Network Protocols and Ports

Overview

This lecture covers the fundamentals of network protocols and the ports they use, focusing on common services, their security implications, and best practices in port management.

Network Protocol Basics

• Network protocols are standardized rules enabling device communication on networks.
• Each protocol operates on specific port numbers that identify services on a host.
• Port numbers distinguish services on a single IP and are grouped into well-known, registered, and dynamic/private ranges.

Common Protocols and Ports

• FTP uses TCP ports 20 (data) and 21 (control) for file transfers.
• SSH operates on TCP port 22 for secure remote access.
• Telnet uses TCP port 23 for unsecured remote terminal access.
• SMTP uses TCP ports 25 and 587 for sending emails.
• DNS uses TCP/UDP port 53 for name resolution.
• DHCP operates on UDP ports 67/68 for IP assignment.
• HTTP uses TCP port 80 for web traffic; HTTPS uses TCP port 443 for encrypted web traffic.

Additional Protocols and Functions

• TFTP uses UDP port 69 for simple, unencrypted file transfers.
• RDP uses TCP port 3389 for remote desktop (GUI) access.
• POP3 (TCP 110) and IMAP (TCP 143) are email retrieval protocols with different management features.
• SLP uses TCP/UDP port 427 for discovering network services.
• NTP uses UDP port 123 to synchronize device clocks.

Security Considerations

• Blocking TCP ports 445 and 139 reduces risks from SMB worms and unauthorized file sharing.
• Regular auditing of open ports helps maintain network security.
• Knowing protocol connection types (TCP vs. UDP) aids in configuring firewalls and understanding traffic.

Key Terms & Definitions

• Protocol — A set of rules for network communication.
• Port — A numerical identifier for specific network services on a device.
• TCP (Transmission Control Protocol) — A connection-oriented protocol ensuring reliable data transmission.
• UDP (User Datagram Protocol) — A connectionless protocol offering fast, but less reliable, data transmission.
• SMB (Server Message Block) — A protocol for file sharing over networks, often targeted by worms.

Action Items / Next Steps

• Review key protocols, their port numbers, and associated security risks.
• Complete discussion questions to reinforce understanding.
• Audit local network ports and identify which services are active.