Networking Ports, Protocols, and OSI Model Layers for IT Security

FTP (File Transfer Protocol)

Used for transferring files between client and server. Port 21 is command/control, Port 20 is data transfer.

SSH (Secure Shell) / SFTP

Encrypted remote console login and secure file transfer.

Telnet

Unencrypted text communications. Replaced by SSH due to lack of security.

SMTP (Simple Mail Transfer Protocol)

Used to send mail between servers or from client to mail server.

DNS (Domain Name System)

Resolves human-readable domain names (e.g., example.com) to IP addresses. Operates primarily over UDP (TCP for zone transfers).

DHCP (Dynamic Host Configuration Protocol)

Automatically assigns IP addresses and network config to clients. Port 67 (Server), Port 68 (Client).

HTTP (Hypertext Transfer Protocol)

Unencrypted web traffic communications.

POP3 (Post Office Protocol 3)

Retrieves email from a server to a single client, typically downloading and deleting from the server.

NTP (Network Time Protocol)

Synchronizes system clocks across network devices over UDP.

IMAP (Internet Message Access Protocol)

Syncs and retrieves email across multiple devices while keeping mail on the server.

SNMP (Simple Network Management Protocol)

Collects and organizes information about managed devices on IP networks. 161 (Poll/Query), 162 (Traps).

LDAP (Lightweight Directory Access Protocol)

Queries and modifies directory services over TCP/UDP.

HTTPS (HTTP Secure)

Encrypted web traffic using TLS/SSL.

SMB (Server Message Block)

Shared access to files, printers, and serial ports across a local network.

RDP (Remote Desktop Protocol)

Microsoft proprietary protocol providing a user with a graphical interface to another computer.

OSI Model Layer 1

Physical — Responsible for the transmission and reception of raw bitstreams over a physical medium (cables, fiber, RF, hubs, repeaters). PDU: Bits.

OSI Model Layer 2

Data Link — Manages node-to-node data transfer, physical MAC addressing, and frame error detection (Switches, Bridges, NICs). PDU: Frames.

OSI Model Layer 3

Network — Handles logical IP addressing, routing, and path determination across subnets (Routers, Layer 3 Switches). PDU: Packets.

OSI Model Layer 4

Transport — Provides end-to-end data transport, connection reliability, flow control, and multiplexing (TCP, UDP). PDU: Segments (TCP) / Datagrams (UDP).

OSI Model Layer 5

Session — Establishes, manages, and terminates connections/sessions between applications (RPC, NetBIOS). PDU: Data.

OSI Model Layer 6

Presentation — Manages data translation, encryption/decryption, and compression (SSL/TLS, ASCII, JPEG). PDU: Data.

OSI Model Layer 7

Application — Interacts directly with software applications to provide communication services (HTTP, DNS, SSH, SMTP). PDU: Data.

TCP vs. UDP

TCP: Connection-oriented, performs 3-way handshake (SYN, SYN-ACK, ACK), guarantees ordered delivery and error checking. UDP: Connectionless, 'best-effort' delivery, low overhead, no handshake or delivery confirmation.

TCP 3-Way Handshake

1. Client sends SYN (Synchronize) 2. Server responds with SYN-ACK (Synchronize-Acknowledge) 3. Client replies with ACK (Acknowledge)

RFC 1918: Class A Private IP Range

10.0.0.0 to 10.255.255.255 (/8 prefix)

RFC 1918: Class B Private IP Range

172.16.0.0 to 172.31.255.255 (/12 prefix)

RFC 1918: Class C Private IP Range

192.168.0.0 to 192.168.255.255 (/16 prefix)

APIPA (Automatic Private IP Addressing)

169.254.0.1 to 169.254.255.254 (/16). Assigned automatically by OS when a DHCP server fails to respond.

IPv4 Loopback Address

127.0.0.1 (Entire block: 127.0.0.0/8). Used to test internal network stack functionality on the local host.

IPv6 Loopback Address

::1 (Equivalent to 127.0.0.1 in IPv4).

Subnet Mask: /24

Subnet Mask: 255.255.255.0 Total IPs: 256 Usable Hosts: 254 (minus Network and Broadcast IDs).

Subnet Mask: /28

Subnet Mask: 255.255.255.240 Total IPs: 16 Usable Hosts: 14.

Subnet Mask: /30

Subnet Mask: 255.255.255.252 Total IPs: 4 Usable Hosts: 2 (commonly used for point-to-point router links).

Default Gateway

The routing device node on a computer network that serves as an access point to other networks when no other route matches an IP packet's destination.

DNS Record: A vs. AAAA

A Record: Resolves hostname to an IPv4 address. AAAA Record: Resolves hostname to an 128-bit IPv6 address.

DNS Record: CNAME

Canonical Name — An alias that points a domain or subdomain to another domain name (not directly to an IP).

DNS Record: MX

Mail Exchanger — Specifies the mail server responsible for accepting email messages on behalf of a domain name.

Cloud Service Models: IaaS vs PaaS vs SaaS

IaaS: Cloud provider manages physical hardware, virtualization, and networking; user manages OS, runtime, and apps (e.g., EC2). PaaS: Cloud provider manages OS and runtime; user only manages code and data (e.g., Elastic Beanstalk). SaaS: Cloud provider manages the entire stack; user only interacts with software (e.g., M365, Google Workspace).

Cloud Deployment Models: Public, Private, Hybrid

Public: Infrastructure shared multi-tenant over the internet. Private: Infrastructure provisioned for exclusive use by a single organization. Hybrid: Composition of two or more distinct cloud/on-premise infrastructures bound together by standardized technology.

High Availability (HA) vs. Fault Tolerance (FT)

High Availability: System remains operational with minimal downtime via redundancy (brief failover time permitted). Fault Tolerance: Zero downtime; system continues operating without interruption even if a component fails completely.

RTO vs. RPO

RTO (Recovery Time Objective): Maximum acceptable duration of time a system can be down after a failure. RPO (Recovery Point Objective): Maximum acceptable amount of data loss measured in time (e.g., max 1 hour of lost transactions).

CIA Triad

Confidentiality: Preventing unauthorized disclosure of data. Integrity: Ensuring data has not been altered or tampered with. Availability: Ensuring authorized users have timely, reliable access to resources.

Authentication: MFA Factors

1. Something you know: Password, PIN. 2. Something you have: Smart card, hardware token, phone authenticator app. 3. Something you are: Biometrics (fingerprint, retina scan). (Supplemental: Somewhere you are, something you do).

Symmetric vs. Asymmetric Encryption

Symmetric: Same shared key used for both encryption and decryption (Fast, e.g., AES). Asymmetric: Key pair; public key encrypts, private key decrypts (Slower, e.g., RSA, ECC).