Exploring Network Protocols and Services

Network protocols

Definition:
Network protocols are rules, standards, and procedures that define how data is formatted,
transmitted, and received between networked devices.

Purpose:
Without protocols, devices cannot properly format, address, or interpret network messages.

Ports:
• Each application layer protocol uses a unique service port number to identify the
service or process.
• Ports act as doorways through which data enters or leaves a device.
• Port numbers are assigned by the Internet Assigned Numbers Authority (IANA).

File protocols
➢ Within the networking industry, there are various application and network layer
protocols that are designed with the functionality to allow file transfer between devices
over a network.
File Transfer Protocol
➢ It operates in a client-server model, allowing users to connect to a file server to upload
and download files over a network.
➢ Port 20 → allow data transfer between an FTP client and the FTP server,
Port 21 → controlling commands and functions from the FTP client and FTP server.

Fig. – Phase 1 of FTP

➢ As shown in the preceding diagram, the computer with the FTP client application opens
the connections to the FTP server on service port 21.
➢ Next, the client opens another connection to the server on service port 20 to transmit
data traffic, as shown in the following diagram:
 Fig. – Phase 2 of FTP
➢ Lastly, the data is transferred from the FTP server on service port 20 to the client, as
shown in the following diagram:

Fig. – Phase 3 of FTP

➢ Use: Used for firmware or OS uploads on routers/modems.
➢ Limitation: Sends data in plain text → vulnerable to Man-in-the-Middle (MiTM)
attacks.
No encryption
SSH File Transfer Protocol
➢ Purpose: Secure File Transfer over SSH (port22)
➢ How it works:
➢ Establishes an encrypted SSH tunnel between client and server.
➢ FTP packets are encapsulated inside this tunnel.
➢ Security:All traffic is encrypted, making it unreadable even if intercepted.

Fig. – SFTP
File Transfer Protocol Secure (FTPS)

➢ Also called: FTP over SSL/TLS.

➢ Encryption: SSL or TLS (no tunnel; each packet encrypted).
➢ Ports:
o 990 → Implicit FTPS (SSL connection auto-starts).
o 21 → Explicit FTPS (client sends AUTH SSL/TLS command).
➢ Security: Protects credentials and data using encryption.
Trivial FTP

➢ Type: Connectionless, lightweight FTP version.

➢ Purpose: Quick uploads/downloads (used for firmware or OS updates).
➢ Port: 69 (UDP)
➢ Operation:
o Used for routers/switches to boot OS from a remote TFTP server.
o No acknowledgments or encryption.
o Fast but insecure.

Fig. – TFTP service on a network

Server Message Block
➢ Function: File and printer sharing in Microsoft networks.
➢ Core Functions:
1. Session control (start/authenticate/terminate).
2. Access control to files/printers.
3. Application communication.
➢ Ports:
o 137, 138 (UDP)
o 445 (TCP)
➢ Platforms:
o Windows: SMB
o Linux: Samba
o macOS: SMB-compatible

The following diagram shows a visual representation of the client-server model of SMB:

Fig. – Client-server model of SMB

➢ As shown in the preceding diagram, the client devices send an SMB Request to the
server to request the shared network resources on the server.
➢ The server responds with an SMB Response to the client, providing requesting
additional information for authentication and providing access to the resources.
Remote access protocol
Purpose
➢ Enable IT professionals to remotely manage devices.
➢ Saves time but may pose security risks if insecure protocols are used.
Telnet
➢ It is an unsecure remote access protocol that allows IT professionals to remotely connect
to devices such as computers, servers, networking devices, security appliances, and IoT
devices.
➢ While Telnet is a legacy protocol and should not be used due to security concerns, many
organizations still implement Telnet as a remote access protocol on their corporate
networks.
➢ If a hacker retrieves or guesses the correct user credentials for any device, the hacker
will be able to access the target device over the internet.
➢ Telnet uses service port 23 by default.
➢ It does not provide any data encryption.
Secure Shell
➢ It is a secure remote access protocol that allows IT professionals to securely connect to
devices over a network to perform configuration changes and troubleshooting.
➢ It encrypts all the messages that are exchanged between the client and the device that’s
running the SSH service, such as the networking device or the server on the network.
➢ Though a hacker can still intercept the communication between a source and
destination, but they will not be able to decrypt the message to view the secret data.
➢ SSH uses service port 22 by default.
Remote Desktop Protocol
➢ Within a Microsoft Windows environment, IT professionals enable Remote Desktop
Protocol (RDP), a native secure remote access protocol that is built into Microsoft
Windows operating systems.
➢ Using RDP within an organization allows IT professionals to remotely manage
Windows servers and desktop devices using a Graphical User Interface (GUI).
➢ This differs from SSH and Telnet, which provide a Command-Line Interface (CLI).
➢ RDP operates on service port 3389.
➢ The RDP message is encrypted using TLS, a security protocol that provides data
security and privacy on a network.
Email protocols
To ensure emails are transported and delivered over a network, various email protocols
help devices format messages for transportation and delivery between a sender and
destination address.
Simple Mail Transfer Protocol (SMTP)
The SMTP is an email protocol that is used for sending emails from clients to email servers,
and email servers to other email servers. The following process provides an overview of
each phase of sending an email between a sender and destination:
1. When a user wants to send an email message to another person, the sender uses an email
application such as Microsoft Outlook to compose and send the message.
2. The email application on the sender’s computer uses SMTP to establish a connection to
the sender’s email server. When the connection is established, the email application uses
SMTP to forward the email message to the recipent’s email server, which has service port
25 open by default.
3. When the sender’s email server receives the email message, it also uses SMTP to forward
the email message to the recipient’s email server, which has service port 25 open by default.
 4. When the email arrives on the recipient’s email server, the recipient uses IMAP/POP to
retrieve the email from the email server.

Fig. – SMTP process

Post Office Protocol (POP)
➢ It allows email clients such as Microsoft Outlook to download messages from email
servers over a network.
➢ The POP server passively listens on TCP service port 110 for inbound requests from
email client applications.
➢ Once a TCP connection is made between the client application and the email server
on service port 110, the client downloads the email messages from the mailbox to
the client.
➢ Once the emails have been downloaded, the email messages are deleted from the
email server.
➢ There is no centralized location for storing the messages on a network.
➢ POP is not recommended for organizations that need a centralized backup solution
for their resources.

Fig. – POP operations

Internet Message Access Protocol (IMAP)

➢ It is another common email protocol that allows email clients such as Microsoft Outlook
to synchronize the email messages between the client application and email server via
service port 143 by default over a network.
 ➢ When using IMAP on a network, the email messages are kept on the email server until
they are manually deleted or removed from a user’s mailbox on the server.

Note
Email protocols such as SMTP, POP and IMAP do not encrypt the messages and send them in
plaintext over a network, so a hacker who is intercepting the messages over a network will be
able to view the content of emails exchanged between users.
Simple Mail Transfer Protocol Secure (SMTPS)
It is a secure email protocol that uses TLS to encrypt outbound emails over a network and uses
service port number 587 by default.
Post Office Protocol Secure (POPS)
It is a secure email protocol that uses SSL to encrypt the email messages that are being
downloaded from an email server to an email application on the client and uses port 995 by
default.
Internet Message Access Protocol Secure (IMAPS)
It is a secure email protocol that operates on service port number 993 and uses SSL to encrypt
the email messages between the client and server during the synchronization process.
HTTP
When communicating with a web server on a network or the internet, a user will typically open
a web browser application on their device that uses HTTP to create a message that is
recognizable to the web application running on the web server.
➢ HTTP is an unsecure protocol that does not provide confidentiality or data privacy and
sends messages in plaintext over a network to a web server.
➢ It uses service port number 80 by default.
➢ HTTP does not encrypt the messages and sends them in plaintext.
HTTPS
➢ It is a secure version of HTTP that establishes a secure connection between the web
browser and web server over the network.
➢ It uses service port number 443 by default.
➢ HTTPS can use either SSL or TLS when connecting to a web server.
Network protocol types
➢ Network protocol types are simply the set of rules that are used to describe how a device
such as a computer communicates with another device over a network.
➢ If two devices are used, whether they are the same type of devices or different, both
systems need to negotiate on a common set of rules.
➢ These common rules are referred to as the network protocol type.
Internet Control Message Protocol
➢ It is defined by RFC 792, which is typically used to provide error reporting on a
network.
➢ Common networking tools such as Ping and Traceroute are built into many operating
systems and allow network professionals to invoke ICMP to check end-to-end
connectivity between hosts on a network, identify the path a packet is traveling between
a source and destination and even measure the latency between hops on a network.
➢ The following table provides a breakdown of each ICMP type by name, code, and
description:
 Fig. – ICMP codes and types
TCP
Discussed in Chapter-1
UDP
Discussed in Chapter-1
Network services
➢ These are the services that organizations rely upon each day to ensure their devices can
exchange messages over a network.
➢ Some of these network services help organizations synchronize time on all devices
within their network, while other network services provide IP addressing configurations
to clients that are connecting to a network.
Network Time Protocol (NTP)
➢ It is a network protocol that allows IT professionals to configure devices to synchronize
their system clock to the same time on a network.
➢ It operates on a client-server model that uses UDP service port 123 by default.
➢ When time is synchronized on the system clocks on all devices, it ensures all devices
have the same time set. This is important for ensuring automated tasks are executed on
time and in the proper sequence.
➢ When a device is generating Syslog messages, it’s important to include the time and
date in each log message to determine when an event has occurred. Without time
synchronization, the time inserted into Syslog messages will not correlate with the
events on other networking devices. This will create a challenge for network
professionals to determine the actual sequence of events that occurred on the network.
➢ It is an unsecure protocol that allows hackers to exploit its security vulnerabilities.
However, NTP allows authentication between an NTP server and NTP clients over a
network.
➢ The following diagram shows the NTP architecture and hierarchical structure:
 Fig. – NTP hierarchical structure
➢ It is made up of clients, servers and stratum levels. The NTP servers are devices that
provide the time for NTP clients on a network.
➢ Each stratum level 0 contains the primary time servers and are known as the
authoritative sources on the network that have the most accurate time.
➢ Servers at stratum level 1 synchronize their time clocks with devices on stratum 0, while
devices on stratum 2 synchronize their time with those devices on stratum 1 and so on.
Dynamic Host Configuration Protocol (DHCP)
➢ It is a protocol that allows network professionals to automatically distribute IP
addresses to client devices on a network.
➢ When an end device is connected to a network, it requires an IP address, subnet mask,
default gateway address, and Domain Name System (DNS) server address.
➢ These IP addresses allow the client to communicate with devices on the same network
and remote networks.
➢ Network professionals implement a DHCP server, which allows them to configure the
following:
• Scope: The range of IP addresses (pool)
• Exclusion ranges: The IP addresses that should not be distributed on the network
• Reservation: Reserves IP addresses from the pool
• Dynamic assignment: Dynamically assigns an IP address to a client on the network
• Static assignment: Statically configures an IP address on a client
• Lease time: Sets the time that the client can use the IP address given from the DHCP
server
• Scope options: Additional operations that can be configured when creating the scope
• Available leases: Identifies the IP addresses available for lease
➢ A DHCP client sends a DHCP message from a source service port of 68 and the DHCP
server operates on service port 67 by default.
DHCP 4-way handshake Process
1. The client connects to the network and sends a DHCP Discover message, seeking a
DHCP server on the network:

Fig. – DHCP Discover message

The source IP address on the packet is left blank while the destination IP address is set to
[Link].
2. Next, the DHCP server responds with a DHCP Offer message, which contains the IP
address needed by the client for communication on the network:

Fig. – DHCP Offer message

3. Next, the client sends a DHCP Request message to the DHCP server, indicating that it
will use the IP addresses from the previous message:

Fig. – DHCP Request message

4. Lastly, the DHCP server responds with a DHCP Acknowledgment unicast message to
confirm the client can use the IP address provided from the addressing pool on the
server:

Fig. – DHCP Acknowledgement message

What if a client connects to the organization’s network but the DHCP server is located on
another IP subnet? How will the client be able to get the IP addresses from the server?

The following diagram shows a router blocking a DHCP Discover message from propagating
to another network:

Fig. – Router blocks Layer 2 broadcast message

Solution
To solve this issue, configuring the router to be a DHCP Relay agent will allow the router to
forward DHCP messages between clients and DHCP servers over a network, as shown here:

Fig. – DHCP Relay agent

➢ The GigabitEthernet 0/0 interface on the router is configured with the following
configurations to allow the router to relay the DHCP messages between the
[Link]/24 network and the DHCP server:
R1(config)# interface GigabitEthernet 0/0
R1(config-if)# ip helper-address [Link]
R1(config-if)# exit
➢ The ip helper-address command is applied to the interface on the router that receives
DHCP Discover messages from clients.
DNS (Domain Name System)
➢ It allows a device to resolve a Fully Qualified Domain Name (FQDN) or a hostname to
an IP address over a network.
➢ Using DNS allows network professionals to implement a DNS server on a network. This
is like a directory that contains a listening of various hostnames that maps to IP addresses.
➢ DNS servers use port UDP port 53 by default. However, a DNS server can exchange
zone records with another DNS server by using TCP port 53.
➢ The following diagram shows a typical DNS transaction between a client and DNS
server:
 Fig. – DNS operations

The following is a breakdown of the DNS operations shown in the preceding diagram:
1. The client wants to establish a connection to [Link] but does not know the IP
address of the web server. Therefore, the client sends a DNS Query message to the
DNS server on service port 53, requesting the IP address of [Link].
2. The DNS server receives this DNS Query and performs a lookup within its database
and finds the record. The DNS server responds with a DNS Reply that contains the IP
address of www. [Link].
3. The client receives the DNS Reply information and connects to the IP address found in
the response from the DNS server.
Within a DNS server, network professionals can create various types of records containing
specific IP addressing information. The following are a list of record types and their
purpose:
• Address (A versus AAAA): The A record maps a hostname to an IPv4 address, while
the AAAA record maps a hostname to an IPv6 address
• Canonical name (CNAME): The CNAME record allows an alias to be mapped to a
domain name
• Mail Exchange (MX): The MX records contain the addresses of mail exchangers on
a domain
• Start of Authority (SOA): The SOA record specifies the authority of the domain
• Pointer (PTR): The PTR record maps an IP address to a hostname
• Text (TXT): The TXT record contains text information that helps a domain owner
validate ownership of a domain
• Service (SRV): The SRV record contains the service records for the domain
• Name Server (NS): The NS record contains the name servers for a domain
Authoritative DNS server:
It is the final holder of an IP address for a domain name or hostname on a network. It contains
the original DNS records that are associated with a domain.
Recursive DNS server or non-authoritative DNS server:
It does not hold the original DNS records for a domain but queries an authoritative server when
needed.
➢ Each domain name that’s available on the internet contains the root (.) and a Top-Level
Domain (TLD) such as .com, .net, or .org within the name, such as [Link].
➢ However, hostnames are usually assigned to servers such as [Link]. This is
commonly referred to as an FQDN since it contains a TLD, the hostname, and the
domain.
➢ Using an FQDN allows network professionals and devices to specify the location of a
device on a network.
 The following diagram shows an example of a global hierarchy of root DNS servers, which
contains the record for their corresponding TLDs:

Fig. – Root DNS servers

There are many trusted DNS servers on the internet that provide improved performance, speed,
and security. The following are some examples of trusted DNS servers:
• Cloudflare DNS: [Link]
• Quad9 DNS: [Link]
• OpenDNS: [Link]
• Google Public DNS: [Link]