Ports and Protocols Study Notes

Introduction to Ports and Protocols

  • Definition of Ports: A port is a virtual point of entry or exit for communications used by software applications to exchange information.

  • Types of Ports:

    • Well-known Ports: Professional services that range from 0 to 1023.

    • Registered Ports: Assigned ports from 1024 to 49151.

    • Dynamic/Private Ports: Temporary ports from 49152 to 65535.

  • Definition of Protocols: A protocol is a set of rules and conventions for data exchange between network devices.

  • Importance: Protocols ensure that data is transmitted in a structured way, allowing devices to understand and process information accurately.

Overview of Networking Concepts

Key Networking Objectives

  • Focus on objective 1.4: Explain common networking ports, protocols, services, and traffic types.

Understanding Port Ranges

Port Ranges

  1. Well-known Ports: 0 - 1023

    • Common examples include:

      • Port 20: FTP (File Transfer Protocol)

      • Port 21: FTP Control

      • Port 25: SMTP (Simple Mail Transfer Protocol)

      • Port 80: HTTP (Hypertext Transfer Protocol)

      • Port 443: HTTPS (HTTP Secure)

  2. Registered Ports: 1024 - 49151

    • These ports are registered for specific services and applications.

  3. Dynamic/Private Ports: 49152 - 65535

    • Typically used for private or ephemeral communication.

Transmission Control Protocol (TCP)

  • Definition: TCP is a fundamental protocol within the Internet Protocol Suite that manages data transmission across the network.

  • Functions:

    • Provides reliable data transmission through error checking, data sequencing, and acknowledgment.

    • Operates at the transport layer of the OSI model.

  • Connection Establishment: Utilizes a three-way handshake consisting of:

    1. SYN: Synchronize packet sent from client to server.

    2. SYN-ACK: Acknowledgment packet sent back from server to client.

    3. ACK: Final acknowledgment from client, establishing the connection.

  • Error Handling: Utilizes sequence numbers and acknowledgments to ensure data is received correctly; retransmissions are triggered if packets are lost or corrupted.

  • Flow Control: Uses windowing to manage data flow, enabling efficient communication under varying network conditions.

User Datagram Protocol (UDP)

  • Definition: UDP is a communication protocol used for time-sensitive transmissions, such as streaming audio and video.

  • Characteristics:

    • Connectionless protocol, meaning it does not establish a dedicated end-to-end connection.

    • Generally faster than TCP but lacks reliability, error detection, and correction mechanisms.

  • Packet Structure: Simpler header structure (8 bytes), only includes source and destination ports, length, and checksum.

  • Use Cases: Ideal for applications where speed is critical, such as:

    • Live broadcasts

    • Online gaming

    • Voice over IP (VoIP)

Internet Control Message Protocol (ICMP)

  • Definition: ICMP is used for diagnostics and error reporting in the Internet Protocol Suite.

  • Purpose: Enables network hosts to send error messages and operational information (e.g., host unreachable, time exceeded).

  • Common Use: The ping utility sends ICMP echo requests to test reachability and measure round-trip latency.

  • Structure:

    • Composed of a header that includes type, code, and checksum fields.

  • Vulnerabilities: Commonly exploited in denial of service attacks (e.g., ICMP flood or Ping of Death).

Web Ports and Protocols

  • HTTP (Hypertext Transfer Protocol)

    • Uses port 80.

    • Data is transmitted in plain text, lacking security.

  • HTTPS (Hypertext Transfer Protocol Secure)

    • Uses port 443.

    • Encrypts data using SSL/TLS, securing it from interception.

Email Ports and Protocols

  • SMTP (Simple Mail Transfer Protocol)

    • Port 25: Standard for sending emails.

    • SMTPS (Secure SMTP): Ports 465 or 587 for secure transmission.

  • POP3 (Post Office Protocol 3)

    • Port 110: Used to retrieve emails; deletes messages from the server after download.

    • POP3S: Port 995 for secure retrieval.

  • IMAP (Internet Message Access Protocol)

    • Port 143: Used for retrieving emails while allowing server-side management.

    • IMAPS: Port 993 for secure access.

File Transfer Ports and Protocols

  • FTP (File Transfer Protocol)

    • Ports 20 and 21: Port 21 for command/control messages and Port 20 for data transfer.

    • Not secure; transmits data in plain text.

  • SFTP (Secure File Transfer Protocol)

    • Port 22: Secure protocol using SSH, encrypting data during transmission.

  • TFTP (Trivial File Transfer Protocol)

    • Port 69: Basic protocol without extensive features or authentication.

  • SMB (Server Message Block)

    • Port 445: Used for file sharing on Microsoft networks.

Remote Access Ports and Protocols

  • SSH (Secure Shell)

    • Port 22: Used for secure remote login and command execution.

    • Encrypts the data and provides strong authentication.

  • Telnet

    • Port 23: Allows remote login but is insecure.

    • Generally not recommended due to lack of encryption.

  • RDP (Remote Desktop Protocol)

    • Port 3389: Microsoft protocol providing graphical interface for remote access.

Networking Service Ports and Protocols

  • DNS (Domain Name System)

    • Port 53: Resolves domain names to IP addresses, functions on UDP for queries and TCP for larger transfers.

  • DHCP (Dynamic Host Configuration Protocol)

    • Ports 67 and 68: Automates IP addressing and network configuration.

  • SQL Services

    • Port 1433: Microsoft SQL Server

    • Port 3306: MySQL database access.

  • SNMP (Simple Network Management Protocol)

    • Ports 161 and 162: Used for managing and monitoring network devices.

  • Syslog Protocol

    • Port 514: Log messages from network devices.

Other Network Service Ports and Protocols

  • NTP (Network Time Protocol)

    • Port 123: Synchronizes clocks across devices on a network.

  • SIP (Session Initiation Protocol)

    • Ports 5060 and 5061: Used for initiating sessions in communication services (VoIP).

  • LDAP (Lightweight Directory Access Protocol)

    • Port 389: Access directory information, transfer in plain text.

    • Port 636: LDAPS - Secure LDAP encrypted over SSL/TLS.

Network Scanning with Nmap

  • Nmap: A command-line tool for network mapping, identifies open ports and services on remote systems.

    • Command syntax example: nmap -sS -o <target_IP>

  • Zenmap: A graphical user interface for Nmap, making it easier to visualize network scans.

  • Common Uses: Network security assessments, identifying potential vulnerabilities.

Conclusion

  • Importance of Ports and Protocols: Critical for enabling efficient, secure communication over networks.

  • Application in Real World: Understanding ports/protocols is essential for IT professionals, especially in network management and security contexts.