Chapter 6

DoD Model

1. Network Access Layer -data link/ physical 2. Internet Layer- Network 3. Host-to-Host layer-Transport 4. Process Layer - application, presentation, session corresponds to OSI model the same as the TCP/IP model

What is the well known port number for RDP?

3389

H.323

A VoIP standard that handles the initiation, setup, and delivery of VoIP sessions. TCP 1720

LDAP (Lightweight Directory Access Protocol)

A communications protocol that defines how a client can access information, perform operations, and share directory data on a server. TCP 389

SMTP (Simple Mail Transfer Protocol)

A communications protocol that enables sending email from a client to a server or between servers. TCP 25

TCP (Transmission Control Protocol)

A connection-oriented,reliable, sequenced, and guaranteed-delivery protocol used to send data packets between computers over a network like the Internet. Provides reliable, ordered, and error-checked delivery of a stream of packets on the internet. TCP is tightly linked with IP and usually seen as TCP/IP in writing.

ICMP (Internet Control Message Protocol)

A core protocol in the TCP/IP suite that notifies the sender that something has gone wrong in the transmission process and that packets were not delivered.

DHCP (Dynamic Host Configuration Protocol)

A network service that provides automatic assignment of IP addresses and other TCP /IP configuration information. UDP 67 (reciever) and 68 (sender)

SFTP (Secure File Transfer Protocol)

A protocol available with the proprietary version of SSH that copies files between hosts securely. Like FTP, SFTP first establishes a connection with a host and then allows a remote user to browse directories, list files, and copy files. Unlike FTP, SFTP encrypts data before transmitting it. TCP 22

SMB (Server Message Block)

A protocol that works on the Application layer and is used to share files, serial ports, printers, and communications devices, including mail slots and named pipes, between computers TCP 445.

SIP (Session Initiation Protocol)

A set of Application layer signaling and control protocols for multiservice, packet-based networks. SIP is used to make an initial connection between hosts for transferring multimedia data. TCP 5060/5061

TFTP (Trivial File Transfer Protocol)

A simple version of FTP that uses UDP as the transport protocol, and does not require a logon to the remote host. UDP 69

connection-oriented protocol

A type of Transport layer protocol that requires the establishment of a connection between communicating nodes before it will transmit data. aka acknowledgements and flow control

connectionless protocol

A type of Transport layer protocol that services a request without requiring a verified session and without guaranteeing delivery of data.

POP (Post Office Protocol)

An Application layer protocol used to retrieve messages from a mail server. When a client retrieves mail via POP, messages previously stored on the mail server are downloaded to the client's workstation, and then deleted from the mail server. Port 110

SNMP (Simple Network Management Protocol)

An Application-layer protocol used to exchange information between network devices. UDP 161

NTP (Network Time Protocol)

An Internet protocol that enables synchronization of computer clock times in a network of computers by exchanging time signals. UDP 123

HTTPS (Hypertext Transfer Protocol Secure)

An encrypted version of HTTP. It uses port TCP 443.

What are the PDU (Protocol Data Unit) names at each layer of the OSI model?

Application, presentation, session, Transport- Segment Network- Packet Data link- Frame Physical- Bits

What transport Layer protocol does a DNS server use?

Both TCP and UDP! A DNS server uses TCP port 53 for zone transfers and UDP port 53 for name resolutions. Notice that DNS uses both TCP and UDP. Whether it opts for one or the other depends on what it's trying to do.

Name the protocol that uses both TCP ports 20 and 21.

FTP uses both TCP ports 20 and 21 for the data channel and the control channel, respectively.

FTP

File Transfer Protocol uses a TCP-based network to pass files from host to host. Port 20 for data, 21 for control

What protocol is at the heart of the ping and tracert commands in a windows operating system?

ICMP is the protocol that the ping and tracert commands rely on. If you're having trouble getting pings and traceroutes through a router, you might need to check if ICMP is being allowed through.

Which protocol dynamically reports errors to source hosts by using IP directly to build packets?

ICMP uses IP directly to build error-reporting packets that are transmitted back to the originating source host when issues arise during the delivery of data packets. ICMP is also used during Ping and some Traceroute operations.

Internet Layer Protocols

Internet Protocol (IP), Internet Control Message Protocol (ICMP), Address Resolution Protocol (ARP)

Which ports does the protocol MGCP use?

MGCP uses ports 2427 and 2727

LDAPS (Lightweight Directory Access Protocol Secure)

Port 636

What could cause a server that you can ping not to provide the particular TCP/IP service such as FTP, HTTP, and so on that you expect it to offer?

Quite simply, the service might not be running currently on that server. Another possibility might be that a firewall between the client and the server has blocked the protocol in question from passing.

IP (Internet Protocol)

Routing protocol that is in charge of forwarding packets on the Internet.

What well known port numbers do SMTP, POP3,RDP,and IMAP4 servers use?

SMTP uses TCP port 25, POP3 uses TCP port 110, RDP uses TCP port 3389, and IMAP4 uses TCP port 143.

SSH (Secure Shell)

TCP/UDP 22

Which destination Transport Layer protocol and port number does a TFTP client use to transfer files over the network?

TFTP servers respond to UDP messages sent to port 69.

What is Telnet?

Telecommunication Network (telnet) is a remote access protocol that allows "virtual terminal" connections to any host on the Internet possessing a telnet server. TCP 23

Process/Application Layer Protocols

Telnet, FTP, Trivial FTP, SMTP

DNS (Domain Name System)

The Internet's system for converting alphabetic names into numeric IP addresses. Port 53 (TCP & UDP)

Protocol Data Unit (PDU)

The name given to data at different layers of the OSI model. Specifically, the PDU for Layer 4 is segment. The Layer 3 PDU is packet, the Layer 2 PDU is frame, and the Layer 1 PDU is bit.

RDP (Remote Desktop Protocol)

The protocol used by Microsoft's Terminal Set.vices implementations. TCP 3389

When should you use TFTP?

This is a connectionless FTP, with none of the security or functions that FTP usually has. It should only be used if you know exactly where you need to send something and the file contents aren't sensitive.Used for sending files between computers on an IP network, and helpful when trying to send files larger than email will allow.

When should you use SFTP?

This is another connection based file transfer protocol based on the secure shell protocol. Traffic is encrypted, so sensitive information is safer here. Used for sending files between computers on an IP network, and helpful when trying to send files larger than email will allow.

What would an ARP destination MAC address appear as?

This would be a Layer 2 broadcast, or FF:FF:FF:FF:FF:FF.

Host-to-Host Layer Protocols

Transmission Control Protocol (TCP) User Datagram Protocol (UDP)

UDP (User Datagram Protocol) key features

Unsequenced Unreliable Connectionless No virtual circuit Low overhead No acknowledgment No windowing or flow control

When should you use FTP/FTPS?

When a connection can be established and one needs to transfer non-sensitive files,Used for sending files between computers on an IP network, and helpful when trying to send files larger than email will allow.

When should you use telnet?

When you need to log into host and run programs when security is a non-issue because telnet is not encrypted

IMAP (Internet Message Access Protocol)

a common protocol for retrieving email messages via the Internet TCP/UDP143

UDP (User Datagram Protocol)

connectionless, unsequenced, unreliable protocol that does not require a connection to send a packet and does not guarantee that the packet arrives at its destination. Operates instead of TCP in applications where delivery speed is important and quality can be sacrificed.

TCP key features

sequenced reliable connection-oriented virtual circuit High overhead Acknowledgments Windowing flow control

HTTP (Hypertext Transfer Protocol)

the protocol used for transmitting web pages over the Internet TCP 80