1.5 Ports And Protocols Flashcards
SSH
Secure shell
Tcp/22
Encrypted communication link
Looks like telnet
Telnet
Tcp/23
Log into devices remotely
In the clear communication
Console access
DNS
Domain name system
UDP/53
Converts names to ip addresses
Large files may use tcp/53
SMTP
Simple mail transfer protocol
Tcp/25
Server to server mail exchange
Send mail to server
POP3
Post office protocol
Tcp/110
-Receive email from server
-Downloads email to one client
-authenticates and transfers
IMAP4
Internet message access protocol
Tcp/143
-receive email from email server
- syncs to multiple clients
SFTP
Secure file transfer protocol
Tcp/22
-Use SSH for file transfer
-provides file system functionality
*resuming interrupted transfers, directory listings, remote file removal
FTP
File transfer protocol
Tcp/20 (active mode data)
and tcp/21(control)
-transfers files between systems
-authenticates with username and password
-full functionality (list, add, delete, etc)
TFTP
Trivial file transfer protocol
UDP/69
-very simple file transfer
-reads and writes
-no authentication
DHCP
Dynamic host configuration protocol
UDP/67, UDP/68
-automated configuration of IP address
-update from bootp
-DORA
-Uses IPv4 broadcast domain
-dhcp relay (helper) needed across different network since routers do not forward broadcast messages
-renewal
-T1 timer (50% of lease time)
-T2 timer (87.5% of lease time)
HTTP
Hypertext transfer protocol
Tcp/80
-communication in browser or over web applications
-in the clear
HTTPS
Hypertext transfer protocol
(Over SSL or TLS)
Tcp/443
-web applications
-encrypted
SNMP
Simple network management protocol
UDP/161
-gather statistics from network devices
-v1 - structured tables, in the clear
-v2 - data type enhancements, bulk
transfers, in the clear
-v3 - message integrity,
authentication, encryption
Syslog
UDP/514
-standard for message logging
- usually central log collector (SIEM)
- lot of disk space needed
RDP
Remote Desktop protocol
Tcp/3389
-share a desktop from a remote location
NTP
Network time protocol
UDP/123
-synchronizing clocks on all devices
-automatic updates
-flexible-you control how clocks update
-distance from original clock is a stratum
-stratum 0 (atomic or gps clock)
-stratum 1 (primary time servers)
-stratum 2(sync’d to stratum 1 servers)
SIP
Session initiation protocol
Tcp/5060 and tcp/5061
-VoIP signaling
-setup and manage VoIP sessions
-video conferencing, instant messaging, file transfer, etc
SMB
Server Message Block
Tcp/445 (NetBIOS-less)
-file sharing, print sharing used by Microsoft
-aka CIFS (Common Internet File System)
LDAP
Lightweight directory access protocol
Tcp/389
-an access database used by 802.1x for authentication
-store and retrieve information in a network directory
-used to query and update an X.500 directory
(Used in windows AD, Apple
OpenDirectory, OpenLDAP, etc)
-Hierarchical structure (builds tree)
-Container objects
-country, organization, OUs
-leaf objects
-users, computers, printers, files
MS-SQL
Microsoft SQL Server
Tcp/1433
SQLnet
Oracle SQL Net
Tcp/1521
-aka oracle net or net8
MySQL
tcp/3306
-free and open source database
-ultimately acquired by Oracle
SMTP TLS
Tcp/587
POP3 over SSL
Tcp/995
IMAP over SSL
Tcp/993
LDAPS
-non-standard implementation of LDAP over SSL
Tcp/636
ICMP
Internet control message protocol
-carried by IP
-“test message” For your network devices
GRE
• Generic Routing Encapsulation
– The “tunnel” between two endpoints
• Encapsulate traffic inside of IP
– Two endpoints appear to be directly connected to each other
– No built-in encryption
VPNs
• Virtual Private Networks
– Encrypted (private) data traversing a public network
• Concentrator
– Encryption/decryption access device
– Often integrated into a firewall
• Many deployment options
– Specialized cryptographic hardware
– Software-based options available
• Used with client software
– Sometimes built into the OS
IPSec
• Security for OSI Layer 3
– Authentication and encryption for every packet
• Confidentiality and integrity/anti-replay
– Encryption and packet signing
• Very standardized
– Common to use multi-vendor implementations
• Two core IPSec protocols
– Authentication Header (AH)
– Encapsulation Security Payload (ESP)
AH
AH (Authentication Header)
• Data integrity
• Origin authentication
• Replay attack protection
• Keyed-hash mechanism
• No confidentiality/encryption
ESP
Encapsulating Security Payload
• Data confidentiality (encryption)
• Limited traffic flow confidentiality
• Data integrity
• Anti-replay protection
IPSec Transport and Tunnel Mode
AH and ESP
• Combine the data integrity of AH with the confidentiality of ESP
Transport mode keeps original IP header and adds AH and ESP before that IP header
Tunnel mode encrypts IP header, puts AH and ESP headers in front of it and adds a new IP header at the front
