Ports & Protocols Flashcards

1
Q

What is TCP?

A

Transport Control Protocol.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which protocol guarantees info delivery?

A

Transfer Control Protocol (TCP). UDP is “best effort”.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is UDP?

A

User Datagram Protocol (UDP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a benefit of UDP?

A

Faster than TCP (Transfer Control Protocol)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is Transfer Control Protocol really good for?

A

File transfer, email, and web page requests.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is UDP really good for?

A

Audio and streaming. Since there is no guarantee the connection was made you can loose data, but you gain speed. That’s acceptable with audio and stream (normally)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is meant by TCP being connection-orientated?

A

Transfer Control Protocol ensures that a connection is established between the sender and the receiver. It is reliable in that you know the message will be received.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Why is UDP considered Connection-less orientated Protocol?

A

User Datagram Protocol will only promise to send the request to the target. It doesn’t ensure the target is ready to receive, or that it has been received. Fire and pray.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How does every TCP (transfer control protocol) session start?

A

3-way handshake

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a 3-way handshake composed of, and what protocol uses it?

A

TCP uses it. It is 3 packets that go back and forth from the sender to the destination to establish connection. The packets have no payload.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Describe the 3-way handshake process.

A

TCP sets up the connection by sending a SYN packet to the destination machine, the destination then sends back a SYN/ACK packet, and TCP then sends its ACK packet back.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What else is being set up in the 3-way handshake besides connection?

A

Flow control. They are telling each other how fast they can send and receive data, and agreeing on an optimal choice.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

In TCP, what must occur before sending any data?

A

A connection via the 3-way handshake (also identify the flow control)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Every time a data packet is sent in TCP what should occur?

A

The destination should send an acknowledgement. If not it will need to send again.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Explain an “error” message in terms of TCP

A

During the 3-way handshake the destination did not acknowledge. The initiator send numerous attempts until its default limit was reached. Then provided the user with an error message.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

TCP sends packets, what does UDP send?

A

User Datagram Protocol sends datagrams.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

TCP and UDP both use ports. What is another name for ports?

A

service identifiers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are ports, or service identifiers?

A

Ways of breaking up channels so you can multiple different applications over them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Ports, or service identifiers are specifically set up for what?

A

Each port, or group of ports is for a specific exchange. The computer is listening for messages that apply to the specific port, through that port. For example, Port 80 is reserved for HTTP traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Who decides what ports are reserved for specific traffic?

A

(IANA) Internet Assigned Numbers Authority

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

How many ports are there in a computer?

A

0 - 65535 (so 65536)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What ports are reserved for “well known” ports (ie. DNS or HTTPS)

A

0 - 1023

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What set of ports are registered, but at the moment unassigned by IANA

A

1024 - 49151

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What set of ports are unassigned and open for anyone to use? Also known as Dynamic.

A

49152 - 65535

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

If a server is not listening to a certain port when a request is made what will happen

A

It will not respond

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

If I am a developer that has made a new protocol, where would I go to get a port assigned to my protocol?

A

IANA (Internet Assigned Authority)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is the dynamic assigned SOURCE port that a client uses to send out a request to establish a connection called?

A

Ephemeral Port

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is a source port?

A

This is the port that the client machine uses to send out the message hoping to establish a connection with a server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

How are source ports (Ephemeral Ports) chosen?

A

They are randomly assigned from a cache of ports that the system uses. Ex: Windows uses a cache of 1025 - 5000. One of these would be assigned arbitrarily to the client machine.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is FTP?

A

File Transfer Protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What ports do FTP run on?

A

TCP port 20 and 21.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Why does FTP (File Transfer Protocol) use 2 TCP ports?

A

One port is used to send the command communications (log me in, authenticate me, upload this file, etc), and the other port is used for data transfers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is a problem with FTP (file transfer protocol)?

A

It is insecure. It is an unencrypted protocol. A sniffer in the middle between A and B can see all the information being exchanged (this includes passwords, usernames, data, everything)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is TFTP?

A

Trivial File Transfer Protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Is TFTP run on TCP ports or UDP ports?

A

UDP ports.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Is FTP run on TCP or UDP ports?

A

TCP ports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What port does Trivial File Transfer Protocol (TFTP) run on?

A

User Datagram Protocol (UDP) ports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

How does TFTP differ from FTP?

A

It is run on UDP ports. It transfers data to a remote machine with basically no commands and no authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Using TFTP what is all you need to make your transfer?

A

Remote end and file name. This IP address, get this .doc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What is ARP?

A

Address Request Protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What layer is Address Request Protocol (ARP) located?

A

Data Link, Layer 2.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

How does Address Request Protocol work?

A

Requests MAC addresses for a given IP address. “I have a packet for 192.168.1.5, which computer is that, tell me, I am 192.168.1.1. (this is done on the same network, the package is already within the network, now its trying to get to is destination). The owner of the IP would then give the MAC address so the package can be delivered.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is a problem with ARP (Address Request Protocol)

A

No authentication. A spoof can be placed that just says its everything so now all traffic goes to it. (Man in the middle)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What is DHCP?

A

Dynamic Host Control Protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What does DCP (Dynamic Host Control Protocol)

A

Assign an IP to a machine at boot time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Why would a machine need to use a DHCP (Dynamic Host Control Protocol) server?

A

If you have not statically assigned, manually assigned, an IP address to your machine it can request one from a DHCP server every time it boots up.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What is a DHCP machine, in terms of the network?

A

It is one server on the network that assigns dynamic IP addresses to machines that request one. (because they were not manually assigned an IP address)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

How does the DHCP server work? (Dynamic Host Control Protocol)

A

A machine asks for a DHCP server, it responds, the machine requests an IP address, the DHCP either gives it one from its pool or it can select one it has already identified as reserved for that machine’s MAC address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What is a MAC address

A

Media Access Control address. Unique identifier assigned to network interfaces for communications on the physical network segment.

50
Q

How do you assure that a computer using a DHCP server will get the same IP address everytime?

A

You would need to associate the machines MAC address with a specific IP address within the DHCP server. It will associate that MAC address with the correct IP. If not it will just assign a random IP from its pool of IP addresses

51
Q

How does BOOTP work?

A

When a client machine turned on it would get a address from BOOTP but it would also boot up from there as well. (earlier form of DHCP) there was no hard drive or media on the terminal.

52
Q

What is ICMP?

A

Internet Control Message Protocol

53
Q

What is Internet Control Message Protocol (ICMP) used for?

A

Management messages, not data payload. Most common is a “ping”. Basically checking to see if the devices on the network are awake and working. The requested machine would send an “echo” acknowledgment

54
Q

What is RTP? (VoIP Protocols)

A

Real-time Transport Protocol

55
Q

What does Real-time Transport Protocol do?

A

Defines type of packets used to move voice or data from a server to clients

56
Q

What is SIP (VoIP Protocols)?

A

Session Initiation Protocol and H.323

57
Q

What does Session Initiation Protocol and H.323 do?

A

Runs on top of Real-time Transport Protocol (RTP). It handles the initiation, setup, and delivery of VoIP sessions.

58
Q

What is RTSP (VoIP Protocols)?

A

Real-time Streaming Protocol

59
Q

What does Real-time Streaming Protocol (RTSP) do?

A

Runs on top of RTP.

60
Q

What is VoIP?

A

Voice over IP.

61
Q

What technology allows for specific phones to plug into the network and communicate using the normal computer network?

A

Voice over IP. (VoIP).

62
Q

What protocols allow for VoIP systems to run on the network?

A

Real-time Transport Protocol (RTP)
Session Initiation Protocol (and H.323) (SIP)
Real-time Streaming Protocol (RTSP)

63
Q

What is DNS?

A

Domain Name Service (U53)

*Runs over port 53.

64
Q

What does Domain Name Service (DNS) do?

A

Translates human friendly names to machine friendly addresses.

65
Q

What are some potential attacks is Domain Name Service (DNS) susceptible to?

A

Redirect, intercept, or deny services

66
Q

What are some CONS to Domain Name Service (DNS)

A

No integrity, confidentiality, or authentication.

67
Q

What is LDAP?

A

Lightweight Directory Access Protocol

*Runs on Port T389

68
Q

What is Lightweight Directory Access Protocol (LDAP) used for?

A

Used for lookups (queries) over a network.

*Looks up many things to include user authentication info.

69
Q

What is NetBOIS?

A

Network Basic Input Output System

*Ports U/T 135 - 139

70
Q

What is a common attack for NetBOIS?

A

Worm attacks

71
Q

What was the Predecessor for LDAP?

A

NetBOIS

72
Q

When talking about Ports U/T 135 - 139, what does the U and T stand for?

A

U= UTP, T = TCP. It means that the protocol that runs on ports 135 -139 run on both UTP and TCP ports.

73
Q

What is NTP? And What port(s) does it run on?

A

Network Time Protocol

*U123

74
Q

What is IGMP, and what port(s) does it run on?

A

Internet Group Management Protocol

* Not sure about the port :/

75
Q

What is SNMP, and what port does it run on?

A

Simple network management protocol

*port T/U 161

76
Q

What is IM?

A

Instant Messaging.

77
Q

Instant Messaging (IM) allows peer to peer communication. What are the “peers”?

A

Computers.

78
Q

In IM, one computer sends a message to another. Those computers use a brokered messenger server. What does that mean?

A

One computer doesn’t send a message directly to another, instead it sends it to a messenger server, which then sends it to the recipient.

79
Q

There are many IM programs that work in different ways, what does that mean in regards to what ports you would expect an IM protocol to located on?

A

There can be any number of ports used in this case. However, many run over port 80.

80
Q

What is IRC, and what port will you find it on?

A

Internet Relay Chat

* located on port 6667

81
Q

What is IRC an early form of?

A

Instant messaging, internet chatting.

*text only

82
Q

How can IRC be integrated on an attack?

A

A malicious user can implant a BOT on your computer, and then send control instructions to the computer using this Internet Relay Chat.

83
Q

What is NNTP, and what port will you find it?

A

Network News Transfer Protocol

* 119

84
Q

What is SMTP and what port will you find it?

A

Simple Mail Transfer Protocol

* T25

85
Q

What is POP, and what server will you find it?

A

Post Office Protocol

* T110

86
Q

What is IMAP, and what port will you find it?

A

Internet Message Access Protocol

* T143

87
Q

What protocol sends mail to a mail server?

A

Simple Mail Transfer Protocol (SMTP)

88
Q

What protocol(s) are used to retrieve the mail that was sent to the mail server using Simple Mail Transfer Protocol (SMTP).

A

Post Office Protocol (POP) and Internet Message Access Protocol (IMAP)

89
Q

What is TELNET? What port will you find it?

A

TCP/IP Terminal Emulation Protocol

*T23

90
Q

What is RLOGIN?

A

Remote Login

91
Q

What is RSH?

A

Remote Shell

92
Q

What is RCP?

A

Remote Copy.

93
Q

What is X11?

A

X Window System

94
Q

What did the TELNET and R suite of tools (RLOGIN, RSH, RCP) allow the user to do?

A

Remotely access another terminal without physically sitting at it.
*lacked security. No encryption or authentication.

95
Q

What does X11 allow the user to do?

A

Forward a display. Normally the computer would use the video cable to send a display to the computer’s monitor. X11 allows you to use your network to send a display to another terminal on the network.
*unencrypted, so all the movements could be monitored.

96
Q

When you use a insecure program like X11, what would you need to do to make it secure?

A

Run it through a Secure Shell.

97
Q

What is CIFS, and SMB?

A

Common Internet File System and Server Message Block. This is a file sharing protocol, a server hosts files that clients can download
* various authentication methods are used.

98
Q

What is NFS?

A

Network File System. This is another file sharing system.

* authentication is possible through Secure RPC (Remote

99
Q

Which file sharing systems are considered Windows based?

A

Common Internet File System (CIFS) and Server Message Block (SMB)

100
Q

Which file sharing system is UNIX LINIX Based?

A

Network File System (NFS)

101
Q

What is SNFS?

A

Secure Network File System

*Authenticates each request, which increases the overhead from NFS.

102
Q

Why wasn’t Secure Network File System (SNFS) widely adopted?

A

They used time synchronized servers, meaning if the times weren’t synced up the communication would not happen.

103
Q

What is SFTP?

A

Secure FTP

  • part of the Secure Shell Suite
  • You can do everything that was possible with FTP (File Transfer Protocol) but now its encrypted.
104
Q

What port does Secure FTP (SFTP) run off of?

A

TCP Port 22

*default port for secure shell suite

105
Q

What is HTTP, and what port would it be found?

A

Hypertext Transfer Protocol

  • T80
  • Standard web based communications
  • Unencrypted
106
Q

What is HTTPS, and what port would it be found.

A

Hypertext Transfer Protocol over SSL or TLS

  • T443
  • SSL is Secure Socket Layer Connection
  • Takes all the web based communications you would find in HTTP and puts a layer of encryption over it.
107
Q

What is S-HTTP

A

Secure Hypertext Transfer Protocol

*not the same as HTTPS

108
Q

What kind of security protocols can you implement on Layer 1?

A

Physical security (like placing a locked box over a cable outlet)(door locks). Choosing more protected cables.

109
Q

What kind of security protocols can you implement on Layer 2.

A

PPTP, Layer 2 Forwarding, Layer 2 Tunneling Protocol, wireless network security, MPLS.
*you can protect layer 2 traffic using tunneling protocols

110
Q

What kind of security protocols can you implement on Layer 3?

A

GRE (Generic Routing Encapsulation), IPSec (IP Security)

111
Q

What kind of security protocols can you implement on Layer 4?

A

SSL (Secure Socket Layer), TLS (Transport Layer Security), WTLS ( Wireless Transport Layer Security), SSH (Secure Shell Protocol), SOCKS (Socket Secure).
*This is where TCP is. So when we set up the 3way handshake we can add more handshakes that set up the encryption.

112
Q

What kind of security protocol can you implement on Layer 5+?

A

This is the application layer. You can have add on’s to the application itself. S-RPC, DNSSEC, S-HTTP

113
Q

In regards to Layer 2 security what is PPTP?

A

Point to point tunneling protocol.

  • I’m going to encapsulate more headers on my layer 2 frame, and the encapsulated headers are going to handle encryption between point A to point B.
  • “tunnel” this layer 2 traffic in more encryption
114
Q

What is L2F?

A

Layer 2 Forwarding

  • Not IP dependent
  • Relies on PPP for authentication (tunnels PPP traffic)
  • Used for VPNs
  • No encryption by itself.
115
Q

What is IPSec?

A

Internet protocol security
* Encapsulates at Layer 3 ( Network Layer)
* Mutual node authentication
* Can authenticate users but requires L2TP
* Crypto implementation agnostic
* Client to client, or node to node.
* Mandatory for IPv6 implementation
Does not work with NAT (unless NAT-Transversal is used)

116
Q

What is GRE?

A

Generic Route Encapsulation

  • Encapsulates Layer 3 (Network Layer) packets in IP tunnel
  • Used to secure VPNs
  • Creates a virtual point to point link with destination
  • Supports multicast protocols (IPSec doesn’t)
117
Q

What is SOCKS?

A

Socket Security

  • Allows internal clients to access external resources
  • Allows external access to internal clients
  • Provides authentication and encryption
  • A type of proxy server that gets in the way between Point A and Point B and requires me to authenticate before I can get to the end resource (Point B)
  • When one person in the office has access to a certain website, but nobody else does, this allows that user to access that point after authentication.
118
Q

What is SSH

A

Secure Shell

  • Creates tunnels that other applications can use
  • Provides server and client authentication and encryption
119
Q

What is SSL and TLS?

A

Secure Socket Layer and Transport Layer Security

  • Encrypts client-server communication
  • Used by protocols (e.g HTTPS) for security
  • Server authentication to client mandatory
  • Client authentication to server optional
120
Q

What does a SSL(Secure Socket Layer) and TLS (Transport Layer Security) handshake include?

A
  • Encryption negotiation
  • Identification of server and/or client
  • Key exchange
121
Q

What is S-RPC

A

Secure Remote Procedure Call

  • Based on DES (Data Encryption Standard) encryption algorithm
  • Uses public key scheme for encryption
  • Laying encryption on top of RPC which is just one computer giving instruction to another.
122
Q

What is DNSSEC?

A

Domain Name System Security

  • Provides authentication and integrity of DNS (Domain Name System) answers
  • Designed to protect against cache poisoning
  • Uses public key schemes, but does not do encryption