10:31:48 leo@group-20 ~ → ls -l /bin/netcat 
lrwxrwxrwx 1 root root 24 Apr  8  2024 /bin/netcat -> /etc/alternatives/netcat
10:31:57 leo@group-20 ~ → ls -l /etc/alternatives/netcat 
lrwxrwxrwx 1 root root 15 Apr  8  2024 /etc/alternatives/netcat -> /bin/nc.openbsd
10:32:11 leo@group-20 ~ → ls -l /bin/nc.openbsd 
-rwxr-xr-x 1 root root 39560 Apr  8  2024 /bin/nc.openbsd
10:31:38 leo@group-20 ~ → sudo setcap cap_net_bind_service+ep /bin/nc.openbsd
10:32:46 leo@group-20 ~ → netcat -l 81
GET / HTTP/1.1
Host: 10.42.23.30:81
User-Agent: curl/8.20.0
Accept: */*
leo@leo-laptop:~$ curl 10.42.23.30:81
^C



On linux ports 0-1023 are privileged ports to which only the root user can bind by default.
By setting the cap_net_bind_service capability the executable can also bind to those lower ports.
/bin/netcat is only a symlink leading to /etc/alternatives/netcat which is a symlink leading to /bin/nc.openbsd.
The capabilities are stored in the file's inode. Because symlinks do not support extended attributes in this way the capability has to be stored on the target executable.