6 Introduction to TCP/IP Flashcards
What is TCP/IP ?
The Transmission Control Protocol/Internet Protocol (TCP/IP). It specifies how data is exchanged over the internet by providing end-to-end communications that identify how it should be broken into packets, addressed, transmitted, routed and received at the destination.
Department of Defense (DoD) model:
Process/Application
Host-to-Host
Internet
Network Access
Internet Layer Protocols:
The main workhorse of TCP/IP is the Internet Protocol (IP). IP is responsible for managing logical network addresses and getting data from point A to point B, even if there are dozens of points in between.
Three support protocols at this layer:
Internet Control Message Protocol (ICMP) - is responsible for delivering error messages.
Address Resolution Protocol (ARP) - resolves logical IP addresses to physical MAC addresses built into network cards.
Reverse ARP (RARP) - resolves MAC addresses to IP addresses.
Host-to-Host Layer Protocols:
At this layer there are two alternatives within the TCP/IP suite: TCP and UDP. TCP guarantees packet delivery through the use of a virtual circuit and data acknowledgments, UDP does not. Because of this, TCP is referred to as connection-oriented, whereas UDP is connectionless. Because UDP is connectionless, it is
faster, but only by milliseconds. When a client makes a request of a server, it does so on a specific port to make sure that the right application on the server hears the request.
There are 65,536 ports, numbered from 0 to 65535. Ports 0 through 1023 are called the
well-known ports and are assigned to commonly used services, and 1024 through 49151 are called the registered ports. All the ports from 49152 to 65535 are free to be used by application vendors.
Common Port Numbers:
Service Protocol Port
FTP TCP 20, 21
SSH TCP 22
Telnet TCP 23
SMTP TCP 25
DNS TCP/UDP 53
DHCP UDP 67, 68
TFTP UDP 69
HTTP TCP 80
POP3 TCP 110
NetBIOS/NetBT TCP 137, 139
IMAP4 TCP 143
SNMP UDP 161, 162
LDAP TCP 389
HTTPS TCP 443
SMB/CIFS TCP 445
RDP TCP 3389
Process/Application Layer Protocols:
Most of the protocols within the TCP/IP suite are at the Process/Application layer.
Port 20/21—File Transfer Protocol (FTP):
The File Transfer Protocol (FTP) — transfer files, upload/download files from one host to another, copy files, list and manipulate directories, and view file contents. FTP is unsecure. It transmits usernames and passwords in plain text. For secure file transfers, other options include Secure FTP (SFTP) and FTP Secure (FTPS). FTP uses two TCP connections for communication. Port 20 is used to send the data files between the client and the server and Port 21 is used for pass control information.
Port 22—Secure Shell (SSH):
Secure Shell (SSH) uses port 22 and provides a secure way to access a remote systems terminal and set up a secure Telnet session for remote logins or for remotely executing programs and transferring files.
Port 23—Telnet:
Terminal emulation protocol. Someone using Telnet can log into another machine and “see” the remote computer in a window on their screen. User can manage files on that remote machine just as if they were logged in locally. Telnet is unsecure, data transmitted, including passwords, is sent in plain text. SSH overcomes this by encrypting the traffic, including usernames and passwords.
Port 25—Simple Mail Transfer Protocol (SMTP):
Simple Mail Transfer Protocol (SMTP) is the protocol used to send email from mail server to mail server as well as from a mail server to an email client. It’s designed to send only (push protocol). An email client locates its email server by querying the DNS server for a mail exchange (MX) record. After the server is located, SMTP is used to push the message to the email server, which will then process the message for delivery.
Port 53—Domain Name System (DNS)
Domain Name System (DNS) uses port 53 and translates domain names (URLs) into IP addresses.
Port 67/68—Dynamic Host Configuration Protocol (DHCP)
Dynamic Host Configuration Protocol (DHCP) dynamically assigns IP addresses and other IP configuration information to network clients.
Port 69—Trivial File Transfer Protocol (TFTP)
Trivial File Transfer Protocol (TFTP) is lighter-weight FTP protocol. It can transfer files much like FTP, but it’s much simpler and faster.
Differences:
Authentication:
(TFTP) - None required
(FTP) - Username / password (although you
may be able to use anonymous)
Protocol used:
(TFTP) UDP (connectionless)
(FTP) TCP (connection-oriented)
Number of commands: (TFTP) 5
(FTP) About 70
Primary use:
(TFTP) Transmitting configurations to and from network devices
(FTP) Uploading and downloading files
Port 80—Hypertext Transfer Protocol (HTTP)
HTTP manages the communication between a web server and client, and it lets you connect to and view content on the Internet. Information transmitted by HTTP is in plain text (not secure).
Port 110—POP3
Post Office Protocol 3 (POP3) - downloading email. It’s been replaced in most installations by IMAP4 because IMAP4 includes security and more features than POP3.
Port 137/139—Network Basic Input/Output System (NetBIOS)/NetBIOS over TCP/IP (NetBT)
Network Basic Input/Output System (NetBIOS) is an application programming interface (API) that allows computers to communicate with each other over the network. It works at Layer 5 of the OSI model. Consequently, it needs to work with another network protocol to handle the functions of Layer 4 and below. NetBIOS running over TCP/IP is called NetBT,
or NBT.
Specifically, NetBIOS provides three services:
Naming service, for name registration and resolution
Datagram distribution service, for connectionless communication
Session management service, for connection-oriented communication
Port 143—Internet Message Access Protocol (IMAP)
Internet Message Access Protocol (IMAP) is a secure protocol designed to download email.
Its current version is version 4, or IMAP4. It’s the client-side email management protocol of choice, having replaced the unsecure POP3. Most current email clients, such as Microsoft Outlook and Gmail, are configured to be able to use either IMAP4 or POP3.
Advantages over POP3:
IMAP4 works in connected and disconnected modes. With POP3, the client makes a connection to the email server, downloads the email, and then terminates the connection.
IMAP4 allows the client to remain connected to the email server after the download, so soon as another email enters the inbox, IMAP4 notifies the email client, which can then download it. IMAP4 also lets you store the email on the server, as opposed to POP3, which requires you to download it. IMAP4 allows multiple clients to be simultaneously connected to the same inbox. This can be useful for smartphone users who have both Outlook on their workstation and their smartphone email client operational at the same time or for cases where multiple users monitor the same mailbox, such as on a customer service account. IMAP4 allows each connected user or client to see changes made to messages on the server in real time.
Port 161/162—Simple Network Management Protocol (SNMP)
Simple Network Management Protocol (SNMP) gathers and manages network performance information. On your network, you might have several connectivity devices, such as routers and switches. A management device called an SNMP server can be set up to collect data from these devices (called agents) and ensure that your network is operating properly. Although SNMP is mostly used to monitor connectivity devices, many other network devices are SNMP-compatible
as well. The most current version is SNMPv3.
Port 389—Lightweight Directory Access Protocol (LDAP)
Lightweight Directory Access Protocol (LDAP) is a directory services protocol. LDAP is designed to access information stored in an information directory typically known as an LDAP directory or LDAP database. LDAP provides you with the access, regardless of the client platform from which you’re working. You can also use access control lists (ACLs) to set up who can read and change entries in the database using LDAP. Often works in conjunction with Active Directory to provide user authentication and management in a network. It is the successor to the DAP (Directory Access Protocol).
Port 443—Hypertext Transfer Protocol Secure (HTTPS)
Hypertext Transfer Protocol Secure (HTTPS) can be used to encrypt traffic between a web server and client securely. Connections are secured using either Secure Sockets Layer (SSL) or Transport Layer Security (TLS).
Port 445—Server Message Block (SMB)/Common Internet File System (CIFS)
Server Message Block (SMB) is a protocol originally developed by IBM but then enhanced by Microsoft, IBM, Intel, and others. It’s used to provide shared access to files, printers, and other network resources and is primarily implemented by Microsoft systems. In a way, it can function a bit like FTP only with a few more options, such as the ability to connect to printers, and more management commands. It’s also known for its ability to make network resources easily visible through various Windows network apps (such as Network in File Explorer).
Common Internet File System (CIFS) is a Microsoft-developed enhancement of the SMB protocol, which was also developed by Microsoft. The intent behind CIFS is that it can be used to share files and printers between computers, regardless of the operating system that they run. It’s the default file and print sharing protocol in Windows.
Port 3389—Remote Desktop Protocol (RDP)
Remote Desktop Protocol (RDP) allows users to connect to remote computers and run programs on them. When you use RDP, you see the desktop of the computer you’ve signed into on your screen. The computer in front of you is the client and the computer you’re logging into is the server. RDP client software is available for Windows, Linux, macOS, iOS, and Android. Microsoft’s RDP client software is called Remote Desktop Connection. The server uses its own video driver to create video output and sends the output to the client using RDP. RDP also supports sound, drive, port, and network printer redirection.
What is a host ?
To communicate on a TCP/IP network, each device needs to have a unique IP address. Any device with an IP address is referred to as a host. This can include servers, workstations, printers, routers, and other devices. If you can assign it an IP address, it’s a host. As an administrator, you can assign the host’s IP configuration information manually, or you can have it automatically assigned by a DHCP server. On the client, this is done through the network adapter’s TCP/IP properties.
What is an IPv4 address ?
An IPv4 address is a 32-bit hierarchical address that identifies a host on the network. It’s typically written in dotted-decimal notation, such as 192.168.10.55. Each of the numbers in this example represents 8 bits (or 1 byte) of the address, also known as an octet.
