The protocols that make networking possible — how they work, what ports they use, and what to watch for.
Purpose: Automatically assign IP configuration (IP address, subnet mask, default gateway, DNS servers) to devices on a network, eliminating manual configuration.
How it works — DORA Process:
Scopes: A scope is the pool of IP addresses a DHCP server can assign. It includes the range, exclusion list (addresses not to hand out), lease duration, and options (gateway, DNS, etc.).
Reservations: Binding a specific MAC address to a permanent IP within a scope. Useful for printers, servers, and infrastructure devices that need stable addresses without static configuration.
Rogue DHCP servers (evil twin attack) can distribute malicious DNS/gateway settings. Mitigate with DHCP snooping on switches, which trusts only designated uplink ports. Also watch for DHCP starvation attacks that exhaust the address pool.
APIPA address (169.254.x.x) indicates DHCP failure — client couldn't reach any server. Causes: DHCP server down, network isolation, scope exhaustion, or corrupted lease. Fix: check server status, verify scope availability, try ipconfig /release && ipconfig /renew.
Purpose: Translates human-readable domain names (google.com) into machine-readable IP addresses (142.250.80.46). Without DNS, we'd need to memorize IP addresses for every website.
Resolution process (recursive query):
Key Record Types:
DNS cache poisoning injects false records. Mitigate with DNSSEC (digital signatures on records), randomize source ports, and use encrypted DNS (DoH on port 443 or DoT on port 853). DNS tunneling can exfiltrate data via encoded subdomain queries.
nslookup or dig timeouts suggest DNS server unreachable. Stale cache causes old IP resolution. DNS hijacking redirects queries to malicious servers. Fix: flush cache (ipconfig /flushdns), verify resolver IP, check DNSSEC validation.
Purpose: HTTP is the foundation of web communication — requesting and delivering resources (HTML, images, APIs). HTTPS adds encryption via TLS/SSL.
How it works: Client sends an HTTP request (method + URI + headers). Server responds with a status code + headers + optional body. Methods: GET (retrieve), POST (submit data), PUT (update), DELETE (remove), PATCH (partial update).
Key Status Codes:
TLS Basics: HTTPS uses TLS to establish an encrypted channel. The handshake involves: (1) Client Hello with supported cipher suites, (2) Server Hello with chosen suite + certificate, (3) Key exchange to establish a shared symmetric key, (4) Encrypted communication begins.
Always prefer HTTPS. Watch for expired certificates, weak cipher suites, and misconfigured HSTS headers. HTTP Strict Transport Security (HSTS) forces browsers to use HTTPS. Certificate pinning and OCSP stapling improve security further.
Browser certificate warnings (expired cert, hostname mismatch, self-signed). Connection refused on port 443 means the web service isn't running or a firewall blocks it. Use curl -v https://example.com to see the handshake details.
FTP Purpose: Transferring files between client and server over a network. Uses separate control (commands) and data (file contents) channels — hence two ports.
FTP Modes: Active mode — server initiates data connection back to client (port 20 → client ephemeral). — client initiates data connection to server (safer through firewalls).
SFTP (SSH File Transfer Protocol): Runs over SSH (port 22). Encrypts both commands and data in a single secure tunnel. Replaces insecure FTP entirely in modern environments.
Classic FTP transmits credentials in cleartext — easily captured. Use SFTP or FTPS (FTP over SSL/TLS on port 990) instead. FTP active mode can expose the server to inbound attacks. Disable anonymous FTP unless explicitly required.
Passive mode failing behind firewalls — the server advertises an IP/port the client can't reach. FTP data connection timeout — check NAT/firewall stateful inspection for established data channels. SFTP failures usually relate to SSH key auth or permissions.
Purpose: Encrypted remote login and command execution. Replaces insecure telnet. Also used for secure file transfer (scp, sftp), port forwarding/tunneling, and key-based authentication.
How it works: Client connects to server on port 22. They negotiate a symmetric session key using Diffie-Hellman key exchange. Server authenticates using password or public key. All subsequent traffic is encrypted.
Common flags: ssh -i key.pem user@host (specify key), ssh -L 8080:localhost:80 (local port forward), scp file.txt user@host:/path/ (secure copy).
Disable password authentication — use key-based auth exclusively. Change default port (22) to reduce automated scanning (does not provide real security, only obscurity). Use fail2ban to block brute-force attempts. Restrict access with AllowUsers or Match directives in sshd_config. Keep OpenSSH updated.
"Connection refused" — SSH service not running or firewall blocking port 22. "Permission denied (publickey)" — wrong key or disabled key auth. "Host key verification failed" — server was reinstalled; remove old key from ~/.ssh/known_hosts.
Purpose: Graphical remote desktop access to Windows machines. Sends screen updates and receives keyboard/mouse input over an encrypted channel.
How it works: RDP uses the Remote Desktop Protocol (RDP) over TCP. It negotiates security (TLS or RDP), authenticates the user, then streams a compressed graphical session. NLA (Network Level Authentication) authenticates before the full session is established, reducing attack surface.
RDP is a prime target for attackers (BlueKeep, Farflame). Never expose RDP directly to the internet. Use VPN access, enforce NLA, apply all security patches, use strong passwords, enable MFA where supported, and limit RDP access via firewall rules to specific source IPs.
"Cannot connect to remote computer" — RDP service not running (check TermService), firewall blocking 3389, or Network Level Authentication mismatch. "Authentication error" — often caused by credential caching or group policy restrictions on RDP access.
Purpose: Monitoring and managing network devices (routers, switches, servers, printers). Collects performance data and triggers alerts on thresholds.
How it works: The manager (monitoring server) polls agents (devices) using GET and GETNEXT requests. Agents respond with values from the MIB (Management Information Base) — a hierarchical database of managed objects. Devices can also send unsolicited TRAP or INFORM messages to the manager.
Versions: SNMPv1 (community strings, no encryption — insecure), SNMPv2c (improved performance, still community-based), SNMPv3 (adds authentication and encryption — use this).
Never use SNMPv1/v2c in production — community strings traverse the network in cleartext. SNMPv3 provides auth (SHA/MD5) and privacy (AES/DES). Restrict SNMP access with ACLs — only allow specific monitoring servers to query devices.
Monitoring tool shows no data — SNMP service not enabled on device, wrong community string/version, or firewall blocking UDP 161. OID mismatches cause "no such object" errors.
Purpose: Resolves an IP address to a MAC (physical) address on the local network segment. Every IP packet needs a destination MAC to be delivered on the local link.
How it works:
Commands: arp -a (Windows) or ip neigh show (Linux) to view the ARP cache.
ARP spoofing/poisoning lets an attacker intercept traffic by sending fake ARP replies. Defend with static ARP entries for critical servers, DHCP snooping + DAI (Dynamic ARP Inspection) on switches, and ARPwatch for anomaly detection.
"Incomplete" ARP entries indicate the target didn't respond (device offline or wrong VLAN). Stale entries persist until timeout — clear with arp -d if needed. MAC address flapping suggests a loop or ARP poisoning attempt.
Purpose: Error reporting and diagnostic messaging between IP devices. ICMP messages are embedded inside IP packets (protocol number 1) and carry type/code information.
Key Message Types:
Important: ICMP is often mistakenly called "the ping protocol." Ping is just one ICMP message type. Traceroute relies heavily on ICMP Type 11 (Time Exceeded) messages.
Unrestricted ICMP can leak information (path MTU discovery, topology mapping). Some organizations block all ICMP, but this breaks PMTU discovery and causes blackhole framing. Best practice: allow ICMP Type 3/11/12 (unreachable/time exceeded/path MTU) inbound and outbound; restrict echo request/reply.
| Protocol | Port(s) | Transport | Purpose |
|---|---|---|---|
| DHCP | 67/68 UDP | UDP | Auto IP assignment |
| DNS | 53 TCP/UDP | UDP (queries), TCP (zone xfer) | Name resolution |
| HTTP | 80 TCP | TCP | Web traffic (unencrypted) |
| HTTPS | 443 TCP | TCP | Encrypted web traffic |
| FTP | 20, 21 TCP | TCP | File transfer (unencrypted) |
| SFTP | 22 TCP | TCP | File transfer over SSH |
| SSH | 22 TCP | TCP | Encrypted remote shell |
| RDP | 3389 TCP | TCP | Remote desktop (Windows) |
| SNMP | 161/162 UDP | UDP | Network device management |
| ARP | — (Layer 2) | — | IP-to-MAC resolution |
| ICMP | Protocol 1 | — | Error reporting & diagnostics |
| Telnet | 23 TCP | TCP | Unencrypted remote terminal (deprecated) |
| SMTP | 25 TCP / 587 TCP | TCP | Email submission |
| POP3 | 110 TCP / 995 TCP (POP3S) | TCP | Email retrieval |
| IMAP | 143 TCP / 993 TCP (IMAPS) | TCP | Email retrieval with server-side sync |
| NTP | 123 UDP | UDP | Time synchronization |
ipconfig /all and identify your DHCP server, lease obtained/expired times, and DNS servers.ipconfig /flushdns, then nslookup google.com — observe the resolution process.nslookup -type=mx gmail.com to find mail exchange records.arp -a — note the interface IP, physical address, and type (dynamic/static).ping -t google.com.http in Wireshark — examine request/response headers.tls — observe the TLS handshake (ClientHello, ServerHello, Certificate, KeyExchange).dig example.com ANY to see all record types.dig @8.8.8.8 example.com NS, then query the authoritative nameserver directly.dig -x 8.8.8.8 (PTR record lookup).ipconfig /displaydns, on Linux sudo resolvectl statistics.