Ports & Protocols Flashcards
(122 cards)
1
Q
What is TCP?
A
Transport Control Protocol.
2
Q
Which protocol guarantees info delivery?
A
Transfer Control Protocol (TCP). UDP is “best effort”.
3
Q
What is UDP?
A
User Datagram Protocol (UDP)
4
Q
What is a benefit of UDP?
A
Faster than TCP (Transfer Control Protocol)
5
Q
What is Transfer Control Protocol really good for?
A
File transfer, email, and web page requests.
6
Q
What is UDP really good for?
A
Audio and streaming. Since there is no guarantee the connection was made you can loose data, but you gain speed. That’s acceptable with audio and stream (normally)
7
Q
What is meant by TCP being connection-orientated?
A
Transfer Control Protocol ensures that a connection is established between the sender and the receiver. It is reliable in that you know the message will be received.
8
Q
Why is UDP considered Connection-less orientated Protocol?
A
User Datagram Protocol will only promise to send the request to the target. It doesn’t ensure the target is ready to receive, or that it has been received. Fire and pray.
9
Q
How does every TCP (transfer control protocol) session start?
A
3-way handshake
10
Q
What is a 3-way handshake composed of, and what protocol uses it?
A
TCP uses it. It is 3 packets that go back and forth from the sender to the destination to establish connection. The packets have no payload.
11
Q
Describe the 3-way handshake process.
A
TCP sets up the connection by sending a SYN packet to the destination machine, the destination then sends back a SYN/ACK packet, and TCP then sends its ACK packet back.
12
Q
What else is being set up in the 3-way handshake besides connection?
A
Flow control. They are telling each other how fast they can send and receive data, and agreeing on an optimal choice.
13
Q
In TCP, what must occur before sending any data?
A
A connection via the 3-way handshake (also identify the flow control)
14
Q
Every time a data packet is sent in TCP what should occur?
A
The destination should send an acknowledgement. If not it will need to send again.
15
Q
Explain an “error” message in terms of TCP
A
During the 3-way handshake the destination did not acknowledge. The initiator send numerous attempts until its default limit was reached. Then provided the user with an error message.
16
Q
TCP sends packets, what does UDP send?
A
User Datagram Protocol sends datagrams.
17
Q
TCP and UDP both use ports. What is another name for ports?
A
service identifiers
18
Q
What are ports, or service identifiers?
A
Ways of breaking up channels so you can multiple different applications over them
19
Q
Ports, or service identifiers are specifically set up for what?
A
Each port, or group of ports is for a specific exchange. The computer is listening for messages that apply to the specific port, through that port. For example, Port 80 is reserved for HTTP traffic.
20
Q
Who decides what ports are reserved for specific traffic?
A
(IANA) Internet Assigned Numbers Authority
21
Q
How many ports are there in a computer?
A
0 - 65535 (so 65536)
22
Q
What ports are reserved for “well known” ports (ie. DNS or HTTPS)
A
0 - 1023
23
Q
What set of ports are registered, but at the moment unassigned by IANA
A
1024 - 49151
24
Q
What set of ports are unassigned and open for anyone to use? Also known as Dynamic.
A
49152 - 65535
25
If a server is not listening to a certain port when a request is made what will happen
It will not respond
26
If I am a developer that has made a new protocol, where would I go to get a port assigned to my protocol?
IANA (Internet Assigned Authority)
27
What is the dynamic assigned SOURCE port that a client uses to send out a request to establish a connection called?
Ephemeral Port
28
What is a source port?
This is the port that the client machine uses to send out the message hoping to establish a connection with a server.
29
How are source ports (Ephemeral Ports) chosen?
They are randomly assigned from a cache of ports that the system uses. Ex: Windows uses a cache of 1025 - 5000. One of these would be assigned arbitrarily to the client machine.
30
What is FTP?
File Transfer Protocol
31
What ports do FTP run on?
TCP port 20 and 21.
32
Why does FTP (File Transfer Protocol) use 2 TCP ports?
One port is used to send the command communications (log me in, authenticate me, upload this file, etc), and the other port is used for data transfers.
33
What is a problem with FTP (file transfer protocol)?
It is insecure. It is an unencrypted protocol. A sniffer in the middle between A and B can see all the information being exchanged (this includes passwords, usernames, data, everything)
34
What is TFTP?
Trivial File Transfer Protocol
35
Is TFTP run on TCP ports or UDP ports?
UDP ports.
36
Is FTP run on TCP or UDP ports?
TCP ports
37
What port does Trivial File Transfer Protocol (TFTP) run on?
User Datagram Protocol (UDP) ports
38
How does TFTP differ from FTP?
It is run on UDP ports. It transfers data to a remote machine with basically no commands and no authentication
39
Using TFTP what is all you need to make your transfer?
Remote end and file name. This IP address, get this .doc
40
What is ARP?
Address Request Protocol
41
What layer is Address Request Protocol (ARP) located?
Data Link, Layer 2.
42
How does Address Request Protocol work?
Requests MAC addresses for a given IP address. "I have a packet for 192.168.1.5, which computer is that, tell me, I am 192.168.1.1. (this is done on the same network, the package is already within the network, now its trying to get to is destination). The owner of the IP would then give the MAC address so the package can be delivered.
43
What is a problem with ARP (Address Request Protocol)
No authentication. A spoof can be placed that just says its everything so now all traffic goes to it. (Man in the middle)
44
What is DHCP?
Dynamic Host Control Protocol
45
What does DCP (Dynamic Host Control Protocol)
Assign an IP to a machine at boot time.
46
Why would a machine need to use a DHCP (Dynamic Host Control Protocol) server?
If you have not statically assigned, manually assigned, an IP address to your machine it can request one from a DHCP server every time it boots up.
47
What is a DHCP machine, in terms of the network?
It is one server on the network that assigns dynamic IP addresses to machines that request one. (because they were not manually assigned an IP address)
48
How does the DHCP server work? (Dynamic Host Control Protocol)
A machine asks for a DHCP server, it responds, the machine requests an IP address, the DHCP either gives it one from its pool or it can select one it has already identified as reserved for that machine's MAC address.
49
What is a MAC address
Media Access Control address. Unique identifier assigned to network interfaces for communications on the physical network segment.
50
How do you assure that a computer using a DHCP server will get the same IP address everytime?
You would need to associate the machines MAC address with a specific IP address within the DHCP server. It will associate that MAC address with the correct IP. If not it will just assign a random IP from its pool of IP addresses
51
How does BOOTP work?
When a client machine turned on it would get a address from BOOTP but it would also boot up from there as well. (earlier form of DHCP) there was no hard drive or media on the terminal.
52
What is ICMP?
Internet Control Message Protocol
53
What is Internet Control Message Protocol (ICMP) used for?
Management messages, not data payload. Most common is a "ping". Basically checking to see if the devices on the network are awake and working. The requested machine would send an "echo" acknowledgment
54
What is RTP? (VoIP Protocols)
Real-time Transport Protocol
55
What does Real-time Transport Protocol do?
Defines type of packets used to move voice or data from a server to clients
56
What is SIP (VoIP Protocols)?
Session Initiation Protocol and H.323
57
What does Session Initiation Protocol and H.323 do?
Runs on top of Real-time Transport Protocol (RTP). It handles the initiation, setup, and delivery of VoIP sessions.
58
What is RTSP (VoIP Protocols)?
Real-time Streaming Protocol
59
What does Real-time Streaming Protocol (RTSP) do?
Runs on top of RTP.
60
What is VoIP?
Voice over IP.
61
What technology allows for specific phones to plug into the network and communicate using the normal computer network?
Voice over IP. (VoIP).
62
What protocols allow for VoIP systems to run on the network?
Real-time Transport Protocol (RTP)
Session Initiation Protocol (and H.323) (SIP)
Real-time Streaming Protocol (RTSP)
63
What is DNS?
Domain Name Service (U53)
| *Runs over port 53.
64
What does Domain Name Service (DNS) do?
Translates human friendly names to machine friendly addresses.
65
What are some potential attacks is Domain Name Service (DNS) susceptible to?
Redirect, intercept, or deny services
66
What are some CONS to Domain Name Service (DNS)
No integrity, confidentiality, or authentication.
67
What is LDAP?
Lightweight Directory Access Protocol
| *Runs on Port T389
68
What is Lightweight Directory Access Protocol (LDAP) used for?
Used for lookups (queries) over a network.
| *Looks up many things to include user authentication info.
69
What is NetBOIS?
Network Basic Input Output System
| *Ports U/T 135 - 139
70
What is a common attack for NetBOIS?
Worm attacks
71
What was the Predecessor for LDAP?
NetBOIS
72
When talking about Ports U/T 135 - 139, what does the U and T stand for?
U= UTP, T = TCP. It means that the protocol that runs on ports 135 -139 run on both UTP and TCP ports.
73
What is NTP? And What port(s) does it run on?
Network Time Protocol
| *U123
74
What is IGMP, and what port(s) does it run on?
Internet Group Management Protocol
| * Not sure about the port :/
75
What is SNMP, and what port does it run on?
Simple network management protocol
| *port T/U 161
76
What is IM?
Instant Messaging.
77
Instant Messaging (IM) allows peer to peer communication. What are the "peers"?
Computers.
78
In IM, one computer sends a message to another. Those computers use a brokered messenger server. What does that mean?
One computer doesn't send a message directly to another, instead it sends it to a messenger server, which then sends it to the recipient.
79
There are many IM programs that work in different ways, what does that mean in regards to what ports you would expect an IM protocol to located on?
There can be any number of ports used in this case. However, many run over port 80.
80
What is IRC, and what port will you find it on?
Internet Relay Chat
| * located on port 6667
81
What is IRC an early form of?
Instant messaging, internet chatting.
| *text only
82
How can IRC be integrated on an attack?
A malicious user can implant a BOT on your computer, and then send control instructions to the computer using this Internet Relay Chat.
83
What is NNTP, and what port will you find it?
Network News Transfer Protocol
| * 119
84
What is SMTP and what port will you find it?
Simple Mail Transfer Protocol
| * T25
85
What is POP, and what server will you find it?
Post Office Protocol
| * T110
86
What is IMAP, and what port will you find it?
Internet Message Access Protocol
| * T143
87
What protocol sends mail to a mail server?
Simple Mail Transfer Protocol (SMTP)
88
What protocol(s) are used to retrieve the mail that was sent to the mail server using Simple Mail Transfer Protocol (SMTP).
Post Office Protocol (POP) and Internet Message Access Protocol (IMAP)
89
What is TELNET? What port will you find it?
TCP/IP Terminal Emulation Protocol
| *T23
90
What is RLOGIN?
Remote Login
91
What is RSH?
Remote Shell
92
What is RCP?
Remote Copy.
93
What is X11?
X Window System
94
What did the TELNET and R suite of tools (RLOGIN, RSH, RCP) allow the user to do?
Remotely access another terminal without physically sitting at it.
*lacked security. No encryption or authentication.
95
What does X11 allow the user to do?
Forward a display. Normally the computer would use the video cable to send a display to the computer's monitor. X11 allows you to use your network to send a display to another terminal on the network.
*unencrypted, so all the movements could be monitored.
96
When you use a insecure program like X11, what would you need to do to make it secure?
Run it through a Secure Shell.
97
What is CIFS, and SMB?
Common Internet File System and Server Message Block. This is a file sharing protocol, a server hosts files that clients can download
* various authentication methods are used.
98
What is NFS?
Network File System. This is another file sharing system.
| * authentication is possible through Secure RPC (Remote
99
Which file sharing systems are considered Windows based?
Common Internet File System (CIFS) and Server Message Block (SMB)
100
Which file sharing system is UNIX LINIX Based?
Network File System (NFS)
101
What is SNFS?
Secure Network File System
| *Authenticates each request, which increases the overhead from NFS.
102
Why wasn't Secure Network File System (SNFS) widely adopted?
They used time synchronized servers, meaning if the times weren't synced up the communication would not happen.
103
What is SFTP?
Secure FTP
* part of the Secure Shell Suite
* You can do everything that was possible with FTP (File Transfer Protocol) but now its encrypted.
104
What port does Secure FTP (SFTP) run off of?
TCP Port 22
| *default port for secure shell suite
105
What is HTTP, and what port would it be found?
Hypertext Transfer Protocol
* T80
* Standard web based communications
* Unencrypted
106
What is HTTPS, and what port would it be found.
Hypertext Transfer Protocol over SSL or TLS
* T443
* SSL is Secure Socket Layer Connection
* Takes all the web based communications you would find in HTTP and puts a layer of encryption over it.
107
What is S-HTTP
Secure Hypertext Transfer Protocol
| *not the same as HTTPS
108
What kind of security protocols can you implement on Layer 1?
Physical security (like placing a locked box over a cable outlet)(door locks). Choosing more protected cables.
109
What kind of security protocols can you implement on Layer 2.
PPTP, Layer 2 Forwarding, Layer 2 Tunneling Protocol, wireless network security, MPLS.
*you can protect layer 2 traffic using tunneling protocols
110
What kind of security protocols can you implement on Layer 3?
GRE (Generic Routing Encapsulation), IPSec (IP Security)
111
What kind of security protocols can you implement on Layer 4?
SSL (Secure Socket Layer), TLS (Transport Layer Security), WTLS ( Wireless Transport Layer Security), SSH (Secure Shell Protocol), SOCKS (Socket Secure).
*This is where TCP is. So when we set up the 3way handshake we can add more handshakes that set up the encryption.
112
What kind of security protocol can you implement on Layer 5+?
This is the application layer. You can have add on's to the application itself. S-RPC, DNSSEC, S-HTTP
113
In regards to Layer 2 security what is PPTP?
Point to point tunneling protocol.
* I'm going to encapsulate more headers on my layer 2 frame, and the encapsulated headers are going to handle encryption between point A to point B.
* "tunnel" this layer 2 traffic in more encryption
114
What is L2F?
Layer 2 Forwarding
* Not IP dependent
* Relies on PPP for authentication (tunnels PPP traffic)
* Used for VPNs
* No encryption by itself.
115
What is IPSec?
Internet protocol security
* Encapsulates at Layer 3 ( Network Layer)
* Mutual node authentication
* Can authenticate users but requires L2TP
* Crypto implementation agnostic
* Client to client, or node to node.
* Mandatory for IPv6 implementation
Does not work with NAT (unless NAT-Transversal is used)
116
What is GRE?
Generic Route Encapsulation
* Encapsulates Layer 3 (Network Layer) packets in IP tunnel
* Used to secure VPNs
* Creates a virtual point to point link with destination
* Supports multicast protocols (IPSec doesn't)
117
What is SOCKS?
Socket Security
* Allows internal clients to access external resources
* Allows external access to internal clients
* Provides authentication and encryption
* A type of proxy server that gets in the way between Point A and Point B and requires me to authenticate before I can get to the end resource (Point B)
* When one person in the office has access to a certain website, but nobody else does, this allows that user to access that point after authentication.
118
What is SSH
Secure Shell
* Creates tunnels that other applications can use
* Provides server and client authentication and encryption
119
What is SSL and TLS?
Secure Socket Layer and Transport Layer Security
* Encrypts client-server communication
* Used by protocols (e.g HTTPS) for security
* Server authentication to client mandatory
* Client authentication to server optional
120
What does a SSL(Secure Socket Layer) and TLS (Transport Layer Security) handshake include?
* Encryption negotiation
* Identification of server and/or client
* Key exchange
121
What is S-RPC
Secure Remote Procedure Call
* Based on DES (Data Encryption Standard) encryption algorithm
* Uses public key scheme for encryption
* Laying encryption on top of RPC which is just one computer giving instruction to another.
122
What is DNSSEC?
Domain Name System Security
* Provides authentication and integrity of DNS (Domain Name System) answers
* Designed to protect against cache poisoning
* Uses public key schemes, but does not do encryption
