up the port for MySQL
grep -w 3306 /etc/services
# Returns: mysql    3306/tcp    # MySQL

# Look up the port for SSH
grep -w "^ssh" /etc/services
# Returns: ssh      22/tcp      # SSH Remote Login Protocol

4. The Linux DNS Resolution Chain Explained

When a user types curl https://veewom.com or writes code that makes an HTTP request, the Linux system invokes the standard C library function getaddrinfo(). The system resolves the domain through a strictly defined hierarchy:

1. Step 1: Check Local Switch Configuration (/etc/nsswitch.conf):
   The Name Service Switch controls the order of lookups. The hosts line usually reads: hosts: files dns (or files resolve dns). This instructs Linux to check local static files first before sending packets across the network.
2. Step 2: Inspect Static Host Mappings (/etc/hosts):
   Linux reads /etc/hosts. If an entry exists (e.g. 192.168.1.50 testserver.local), the kernel resolves the IP immediately with zero latency and stops further queries.
3. Step 3: Query Local Stub Resolver / Systemd-Resolved (127.0.0.53):
   On modern Ubuntu, Debian, and Fedora distributions, /etc/resolv.conf points to the loopback stub listener 127.0.0.53 managed by systemd-resolved. If the IP is cached locally in RAM, it is returned instantly.
4. Step 4: Upstream Recursive Nameservers:
   If the address is not cached, the resolver sends UDP port 53 datagrams to the configured upstream DNS servers (e.g. 8.8.8.8 or router IP).
5. Step 5: The Global DNS Iterative Hierarchy:
   If the recursive server has not cached the record, it performs an iterative lookup:
   • Queries one of the 13 global Root Nameservers (a.root-servers.net to m.root-servers.net) to find the Top-Level Domain (TLD) authoritative servers (e.g., .com).
   • Queries the TLD Nameservers to find the domain's Authoritative Nameservers.
   • Queries the Authoritative Nameservers (e.g., Cloudflare, Route53) which host the official DNS zone records (A, AAAA, CNAME, MX).

5. DNS Diagnostic Tools: dig, nslookup & host

The dig Command (Domain Information Groper)

dig is the industry standard for diagnosing DNS issues, querying nameservers directly and showing full answer payloads:

# 1. Standard DNS query for IPv4 A record
dig veewom.com

# 2. Short answer format (prints only the resolved IP address)
dig veewom.com +short

# 3. Query a specific DNS server directly (bypassing local /etc/resolv.conf)
dig @8.8.8.8 veewom.com

# 4. Query specific record types (MX for Mail, NS for Nameservers, TXT for SPF/DKIM)
dig veewom.com MX +short
dig veewom.com NS +short
dig veewom.com TXT +short

# 5. Reverse DNS lookup (Resolving an IP to a hostname / PTR record)
dig -x 8.8.8.8 +short
# Returns: dns.google.

# 6. Full hierarchical trace from root servers to authoritative nameserver
dig +trace veewom.com

The host & nslookup Commands

# Quick one-line lookup with host
host veewom.com

# Check mail exchangers
host -t MX google.com

# Interactive query with nslookup
nslookup veewom.com

Managing systemd-resolved

# View active DNS servers and caching statistics
resolvectl status

# Flush local DNS cache in Ubuntu / Debian
sudo resolvectl flush-caches

# Verify cache statistics
resolvectl statistics

6. Practical Terminal Lab: Ports & DNS Management

Lab 6.1: Auditing Active Listening Ports

# Display all listening TCP and UDP ports with process name
sudo ss -tulpn

# Filter specifically for web servers (Port 80/443) or SSH (22)
sudo ss -tulpn | grep -E ':22|:80|:443'

Lab 6.2: Overriding DNS with /etc/hosts

System administrators use /etc/hosts to test staging websites before switching public DNS records:

# Add a staging server override
echo "192.168.1.200 staging.mycompany.com" | sudo tee -a /etc/hosts

# Verify ping points immediately to the private IP
ping -c 2 staging.mycompany.com

# Remove the test line when finished
sudo sed -i '/staging.mycompany.com/d' /etc/hosts

7. Student Viva & Exam Practice Q&A

8. Frequently Asked Questions (FAQ)