TCP/IP Model (1.1, 1.5, & 5.3) Flashcards
TCP/IP Model
o TCP/IP Model
▪ Also known as TCP/IP stack or the DoD Model
▪ Alternative to the OSI Model
▪ More relevant model for network designers since it’s based on TCP/IP
▪ Only a 4-layer model
OSI Model to TCP/IP Model
Network Interface (Layer 1) (Physical and Electrical characteristics / bits / coax, optic, twisted-pair)
▪ Physical and electrical characteristics
▪ Describes how to transmit bits across the network (1’s and 0’s)
▪ Determines how interface uses network medium
▪ Coaxial, Optical fiber, or Twisted-pair copper cabling
▪ Examples:
● Ethernet, Token Ring, FDDI, RS-232
Internet (Layer 2) (data into IP datagrams -> routes across networks > external connection)
▪ Packages data into IP datagrams
● Contains source and destination IPs
● Forwards datagrams between hosts across the networks
▪ Routes IP datagrams across networks
▪ Connectivity occurs externally
▪ Examples:
● IP, ICMP, ARP, RARP
Transport (Layer 3) (Communication session management / TCP / UDP / RTP)
▪ Provides communication session management between hosts
▪ Defines level of service and status of connection used for transport
▪ Examples:
● TCP
● UDP
● RTP
Application (Layer 4)
▪ Defines TCP/IP application protocols
▪ Defines how programs interface with the transport layer service
▪ Layer with which the user interacts
▪ Examples:
● HTTP, TELNET, FTP, SNMP, DNS, SMTP, SSL, TLS, …
Data Transfer Over Networks (0 - 65,535 / 0 - 1023 / Ephem = 1024 - 65,535)
(Ports)
o Ports
▪ Port numbers can be 0 to 65,535
▪ “Well-known” & Reserved Ports
● Ports 0 to 1023
▪ Ephemeral Ports
● Short-lived transport port that is automatically selected from a predefined range
● Ports 1024 to 65,535
Data Transfer
IPv4 Packets
Overhead of TCP and UDP
Ports and Protocols
o File Transfer Protocol FTP (Port 20, 21)
o Secure Shell SSH (Port 22)
o SSH File Transfer Protocol SFTP (Port 22)
o Telnet (Port 23)
o Simple Mail Transfer Protocol SMTP (Port 25)
o Domain Name Service DNS (Port 53)
o Dynamic Host Control DHCP (Port 67, 68)
o Trivial File Transfer TFTP (Port 69)
o Hyper Text Transfer HTTP (Port 80)
o Post Office Protocol v3 POP3 (Port 110)
o Network Time Protocol NTP (Port 123)
o NetBIOS (Port 139)
o Internet Mail Application IMAP (Port 143)
o Simple Network Management SNMP (Port 161)
o Lightweight Directory Access LDAP (Port 389)
o HTTP Secure HTTPS (Port 443)
o Server Message Block SMB (Port 445)
o System Logging Protocol Syslog (Port 514)
o Simple Mail Transfer Protocol Transport Layer Security SMTP TLS (Port 587)
o LDAP Secure LDAPS (Port 636)
o Internet Message Access Protocol over SSL IMAP over SSL (Port 993)
o Post Office Protocol Version 3 over SSL POP3 over SSL (Port 995)
o Structured Query Language Server Protocol SQL (Port 1433)
o SQLnet Protocol (Port 1521)
o MySQL (Port 3306)
o Remote Desktop Protocol RDP (Port 3389)
o Session Initiation Protocol SIP (Port 5060, 5061)
Ports to Remember
File Transfer Protocol FTP (Port 20, 21) (Transfers files / unsecure)
▪ Transfers computer files between a client and server on a computer network
▪ Unsecure method
▪ Data transferred in the clear
Secure Shell SSH (Port 22) (Network services securely over unsecured network / remote login by users)
▪ Cryptographic network protocol for operating network services securely over an unsecured network
▪ Best known for remote login to computer systems by users
SSH File Transfer Protocol SFTP (Port 22) (file transfer/management/access over reliable data steram)
▪ Provides file access, file transfer, and file management over any reliable data stream
Telnet (Port 23) (bidirectional text-oriented communication via virtual terminal / like ssh but insecure)
▪ Provides bidirectional interactive text-oriented communication facility using a virtual terminal connection
▪ Like SSH, but insecure
Simple Mail Transfer Protocol SMTP (Port 25) (sending electronic mail)
▪ Internet standard for sending electronic mail
▪ RFC 821 was defined originally in 1982
▪ RFC 5321 developed in 2008 (current version)
Domain Name Service DNS (Port 53) (naming system / domain names into IP addresses)
▪ Hierarchical decentralized naming system for computers, services, or other resources connected to the Internet or a private network
▪ Converts domain names to IP addresses
Dynamic Host Control DHCP (Port 67, 68) (dynamically assigns IP address / able to request IP / easier on net admins)
▪ DHCP server dynamically assigns an IP address and other network configuration parameters to a client
▪ Enables computers to request IP addresses and networking parameters automatically?
▪ Reduces burden on network administrators
Trivial File Transfer TFTP (Port 69) (Transmits files / used for booting OS from LAN server / no user authentication / stripped-down va. of FTP )
▪ Transmits files in both directions of a client-server application
▪ Used for booting an operating system from a local area network file server
▪ Doesn’t provide user authentication or directory visibility
▪ Essentially a stripped-down version of FTP
Hyper Text Transfer HTTP (Port 80) (data communication for WWW. / collaborative and hypermedia )
▪ Foundation of data communication for WWW
▪ Designed for distributed, collaborative, and hypermedia presentation across many devices
Post Office Protocol v3 POP3 (Port 110) (local email)
▪ Used by local e-mail
Network Time Protocol NTP (Port 123) (clock synchronization / created in 1985)
▪ Provides clock synchronization between computer systems over packet-switched, variable-latency data networks
▪ Created in 1985, one of the oldest Internet protocols in current use
NetBIOS (Port 139) (file and printer sharing / Netbasic input/output system)
▪ Network Basic Input/Output System
▪ Provides services allowing applications on separate computers to communicate over a local area network for file and printer sharing
Internet Mail Application IMAP (Port 143) (accessing your email board from a mail server or service)
▪ Provides e-mail clients to retrieve e-mail messages from a mail server over a TCP/IP connection
▪ Allows the end user to view and manipulate the messages as if they’re stored locally
Simple Network Management SNMP (Port 161) (collecting and organizing information about managed devices / can modify information as well)
▪ Provides collection and organization of information about managed devices on IP networks
▪ Can modify that information to change device behavior, commonly used in network devices
Lightweight Directory Access LDAP (Port 389) (Communicates with Active Directory / used to store data, authentication and policy of an organization)
▪ Open, vendor-neutral, industry standard for accessing and maintaining distributed directory information services
▪ LDAP and Active Directory use this port
HTTP Secure HTTPS (Port 443) (ecommerce of WWW / adds security to the insecure HTTP protocol)
▪ Foundation of ecommerce on WWW
▪ Designed for adding security to the insecure HTTP protocol
Server Message Block SMB (Port 445) (provides access to files, printers, and miscellaneous communications between devices)
▪ Provides shared access to files, printers, and miscellaneous communications between devices on a network
System Logging Protocol Syslog (Port 514) (sends log data to centralized sever)
▪ Used to send logging data back to a centralized server
Simple Mail Transfer Protocol Transport Layer Security SMTP TLS (Port 587) (secure/encrypted way to send emails)
▪ Secure and encrypted way to send emails
LDAP Secure LDAPS (Port 636)
▪ Open, vendor-neutral, industry standard for accessing and maintaining distributed directory information services
Provides secure directory services
Internet Message Access Protocol over SSL IMAP over SSL (Port 993) (secure/encrypted way of receiving emails)
▪ Secure and encrypted way to receive emails
Post Office Protocol Version 3 over SSL POP3 over SSL (Port 995)
▪ Secure and encrypted way to receive emails
Structured Query Language Server Protocol SQL (Port 1433)
▪ Used for communication from a client to the database engine
SQLnet Protocol (Port 1521)
▪ Used for communication from a client to an Oracle database
MySQL (Port 3306)
▪ Used for communication from a client to the MySQL database engine
Remote Desktop Protocol RDP (Port 3389) (connect to another computer via network connection )
▪ Proprietary protocol developed by Microsoft
▪ Provides a user with a graphical interface to connect to another computer over a network connection
▪ User employs RDP client software for this purpose and the other computer must run RDP server software
Session Initiation Protocol SIP (Port 5060, 5061) (used for internet voice/video calls, VOIP and messaging)
▪ Provides signaling and controlling multimedia communication sessions in applications
▪ Used for Internet telephony for voice and video calls, VOIP, and instant messaging
Ports to Remember
IP Protocol Types
o Transmission Control Protocol (TCP)
o User Datagram Protocol (UDP)
o Internet Control Message Protocol (ICMP)
o Generic Routing Encapsulation protocol (GRE)
o Internet Protocol Security protocol (IPsec)
Transmission Control Protocol (TCP)
▪ A transport protocol that operates at layer 4 of the OSI model
▪ Used on top of the Internet Protocol for the reliable packet transmission
▪ Operates by conducting a three-way handshake between a client and a server, and then establishing the connection
▪ TCP is considered a connection-oriented method of communication
User Datagram Protocol (UDP)
▪ A lightweight data transport protocol that also works on top of IP
▪ Can detect if its packets are corrupted when they are received by a client using a checksum, but there is no connection and no sequencing to the UDP segments
▪ Great for some applications, like streaming audio and video, but it definitely does NOT provide reliable delivery of the data
Internet Control Message Protocol (ICMP)
▪ A network level protocol that is used to communicate information about network connectivity issues back to the sender
▪ ICMP is used a lot by network technicians during troubleshooting, but it is also used by attackers to conduct ping scans and network mapping
Generic Routing Encapsulation protocol (GRE)
▪ A tunneling protocol that was developed by Cisco to encapsulate a wide variety of network layer protocols inside a virtual point-to-point or point-to-multipoint link over an Internet Protocol network
▪ Important to set a smaller maximum transmission unit or MTU size on the tunnel
▪ It does not provide any encryption
Internet Protocol Security protocol (IPsec)
▪ Set of secure communication protocols at the network or packet processing layer that is used to protect data flows between peers
● Authentication Header (AH)
o A protocol within IPSec that provides integrity and authentication
● Encapsulating security payload (ESP)
o Provides encryption and integrity for the data packets sent over IPsec
o Backwards-compatible with most IP routers including those that were not designed to work with IPsec initially
