Port Details (3)-Source port _ Network surfing

Port 1~1024 are reserved ports, so they are almost never the source port. But there are some exceptions, such as connections from NAT machines. See also 1.9.
Often see the port immediately after 1024, which is the "dynamic port" that the system assigns to those applications that do not care which port to use.
Server Client Service Description
1-5/TCP Dynamic FTP 1-5 port means the Sscan script
20/TCP Dynamic FTP FTP server transfer file Port 53 Dynamic FTP DNS sends UDP response from this port. You may also see a TCP connection to the source/destination port.
123 Dynamic S/NTP The Simple Network Time Protocol (S/NTP) server runs the port. They are also sent to broadcast on this port.
27910~27961/UDP dynamic Quake Quake or Quake engine-driven games run its servers at this port. Therefore, UDP packets from this one-port range or UDP packets sent to this end-port range are usually games.
More than 61000 of dynamic FTP 61000 ports may come from Linux NAT server (IP Masquerade)
  To find out if your machine is being planted on a Trojan horse, run "Netstat -an". See if the connection to the following ports appears.  Port Trojan 555 phAse zero 1243 Sub-7, SubSeven 3129  Masters paradise 6670 deepthroat 6711 sub-7, subseven 6969 gatecrasher  21544 GirlFriend 12345 NetBus 23456 EvilFtp 27374 Sub-7,  Subseven 30100 netsphere 31789 hack ' A ' tack 31337 backorifice, and many  others 50505 Sockets de Troie