This is more idle curiosity than anything else. A friend of mine asked me 'which port range is it that only root can use under Linux?' I told him 0-1024 were restricted. Then he asked my why it was so and... I was at a loss. No idea whatsoever.

Is there a reason why these ports are restricted and 1025-65535 are not?

Most major network services (HTTP, FTP, SSH, Telnet, HTTPS, POP, SMTP, etc) are in this range so possible answers I thought of:

• An untrusted user could run a program that listened on these ports for logon details.
• An untrusted user could run an unauthorized server application.

Can anyone shed light here?