Ports and Protocols, Traffic Type

This objective covers the fundamental language of the internet: the ports, protocols, and communication methods that devices use to talk to each other.

Let’s break this down into digestible, real-world pieces.

1. Network Transport Types (The Mail Delivery Methods)

Before data can use a specific port, it needs to choose how it wants to travel across the network.

TCP vs. UDP (Layer 4)

• TCP (Transmission Control Protocol): Connection-oriented. It establishes a reliable connection with a 3-Way Handshake (SYN rightarrow SYN-ACK rightarrow ACK) before sending data. If a packet is lost, TCP detects it and resends it.
  • Analogy: A certified letter. The mailman checks your ID, makes you sign for it, and the sender gets confirmation it arrived.
• UDP (User Datagram Protocol): Connectionless. It sends data across the network as quickly as possible without checking whether the receiver is ready or whether the data actually arrives.
  • Analogy: Throwing newspapers at a porch from a moving car. It’s fast, but some might land in a puddle or get lost.

Specialized Protocols (Layer 3 & 4)

• ICMP (Internet Control Message Protocol): Used by network devices to send error messages and operational information.
  • Simple Example: When you use ping or tracerouteYou are using ICMP to see if a device is online.
• GRE (Generic Routing Encapsulation): A protocol used to encapsulate a wide variety of network-layer packet types within an IP tunnel. It creates a simple virtual point-to-point link but does not encrypt the data itself.
• IPsec (Internet Protocol Security): A suite of protocols used to encrypt and secure data transmitted over a network (commonly used to build VPNs). It uses three key components:
  • IKE (Internet Key Exchange): Establishes a secure tunnel by negotiating security keys between the two sides.
  • AH (Authentication Header): Proves exactly who sent the data and guarantees it wasn’t altered in transit (provides integrity but no encryption).
  • ESP (Encapsulating Security Payload): Encrypts the actual data payload so outsiders cannot read it.

2. Ports and Protocols Reference Guide

Think of an IP address like the physical phone number to a corporate office. The Port Number is the specific employee’s extension number you dial once you connect.

File Transfer & Remote Management

• FTP (Ports 20/21 – TCP): Used to transfer files between a client and a server. Port 21 handles the control commands, and Port 20 moves the actual data. Completely unencrypted.
• SFTP (Port 22 – TCP): Performs the same file transfer as FTP but wraps the transfer securely within a Secure Shell session.
• SSH (Port 22 – TCP): Allows an administrator to securely log into and manage a remote device via a command-line interface. All traffic is encrypted.
• Telnet (Port 23 – TCP): An older, unencrypted remote management tool. Never use this, because passwords are sent in plain text.

Web & Directory Services

• HTTP (Port 80 – TCP): Used to transmit web pages over the Internet. Unencrypted.
• HTTPS (Port 443 – TCP): Secure web browsing. It encrypts web traffic using SSL/TLS.
• LDAP (Port 389 – TCP/UDP): Used to query and manage directory information services, like looking up a user in Microsoft Active Directory. Unencrypted.
• LDAPS (Port 636 – TCP): Secure LDAP wrapped in an encrypted SSL/TLS session.
• SMB (Port 445 – TCP): Used for sharing files, printers, and serial ports across a local network (typically Windows environments).

Network Infrastructure & Automation

• DNS (Port 53 – UDP/TCP): The internet’s phonebook. It translates user-friendly names (e.g., google.com) into machine-readable IP addresses (e.g., 8.8.8.8). It uses UDP for quick queries and TCP for heavy database transfers (zone transfers).
• DHCP (Ports 67/68 – UDP): Automatically assigns IP addresses, subnet masks, and default gateways to devices when they connect to a network.
• TFTP (Port 69 – UDP): A stripped-down, lightweight version of FTP. It doesn’t require a password or authentication. Commonly used to push firmware updates to network switches or boot diskless workstations.
• NTP (Port 123 – UDP): Synchronizes the clocks of all routers, switches, and servers on a network to a central time source.
• SNMP (Ports 161/162 – UDP): Used by administrators to monitor network health. Port 161 is used to pull statistics from devices; Port 162 is where devices send spontaneous alert notifications (“Traps”).
• Syslog (Port 514 – UDP): A central server destination to which network devices automatically send their operational logs and system event messages for storage.

Databases, Mail, & Communication

• SMTP (Port 25 – TCP): Used to send email from a client to a server, or between email servers.
• SMTPS (Port 587 – TCP): Secure SMTP used by modern email applications to send mail securely over an encrypted connection.
• SQL Server (Port 1433 – TCP): Used to communicate with a Microsoft SQL relational database server.
• RDP (Port 3389 – TCP): Remote Desktop Protocol. Allows an administrator to remotely log in to a Windows computer and view the graphical user interface (GUI) desktop.
• SIP (Ports 5060/5061 – TCP/UDP): Used to initiate, maintain, and tear down multimedia voice and video calls (VoIP). Port 5060 is unencrypted; 5061 is secure.

3. Traffic Types (How Data is Addressed)

This specifies how many destinations a packet can reach simultaneously.

• Unicast (One-to-One): Data is sent from a single source straight to a single, specific destination device.
  • Example: You are reading a specific article on a web page.
• Broadcast (One-to-All): Data is sent from a single source to every single device on the local network segment. Routers block these by default so they don’t flood the entire internet.
  • Example: A teacher standing up and yelling an announcement to a silent classroom.
• Multicast (One-to-Many): Data is sent from a single source to a specific group of interested devices that have joined a multicast subscription group.
  • Example: Streaming a live corporate video feed to only the employees who clicked “join meeting.”
• Anycast (One-to-Closest): Data is routed to a single destination address maintained by multiple identical servers globally. The network routers automatically direct the packet to the physical server closest in geographic distance.
  • Example: DNS providers use Anycast so that when you query a server, you get routed to the server down the street rather than one across the country.

Key Exam Study Matrix

Port	Protocol	Security Status	Quick Clue
22	SSH / SFTP	Encrypted	Replaces Telnet / FTP safely
23	Telnet	Plain Text	Avoid at all costs
53	DNS	Mostly UDP	Names $\leftrightarrow$ IPs
69	TFTP	Unencrypted	UDP File move, no password
161	SNMP	UDP	Network monitoring & traps
443	HTTPS	Encrypted	Secure web traffic
3389	RDP	Encrypted	Windows Graphical Remote Access