Each client/server IP connection is identified by a tuple composed by five elements:
- ip protocol
- source address
- source port
- destination address
- destination port
When a connection is established, both the client and server IP stacks remember the respective tuple in a specific in-memory table. Later, when a packet arrive, it search the connection table to find the correct tuple and to see what specific process is listening for it.
As a practical example, consider issuing the command netstat -n -t -p
on a linux box. On my PC, it shows the following output:
[root@centos-webdev ~]# netstat -n -t -p
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 172.31.255.240:45414 1.1.8.246:25 TIME_WAIT -
tcp 0 64 172.31.255.240:22 1.1.9.6:2205 ESTABLISHED 10604/sshd
Give a look a the last line: if shows that there is an established SSH connection from remote address 1.1.9.6, port 2205 to the local IP 172.31.255.240, port 22. The rightmost field explain that the ssh executable, with PID 10604, is listening for packet belonging to that specific connection.