Network Protocols Explained

Various Network Protocols

• Internet Protocol (IP) operates at Layer 3.
• Internet Service Provider (ISP) is a provider of internet access.
• Network Address Translation (NAT) translates network addresses.
• Virtual Private Network (VPN) provides a private network over a public network.
• Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) are transport layer protocols.
• Domain Name System (DNS) translates domain names to IP addresses.
• Secure Shell (SSH) provides a secure, encrypted connection to a remote computer.
• File Transfer Protocol (FTP) is used for transferring files between computers.
• HyperText Transfer Protocol (HTTP) is used for communication on the World Wide Web.
• Simple Mail Transfer Protocol (SMTP) is used for sending email.
• Simple Network Management Protocol (SNMP) is used for managing network devices.
• Dynamic Host Configuration Protocol (DHCP) automatically assigns IP addresses to devices on a network.
• Internet Control Message Protocol (ICMP) is used for network diagnostics.
• Time to Live (TTL) indicates how long a packet can live on a network before it's discarded.
• Address Resolution Protocol (ARP) resolves IP addresses to MAC addresses.

IP - Internet Protocol

• It is a method for sending data from one computer to another over the Internet.
• A numerical label assigned to each device connected to a computer network.
• IPv4 utilizes addresses such as 192.168.128.2.
• IPv6 utilizes addresses such as 200.7.149.50.
• Public IP addresses differentiate devices plugged into the public internet and are sometimes called Internet IPs.
• Each device accessing the internet uses a unique public IP address.
• ISPs use public IP addresses to forward internet requests to specific locations with similarity to how delivery vehicles use physical addresses to get the delivery done.
• Private IP addresses, like their public counterparts, are unique device identifiers behind a service providing device.
• Devices on a home network can share the same private IP addresses as devices elsewhere because private IP addresses are not routable on the internet.
• A private IP address ranges include:
  • 192.168.0.0 - 192.168.255.255 (65,536 IP addresses)
  • 172.16.0.0 - 172.31.255.255 (1,048,576 IP addresses)
  • 10.0.0.0 - 10.255.255.255 (16,777,216 IP addresses)
• IPv4 requires each internet-connected machine to have a unique IP address which allows for roughly 4.3 billion devices.
• IPv6 uses 128-bit addresses (e.g., fe80::240:d0ff:fe48:4672), solving address limitations.
• IPv6 also improves security and allows for router autoconfiguration.

Internet and Intranet

• The Internet operates as a global network using TCP/IP to connect devices worldwide and is a public network accessible to anyone.
• The Internet exhibits less security and high traffic due to its global scale and large user base.
• An intranet is a private network within an enterprise.
• The Intranet is more secure and has minimal traffic due to it's restricted user base.

NAT (Network Address Translation)

• NAT is a process in which a network device, usually a firewall, assigns a public address to a computer or group of computers inside a private network.

VPN (Virtual Private Network)

• A VPN extends a private network across a public network.
• VPN enables users to send and receive data across shared or public networks as if their devices were directly connected to the private network.

DNS (Domain Name System)

• DNS translates IP addresses to domain names and vice versa.
• DNS can be considered as the "phonebook of the Internet"
• Humans can access online content by using domain names like www.google.com.
• Web browsers interact using IP addresses, wherefore DNS translates domain names to IP addresses.

SSH & Telnet

• Secure Shell (SSH) is a cryptographic network protocol for secure network service operation over unsecured networks with remote command-line, login, and command execution applications.
• Telnet is a network protocol providing a command-line interface for device communication, often used for remote management and device setup (switches and access points).

FTP (File Transfer Protocol)

• FTP is a standard Internet protocol transmitting files between computers over TCP/IP connections using a client-server architecture.
• FTP clients are for uploading, downloading, and managing server files.
• WinSCP can be used as a Windows FTC client supporting FTP, SSH, and SFTP.

HTTP and HTTPS

• HTTP stands for Hyper Text Transfer Protocol.
• WWW (World Wide Web) is about communication between web clients and servers.
• Client computers and web servers communicate by sending HTTP Requests and receiving HTTP Responses.
• HTTPS secures communication over a network using the Hypertext Transfer Protocol (HTTP).

The HTTP Request/Response Circle

• A browser requests an HTML page and the server returns the HTML file.
• When a browser requests a style sheet, the server returns a CSS file.
• Browsers and servers mirror the above process for JPG images and JavaScript codes.
• Browsers request and get data in XML or JSON formats.
• Clients send HTTP requests to a web server.
• The web server receives the request and runs an application to process it.
• The server sends an HTTP response (output) to the browser.
• Then the client (browser) receives the response (output).

SMTP (Simple Mail Transfer Protocol)

• SMTP is a set of communication rules allowing software to send electronic mail.
• SMTP is used to send email and acts as a push protocol with email retrieval using IMAP or POP and operates under an application layer protocol.
• When an email is sent, a user initiates a TCP connection to the SMTP server, transmitting the mail.
• The SMTP server, always in listening mode, creates a connection upon a TCP connection request.
• Once the TCP connection is established, mail is sent immediately.
• SMTP transmits messages through email addresses.
• It makes message exchanges between clients, either on the same computer or on different devices for the same user.
• It transmits to multiple recipients, attaches media, or sends messages to external networks.

SNMP (Simple Network Management Protocol)

• SNMP is an application-layer protocol defined by the Internet Architecture Board (IAB) in RFC1157.
• It's for exchanging network management information between devices and is part of the TCP/IP protocol suite to manage network elements.
• Syslog is for network devices sending event messages to a logging server.
• The Syslog protocol is supported by various devices for logging different event types.
• Examples of its functionalities include system reboots, port status, login details, and the documentation of system changes.

SNMP vs Syslog

• SNMP remotely monitors devices, being active and secure, using UDP ports 161 and 162.
• SNMP alerts on critical actions, like HSRP state changes.
• Syslog, on the other hand, handles log messages of different severities, pushing logging info passively for historical data over TCP/UDP port 514.
• SNMP server polls devices, Syslog server is capable of receiving syslog messages.
• SNMP provides real-time information, allowing end device configuration using SNMP set.
• Syslog, while generally insecure and shares events in plain text, is primarily used to collect and acquire historical data.

DHCP (Dynamic Host Configuration Protocol)

• DHCP is a protocol used for automatic and central IP address distribution within a network.
• It configures the subnet mask, default gateway, and DNS server information, which is also referred to as dynamic IP address setting
• Addresses can be assigned statically (without DHCP server) or dynamically (with DHCP server).

ICMP (Internet Control Message Protocol)

• ICMP communicates between internet network devices.
• ICMP is used by network administrators for troubleshooting Internet connections.
• This is normally done using utilities like 'ping' and 'traceroute'.
• ICMP has been used to execute DDoS attacks using oversized IP packets.
• In a DDoS attack, multiple compromised systems flood a target server or network with traffic.

DDoS Attack

Attacks typically feature an attacker, bots, and a targeted victim.

Ping & Traceroute

• Ping tests if a host is reachable.
• Ping sends data packets to a server; upon receiving a data packet back, a connection is established.
• Traceroute traces the path packets take to an IP address.
• "Ping 'IP address'" can test the connection; "-t" command enables continuous pinging; "-t -l 1024" activates continuous pinging with 1024 bytes data packets.

TTL (Time-to-Live)

• TTL is a value in an IP packet.
• It tells a network router whether the packet has been in the network too long and should be discarded.
• Ping and traceroute utilities use the TTL value to reach a host or trace a route.
• Packet scope is controlled by TTL according to convention.
• Scopes include 0 (same host), 1 (same subnet), 32 (same site), 64 (same region), 128 (same continent), and 255 (unrestricted).

ARP (Address Resolution Protocol)

• ARP finds a host's hardware address from a known IP address.
• ARP is a communication protocol that discovers the link layer address (MAC address) associated with a given internet layer address (IPv4 address).
• This mapping is vital in in the suite of internet protocols

Network Addressing

• Classfull network example: 192.168.0.0/24.
• Router address: 192.168.0.1.
• Host addresses (Switch: 192.168.0.2, Wireless modem: 192.168.0.3, Wireless router: 192.168.0.4).

Network Addressing types

• Class A: Network.Node.Node.Node, 255.0.0.0 subnet mask, 126 networks, and 16,777,214 hosts.
• Class B: Network.Network.Node.Node Node, 255.255.0.0 subnet mask, 16,382 networks, and 65,534 hosts.
• Class C: Network.Network.Network.Node, 255.255.255.0 subnet mask, 2,097,150 networks, and 254 hosts.

Network Addressing - Private IP Addresses

• Class A: 10.0.0.0, 255.0.0.0 subnet mask and has an address range of 10.0.0.0 - 10.255.255.255.
• Class B: 172.16.0.0 - 172.31.0.0 addresses, 255.240.0.0 subnet mask and has an address range of 172.16.0.0-172.31.255.255.
• Class C: 192.168.0.0, 255.255.0.0 subnet mask and has an address range of 192.168.0.0 - 192.168.255.255.
• The addresses from 127.0.0.0 to 127.255.255.255 can't be used and are reserved for loopback and diagnostic functions.

Addressing - Classless Interdomain Routing (CIDR)

• Subnet masks vary based on the CIDR value.
• Ranges from /8 (255.0.0.0) to /30 (255.255.255.252).

VLSM (Variable Length Subnet Mask)

• VLSM involves using different subnet mask lengths with a same network address.