Ports and protocols

What is FTP used for?

Transferring files between clients and servers.

What layer does FTP operate at?

Application layer (Layer 7).

What ports does FTP use?

TCP 20 and TCP 21.

What is TCP 21 used for in FTP?

Control connection—commands and responses.

What is TCP 20 used for in FTP?

File data in active mode.

Is FTP encrypted?

No

What FTP commands are commonly used to navigate directories and transfer files?

ls, cd, get, and put.

What is SSH used for?

Secure remote command-line access and administration.

What port does SSH use?

TCP 22.

Is SSH encrypted?

Yes

What can you do with SSH?

Remotely log in, execute commands, configure systems, install software, and manage services.

What protocol did SSH replace for secure remote administration?

Telnet.

What is SFTP?

A secure file-transfer protocol that runs over SSH.

What port does SFTP use?

TCP 22.

Is SFTP encrypted?

Yes, through SSH.

What can SFTP do besides upload and download files?

List, rename, delete, and manage files on a remote system.

When would you use SFTP instead of FTP?

When files need to be transferred securely over a network.

What is Telnet used for?

Remote command-line/console access.

What port does Telnet use?

TCP 23.

Is Telnet encrypted?

No. It sends information in cleartext.

What is the secure alternative to Telnet?

SSH.

What is SMTP used for?

Sending email.

What port does traditional SMTP use?

TCP 25.

What is TCP 587 used for?

Email submission from clients to mail servers, typically using TLS/STARTTLS.

Which SMTP port is commonly used by email clients to submit outgoing mail?

TCP 587.

What is STARTTLS?

A method for upgrading an existing connection to use TLS encryption.

What does DNS do?

Translates domain names into IP addresses.

What port does DNS use?

UDP 53 and TCP 53.

Why is UDP 53 normally used for DNS queries?

It's faster and has less overhead than TCP.

When does DNS use TCP 53?

For larger responses and DNS zone transfers.

What is a DNS zone transfer?

Replication of DNS information between DNS servers.

What is DHCP used for?

Automatically assigning IP addresses and network configuration.

What information can DHCP provide?

IP address, subnet mask, default gateway, DNS server, and lease information.

What ports does DHCP use?

UDP 67 and UDP 68.

Which DHCP port is used by the server?

UDP 67.

Which DHCP port is used by the client?

UDP 68.

What is a DHCP lease?

A temporary assignment of an IP address to a client.

What is a DHCP reservation?

A specific IP address permanently associated with a device's MAC address.

What is TFTP?

A simple, lightweight file-transfer protocol using UDP.

What port does TFTP use?

UDP 69.

Does TFTP provide authentication or encryption?

No.

What are common uses for TFTP?

Firmware transfers, network-device configuration, and booting devices.

Why is TFTP useful for network devices during startup?

Devices can download configuration files or OS/firmware images without requiring complex authentication.

What is HTTP used for?

Communication between web browsers/applications and web servers.

What port does HTTP use?

TCP 80.

What port does HTTPS use?

TCP 443

What makes HTTPS secure?

TLS encryption.

What does HTTPS provide?

Confidentiality, authentication, and integrity.

Can applications other than browsers use HTTP/HTTPS?

Yes. APIs and other applications commonly use them.

What is NTP used for?

Synchronizing clocks across networked devices.

What port does NTP use?

UDP 123.

Why is accurate time synchronization important?

It helps with logs, authentication, troubleshooting, security events, and correlating events across systems.

What is SNMP used for?

Monitoring and managing network devices.

What port does SNMP use for queries?

UDP 161.

What port does SNMP Trap use?

UDP 162.

What is an SNMP manager?

The system that monitors and manages network devices.

What is an SNMP agent?

Software running on a managed network device that provides information to the SNMP manager.

What is a MIB?

Management Information Base—a database/structure containing information about managed devices.

What is an SNMP Trap?

An unsolicited alert sent by a network device to an SNMP manager.

Which SNMP version provides authentication, integrity, and encryption?

SNMPv3.

What is LDAP used for?

Accessing and managing directory information such as users, groups, and credentials.

What port does LDAP use?

TCP 389.

What port does LDAPS use?

TCP 636.

What is the difference between LDAP and LDAPS?

LDAP is unencrypted by default; LDAPS uses TLS encryption.

What is a common use of LDAP?

User authentication and directory lookups, including Active Directory environments.

What is SMB used for?

File and printer sharing over a network.

What operating system is strongly associated with SMB?

Microsoft Windows.

What is another name associated with SMB?

CIFS (an older version/name).

What features does SMB provide?

File sharing, permissions, file locking, and printer sharing.

What port does modern SMB commonly use?

TCP 445.

What is Syslog used for?

Collecting and centralizing log messages from network devices and systems.

What port does Syslog traditionally use?

UDP 514.

What is a Syslog server?

A central system that collects and stores log messages from multiple devices.

What is SQL?

Structured Query Language used to communicate with and manage relational databases.

What database system commonly uses TCP 1433?

Microsoft SQL Server.

What is RDP used for?

Remotely connecting to and controlling a computer's graphical desktop.

What port does RDP use?

TCP 3389.

What can you do with RDP?

View/control a remote desktop and run applications remotely.

What is SIP used for?

Setting up, managing, and terminating VoIP communication sessions.

Does SIP carry the actual voice data?

No. SIP handles signaling; other protocols such as RTP typically carry the media.

What ports does SIP commonly use?

UDP/TCP 5060 for SIP and TCP 5061 for SIP over TLS.

What is SIP over TLS?

Encrypted SIP signaling using TLS, commonly on TCP 5061.

What is ICMP?

A Layer 3 protocol used to send network error messages and operational information.

What OSI layer does ICMP operate at?

Layer 3 — Network layer.

Is ICMP used to transfer application data?

No. It is primarily used for control, diagnostics, and error reporting.

What common command uses ICMP?

ping

What does ping test?

Whether a destination is reachable and how long a response takes.

What protocol does traditional traceroute use to reveal routing information?

It relies on TTL expiration and ICMP messages, though the exact probe protocol varies by operating system.

What ICMP message indicates that a packet's TTL has expired?

Time Exceeded.

What type of information can ICMP provide?

Connectivity status and errors such as unreachable destinations or expired TTLs.

Does ICMP use TCP or UDP ports?

No. ICMP does not use port numbers.

What is GRE?

A tunneling protocol that encapsulates network traffic inside IP packets.

What is the purpose of GRE?

To create a virtual tunnel between two endpoints across a network.

What happens when GRE creates a tunnel?

Traffic is encapsulated so the two endpoints appear to have a virtual point-to-point connection.

Does GRE provide encryption?

No.

How can GRE traffic be encrypted?

GRE can be combined with IPsec.

What is a good way to remember GRE?

GRE = a tunnel without built-in security.

What technology is commonly used for site-to-site VPNs?

IPsec.

What is IPsec?

A suite of protocols that provides security for IP communications.

What OSI layer does IPsec operate at?

Layer 3 — Network layer.