net_bind_service. This one's easy. If you have this capability, you can bind to privileged ports (e.g., those below 1024). If you want to bind to a port below 1024 you need this capability. If you are running a service that listens to a port above 1024 you should drop this capability.