Protocols Flashcards
TCP and UDP
Transported inside of IP
– Encapsulated by the IP protocol
* Two ways to move data from place to place
– Different features for different applications
* OSI Layer 4
– The transport layer
* Multiplexing
– Use many different applications at the same time
– TCP and UDP
TCP
Transmission Control Protocol
Connection-oriented network communication
* Connection-oriented
– A formal connection setup and close
* “Reliable” delivery
– Recovery from errors
– Can manage out-of-order messages or retransmissions
* Flow control
– The receiver can manage how much data is sent
UDP
User Datagram Protocol
Connectionless network communication
* Connectionless
– No formal open or close to the connection
* “Unreliable” delivery
– No error recovery
– No reordering of data or retransmissions
* No flow control
ICMP
Internet Control Message Protocol
– “Text messaging” for your network devices
* Another protocol carried by IP - Not used for data transfer
* Devices can request and reply to administrative requests
– Hey, are you there? / Yes, I’m right here.
* Devices can send messages when things don’t go well
– That network you’re trying to reach is not reachable from here
– Your time-to-live expired, just letting you know
SNMP
Simple Network Management Protocol - udp/161 - Gathers statistics from network devices
* v1 – The original – Structured tables, in-the-clear
* v2 – A good step ahead – Data type enhancements, bulk transfers – Still in-the-clear
* v3 – The new standard – Message integrity, authentication, encryption
ARP
Address Resolution Protocol - Resolves IP (logical) address to MAC (physical)
DNS
Domain Name System - udp/53 - Converts names to IP addresses - Large transfers may use tcp/53
DHCP
Dynamic Host Configuration Protocol - udp/67, udp/68
* Automated configuration of IP address, subnet mask and other options. Requires a DHCP server
* Dynamic / pooled
– IP addresses are assigned in real-time from a pool
– Each system is given a lease
– Must renew at set intervals
* Reserved
– Addresses are assigned by MAC address
– Quickly manage addresses from one location
HTTP
Hypertext Transfer Protocol - tcp/80
– Communication in the browser
– And by other applications
* In the clear
– Supported by nearly all web servers and clients
HTTPS
Hypertext Transfer Protocol - tcp/443
– Communication in the browser
– And by other applications
* encrypted (over TLS/SSL)
– Supported by nearly all web servers and clients
LDAP
LDAP (Lightweight Directory Access Protocol) - tcp/389
– Store and retrieve information in a network directory
LDAPS
(LDAP Secure) - tcp/636
– A non-standard implementation of LDAP over SSL
– Still in use today
Syslog
udp/514
* Standard for message logging
– Diverse systems, consolidated log
* Usually a central log collector
– Integrated into the SIEM
* You’re going to need a lot of disk space
– Data storage from many devices over an extended timeframe
NTP
Network Time Protocol - udp/123
* Switches, routers, firewalls, servers, workstations
– Every device has its own clock
* Synchronizing the clocks becomes critical
– Log files, authentication information, outage details
* Automatic updates
* Flexible - You control how clocks are updated
* Very accurate
– Accuracy is better than 1 millisecond
IMAP4
Internet Message Access Protocol v4 - tcp/143
– Manage email inbox from multiple clients
* Receive emails from an email server
– Authenticate and transfer