What is a Socket?

In networking, a socket is the programming interface (and the abstract endpoint) that ties an IP address and a port to a process so data can flow in or out. TCP sockets represent connected streams; UDP sockets send and receive datagrams. Every web request, DNS lookup, and API call on your network ultimately goes through sockets managed by the operating system.

How programs use sockets

A server typically creates a socket, binds it to an interface and port, listens, and accepts incoming TCP connections (each accepted connection gets its own socket). A client creates a socket and connects to the server’s IP and port. For UDP, bind and then sendto or recvfrom without a persistent connection. The Berkeley sockets API on Unix-like systems became the de facto model; Windows uses Winsock with the same concepts.

Higher protocols layer on top: HTTP servers listen on TCP port 443 (TLS) or 80; mail, databases, and game servers each use assigned or custom ports.

Sockets, WebSockets, and ports

A WebSocket connection still uses a TCP socket underneath after the HTTP upgrade. “Socket” in API terms is broader than “WebSocket,” which is a specific web protocol. Ports let one IP host many services; combined with IP, they identify the target application for delivery.

Why sockets matter for fraud analysis

Blocking or scoring traffic often works at IP or ASN granularity, but the business logic lives in TCP and UDP ports (443 for HTTPS, 53 for DNS, and so on). Proxy and VPN endpoints terminate or tunnel sockets, changing what publishers see as the client address. Bot operators may open many short-lived sockets from data centers while mimicking browsers at the HTTP layer.

Understanding sockets clarifies what “IP blocking” actually affects and why fraud detection adds behavioral and device signals beyond the address alone. Spend abuse still maps to click fraud and ad fraud at the campaign level.