Chapter 6: Exploring Network Protocols and Services

Network protocols
 For a client such as a computer to access the resources on a server, these two devices use a mutually
agreed-upon network protocol that is responsible for exchanging messages over the network.
 Network protocols are simply the underlying technology, rules, and procedures that define
how a sender can package and format a message to be sent across a network to a destination
host.
 Without protocols or rules for communication on a network, devices will not format or address a
message properly before placing the message onto the network for delivery.
 When the receiver accepts the incoming message, the receiver may misinterpret the message due to a
lack of formatting or addressing.
 Hence, many unique network protocols have their roles and functionality for communication over a
network.
 Many common protocols on a network are application layer protocols that operate at the application
layer of both the Open Systems Interconnection (OSI) and Transmission Control Protocol/
Internet Protocol (TCP/IP) networking models.
 These application layer protocols allow a user such as yourself to interface with the network.
Example:
Hypertext Transfer Protocol Secure (HTTPS): Using an application on your device such as a web
browser, you can interact with web applications and web servers using HTTPS.
Simple Mail Transfer Protocol (SMTP): Use the Microsoft Outlook application to send email
messages using SMTP.
 Transport layer of the OSI and TCP/IP networking model is responsible for assigning the source
and destination service port number based on the application layer protocol.
 Each application layer protocol is associated with a unique service port number that helps devices
deliver a message to the appropriate application layer protocol.
 The following table shows the major categories of service numbers and their ranges according to the
Internet Assigned Numbers Authority (IANA):

 There are 65,535 service ports on an operating system. These services can be used with the
Transmission Control Protocol (TCP) and/or User Datagram Protocol (UDP) Transport layer
protocols of an operating system.
  A server that’s providing a service or resource to clients on a network will open a well-known
service port number to allow inbound connections from clients.
 Without an open service port number on an operating system, a device will not be able to send and
receive messages. As a result, the device will not be able to communicate with others on the network.

File protocols
 As a network professional, you will commonly discover many file-sharing applications that allow
devices, clients, and servers within organizations to provide file-sharing services to users on the
network.
 Within the networking industry, there are various application and network layer protocols that are
designed with the functionality to allow file transfer between devices over a network.
A. File Transfer Protocol (FTP),
B. SSH (Secure Shell) File Transfer Protocol (SFTP),
C. File Transfer Protocol Secure (FTPS),
D. Trivial File Transfer Protocol (TFTP),
E. Server Message Block (SMB)
A. File Transfer Protocol (FTP),
 The File Transfer Protocol (FTP) is a very common file sharing protocol that operates in a client-
server model, allowing users to connect to a file server to upload and download files over a network.

 FTP operates on service port 20 to allow data transfer between an FTP client and the FTP server,
while service port 21 is dedicated to controlling commands and functions from the FTP client and
FTP server.

opens the connections to the opens another connection to the data is transferred from the FTP
FTP server on service port 21. server on service port 20 to server on service port 20 to the
transmit data client
 FTP does not provide any data encryption and sends the traffic in plaintext. FTP is vulnerable to
Man-in-the-Middle (MiTM) attacks.
B. SSH (Secure Shell) File Transfer Protocol (SFTP)
 SFTP allows a client to establish an encrypted tunnel using Secure Shell (SSH) to a file server that
supports the SFTP protocol.
 All the packets are encrypted and the data will be unreadable.
  The computer establishes an SSH tunnel to the server on port 22 over the network and uses FTP to
transfer files within the encrypted SSH tunnel.
 SFTP is one of the many secure protocols within the TCP/IP networking model.

C. File Transfer Protocol Secure (FTPS)

 File Transfer Protocol Secure (FTPS), sometimes referred to as FTP over SSL (FTP/S), is
another file transfer protocol that allows users to securely transfer files between a client and server
over a network.
 SFTP uses Secure Sockets Layer (SSL) or Transport Layer Security (TLS) to encrypt the FTP
messages that are being sent over the network between a client and server.
 The client encrypts the FTP messages using SSL/TLS before placing the messages on the network to
the destination FTP server.
 Compared to SFTP, as messages are sent across the network, there is no secure connection/tunnel;
each FTPS packet is individually encrypted using SSL/TLS. Therefore, the FTP server will decrypt
each FTPS message as they are received from the network and reassemble the messages into data.
 FTPS operates on service port 990 and sometimes on service port 21.
 If a client on the network establishes a connection to the server on service port 990, it is considered
to be implicit FTPS. On the other hand, if the client establishes a connection to the server on service
port 21, it is known as explicit FTPS.
D. Trivial File Transfer Protocol (TFTP)
 The TFTP is a connectionless FTP that allows network professionals to quickly upload and
download files between a client and networking device over a network.

 When a networking device is powered on, it will check for a remote TFTP server and download the
operating systems over the network and load it into the memory of the router.
 In the future, whenever a newer version of the operating system is available, network professionals
can simply download the newer version and replace the older version on the TFTP server.
  The client is connecting to the TFTP server on its default service port, 69, to upload or download
files over the network.
 Being a connectionless protocol, TFTP uses UDP as the preferred Transport layer protocol, so it is
lightweight and does not need acknowledgment messages when sending messages.
E. Server Message Block (SMB)
 The Service Message Block (SMB) is a common protocol that operates in a client-server model,
allowing shared network resources such as printers, files, and directories to be shared in a Microsoft
Windows environment.
 The following are the three core functions of SMB:
 Starting, authenticating, and terminating sessions between a client and server
 Controlling access to files and printers
 Allowing applications to exchange information between devices on a network

 The client devices send an SMB Request to the server to request the shared network resources on
the server.
 The server responds with an SMB Response to the client, providing requesting additional
information for authentication and providing access to the resources.
 SMB is commonly used within a Microsoft Windows environment, Linux-based operating systems
use a variation of SMB that is known as SAMBA.
Remote access protocols
 Remote access protocols are special protocols that allow IT professionals to remotely access and
manage devices over a network.
 It helps to remotely connect and implement new configurations or perform troubleshooting to resolve
any issues on remote devices.
 Using remote access protocols provides the convenience for IT professionals to centrally manage end
devices, servers, and networking devices over a network.
 It save a lot of time from physically visiting the location of a server or network device.
 Remote access protocols provide a security risk if an IT professional is using an unsecure remote
access protocol to connect to a networking device. Unsecure protocols do not provide security
features such as data encryption.
Telnet
 Telnet is an unsecure remote access protocol.
 Telnet uses service port 23 by default.

Secure Shell
 The Secure Shell (SSH) is a secure remote access protocol.
 SSH encrypts all the messages that are exchanged between the client and the device that’s running
the SSH service, such as the networking device or the server on the network.
 SSH uses service port 22 by default.

Remote Desktop Protocol

 Remote Desktop Protocol (RDP), a secure remote access protocol that is built into Microsoft
Windows operating systems.
 Using RDP within an organization allows IT professionals to remotely manage Windows servers and
desktop devices using a Graphical User Interface (GUI).
 The RDP message is encrypted using Transport Layer Security (TLS), a security protocol that
provides data security and privacy on a network.
 RDP operates on service port 3389.

Email protocols
 Email protocols ensure emails are transported and delivered over a network.
 Email protocols help devices format messages for transportation and delivery between a sender and
destination address.
Simple Mail Transfer Protocol (SMTP)
 The SMTP is an email protocol that is used for sending emails from clients to email servers, and
email servers to other email servers.
  SMTP uses service port 25.
Overview of each phase of sending an email between a sender and destination:
1. When a user wants to send an email message to another person, the sender uses an email application such
as Microsoft Outlook to compose and send the message.
2. The email application on the sender’s computer uses SMTP to establish a connection to the sender’s email
server. When the connection is established, the email application uses SMTP to forward the email message
to the sender’s email server.
3. When the sender’s email server receives the email message, it also uses SMTP to forward the email
message to the receiver email server.
4. When the email arrives on the receiver email server, the server uses SMTP to send the message to the
email application on the receiver device.

Post Office Protocol (POP)

 The Post Office Protocol (POP) is a common email protocol that allows email clients such as
Microsoft Outlook to download messages from email servers over a network.
 POP uses service port 110.
 Once a TCP connection is made between the client application and the email server, the client
downloads the email messages from the mailbox to the client.
 Once the emails have been downloaded, the email messages are deleted from the email server.

 As POP deletes the email messages from the email server after downloading them onto the client
device, there is no centralized location for storing the messages on a network. Hence, POP is not
recommended for organizations that need a centralized backup solution for their resources.
Internet Message Access Protocol (IMAP)
 The IMAP is another common email protocol that allows email clients such as Microsoft Outlook to
synchronize the email messages between the client application and email server
 It uses port 143 by default over a network.
 When using IMAP on a network, the email messages are kept on the email server until they are
manually deleted or removed from a user’s mailbox on the server.
Demerits of SMTP, POP, and IMAP: Lack of security features such as data encryption to provide
confidentiality and privacy, so a hacker who is intercepting the messages over a network will be able to view
the content of emails exchanged between users.
Secure Email Protocol
 Simple Mail Transfer Protocol Secure (SMTPS) is a secure email protocol that uses Transport
Layer Security (TLS) to encrypt outbound emails over a network and uses service port number 587
by default.
 Post Office Protocol Secure (POPS) is a secure email protocol that uses Secure Sockets Layer
(SSL) to encrypt the email messages that are being downloaded from an email server to an email
application on the client and uses port 995 by default.
 Internet Message Access Protocol Secure (IMAPS) is a secure email protocol that operates on
service port number 993 and uses SSL to encrypt the email messages between the client and server
during the synchronization process.

HTTP and HTTPS

 HyperText Transfer Protocol (HTTP) and HyperText Transfer Protocol over SSL (HTTPS)
 When communicating with a web server on a network or the internet, a user will typically open a
web browser application on their device that uses HTTP.
 HTTP is an unsecure protocol that does not encrypt the messages. It does not provide confidentiality
or data privacy and sends messages in plaintext over a network to a web server
 HTTP uses service port number 80.
 HTTPS is a secure version of HTTP that establishes a secure connection between the web browser
and web server over the network.
 HTTPS uses service port number 443.
 HTTPS can use either SSL or TLS when connecting to a web server.

Network protocol types

 Network protocol types are simply the set of rules that are used to describe how a device such as a
computer communicates with another device over a network.
 Example: ICMP, TCP, and UDP.
Internet Control Message Protocol
 Internet Control Message Protocol (ICMP) is typically used to provide error reporting on a
network.
 Common networking tools such as Ping and Traceroute are used by ICMP to check end-to-end
connectivity between hosts on a network, identify the path a packet is traveling between a source and
destination.

TCP (Transmission Control Protocol)

 TCP is a connection-oriented protocol that operates at the Transport layer of both the OSI and
TCP/IP networking models.
 It is designed to provide reliable transportation of the datagrams over a network.
 For each message sent between devices on the network, the receiver responds with a TCP
acknowledgment (ACK) message that indicates the message was received.
 If the sender does not receive an ACK message from the intended destination after a predefined time,
the sender will attempt to retransmit the message again.
UDP (User Datagram Protocol)
 UDP is a connectionless protocol that operates at the Transport layer of both the OSI and TCP/IP
networking models.
 Unlike TCP, UDP does not provide any guarantee or reassurance of the delivery of datagrams across
a network.
 UDP is not concerned about whether the messages are delivered to the intended destination.
However, it provides faster data transmission and less overhead on the network compared to TCP.
Network services
 Network services ensure the devices can exchange messages over a network.
 Network services: 1. synchronize time on all devices within the network, 2. provide IP addressing
configurations to clients that are connecting to a network.
Network Time Protocol (NTP)
 NTP is a network protocol that allows IT professionals to configure devices to synchronize their
system clock to the same time on a network.
 NTP operates on a client-server model that uses UDP service port 123 by default.
 Without NTP on a network, IT professionals will need to manually configure the time on each device
within the organization and this process can be very time consuming.
 This is important for ensuring automated tasks are executed on time and in the proper sequence.
 NTP is an unsecure protocol that allows hackers to exploit its security vulnerabilities. However, NTP
allows authentication between an NTP server and NTP clients over a network.
 The NTP stratum levels range from 0 to 15, where
level 0 contains the authoritative sources.
 Each stratum level 0 contains the primary time servers
and are known as the authoritative sources on the
network that have the most accurate time. Servers at
stratum level 1 synchronize their time clocks with
devices on stratum 0, while devices on stratum 2
synchronize their time with those devices on stratum 1
and so on.

Dynamic Host Configuration Protocol (DHCP)

 DHCP is a common network protocol and service that allows network professionals to automatically
distribute IP addresses to client devices on a network.
 When an end device such as a computer or smartphone is connected to a network, it requires an IP
address, subnet mask, default gateway address, and Domain Name System (DNS) server address.
 These IP addresses allow the client to communicate with devices on the same network and remote
networks.
 If network professionals have to statically/manually assign IP addresses to each device that’s
connecting to their organization’s network; the process will be time-consuming and lead to
duplication of IP address assignment.
 A DHCP client sends a DHCP message from a source service port of 68. The DHCP server operates
on service port 67 by default.
  To help simplify the process of distributing IP addresses on a network, network professionals
implement a DHCP server, which allows them to configure the following:
 Scope: The range of IP addresses (pool)
 Exclusion ranges: The IP addresses that should not be distributed on the network
 Reservation: Reserves IP addresses from the pool
 Dynamic assignment: Dynamically assigns an IP address to a client on the network
 Static assignment: Statically configures an IP address on a client
 Lease time: Sets the time that the client can use the IP address given from the DHCP server
 Scope options: Additional operations that can be configured when creating the scope
 Available leases: Identifies the available lease time for an IP address
 Whenever a client device such as a computer connects to a network, it will seek a DHCP server on
the network to retrieve IP addresses to communicate with other hosts on the same network.
DHCP 4-way handshake that occurs when a client connects to a network with an active DHCP server:
1. The client connects to the network and sends a DHCP Discover message, seeking a DHCP server on
the network. The source IP address on the packet is left blank while the destination IP address is set
to [Link].

2. Next, the DHCP server responds with a DHCP Offer message, which contains the IP address needed
by the client for communication on the network. The DHCP Offer message is sometimes sent as
unicast or broadcast to the client on the network.
3. Next, the client sends a DHCP Request message to the DHCP server, indicating that it will use the
IP addresses from the previous message. the client sends a Layer 2 broadcast message to the DHCP
server on the network
4. Lastly, the DHCP server responds with a DHCP Acknowledgment unicast message to confirm the
client can use the IP address provided from the addressing pool on the server. The client is allowed
to use the IP addresses provided by the DHCP server for the duration of the lease. If the client wants
to extend the lease of communication on the network, the client can send a DHCP Request (unicast)
message to the DHCP server to request the renewal of the lease.
DNS
 DNS (The Domain Name System), which handles naming within the Internet.
 DNS is a very popular network protocol that allows a device to resolve a Fully Qualified Domain
Name (FQDN) or a hostname to an IP address over a network.
 It is primarily used for mapping host names and e-mail destinations to IP addresses.
 Each device on a network has an IP address that allows end-to-end communication between hosts.
Imagine if you need to remember the IP address of each web server on the internet that you want to
visit – it will be quite challenging to remember these logical addresses.
 What if a server’s IP address has changed and you don’t know the new IP address? How will you
connect to the server to access the resources?
 Using DNS allows network professionals to implement a DNS server on a network.
 This is like a directory that contains a list of various hostnames that maps to IP addresses, similar to a
traditional telephone directory, which contains a list of people’s names and their telephone numbers.
 The following diagram shows a typical DNS transaction between a client and DNS server: