diff --git a/metropolis/node/ports.go b/metropolis/node/ports.go
index 3449f07..05cbd9e 100644
--- a/metropolis/node/ports.go
+++ b/metropolis/node/ports.go
@@ -16,12 +16,44 @@
 
 package node
 
+// Port is a TCP and/or UDP port number reserved for and used by Metropolis
+// node code.
+type Port uint16
+
 const (
-	CuratorServicePort = 7835
-	ConsensusPort      = 7834
-	MasterServicePort  = 7833
-	DebugServicePort   = 7837
-	WireGuardPort      = 7838
-	KubernetesAPIPort  = 6443
-	DebuggerPort       = 2345
+	// CuratorServicePort is the TCP port on which the Curator listens for gRPC
+	// calls and services Management/AAA/Curator RPCs.
+	CuratorServicePort Port = 7835
+	// ConsensusPort is the TCP port on which etcd listens for peer traffic.
+	ConsensusPort Port = 7834
+	// DebugServicePort is the TCP port on which the debug service serves gRPC
+	// traffic. This is only available in debug builds.
+	DebugServicePort Port = 7837
+	// WireGuardPort is the UDP port on which the Wireguard Kubernetes network
+	// overlay listens for incoming peer traffic.
+	WireGuardPort Port = 7838
+	// KubernetesAPIPort is the TCP port on which the Kubernetes API is
+	// exposed.
+	KubernetesAPIPort Port = 6443
+	// DebuggerPort is the port on which the delve debugger runs (on debug
+	// builds only). Not to be confused with DebugServicePort.
+	DebuggerPort Port = 2345
 )
+
+func (p Port) String() string {
+	switch p {
+	case CuratorServicePort:
+		return "curator"
+	case ConsensusPort:
+		return "consensus"
+	case DebugServicePort:
+		return "debug"
+	case WireGuardPort:
+		return "wireguard"
+	case KubernetesAPIPort:
+		return "kubernetes-api"
+	case DebuggerPort:
+		return "delve"
+	}
+	return "unknown"
+}