Application Layer Protocols
HTTP (port 80 TCP) and HTTPS (port 443 TCP): web traffic. HTTP is cleartext; HTTPS wraps HTTP in TLS. Always use HTTPS for any sensitive data. HTTP/1.1, HTTP/2, HTTP/3 (QUIC over UDP) — newer versions improve performance. Status codes: 200 OK, 301/302 redirect, 401 unauthorized, 403 forbidden, 404 not found, 500 server error.
DNS (port 53 UDP/TCP): resolves names to IPs. UDP for standard queries; TCP for zone transfers and large responses. DNSSEC adds cryptographic signatures. DNS runs on UDP 53 for queries and TCP 53 for zone transfers — know both.
DHCP (port 67 UDP server, 68 UDP client): automatic IP configuration via DORA process (Discover, Offer, Request, Acknowledge). DHCP uses broadcasts — relay agents (IP helper) forward DHCP across routed segments. DHCPv6 operates differently — uses multicast and stateless address autoconfiguration (SLAAC).
SMTP (port 25 TCP, 587 for submission): email sending. SMTPS (port 465). POP3 (port 110 TCP, 995 secure): downloads mail, typically deletes from server. IMAP (port 143 TCP, 993 secure): accesses mail in-place, syncs across devices. FTP (ports 20/21 TCP): file transfer; control on 21, data on 20 (active) or dynamic port (passive). SFTP (port 22 TCP, over SSH) and FTPS (FTP + TLS) are secure alternatives.
SSH (port 22 TCP): encrypted remote shell, replaces Telnet (port 23 — cleartext, never use). SNMP (port 161 UDP, traps on 162 UDP): network device management. SNMPv3 adds encryption and authentication — always use v3. Syslog (port 514 UDP): log forwarding to central collector. NTP (port 123 UDP): time synchronization — critical for authentication, certificates, and log correlation.
Transport Layer Protocols
TCP (Transmission Control Protocol): connection-oriented, reliable, ordered delivery. Three-way handshake (SYN, SYN-ACK, ACK) before data. Four-way close (FIN, ACK, FIN, ACK). Uses sequence numbers and acknowledgments. Flow control via window size. Congestion control. Used for: HTTP, HTTPS, SSH, FTP, SMTP, POP3, IMAP, DNS zone transfers. When data integrity matters more than speed.
UDP (User Datagram Protocol): connectionless, unreliable, no ordering guarantees. No handshake — send and hope. Faster due to no overhead. Used for: DNS queries, DHCP, TFTP, streaming media, VoIP, gaming, NTP, SNMP. When speed matters more than guaranteed delivery.
Common port ranges: Well-known ports 0–1023 (reserved for standard services). Registered ports 1024–49151. Dynamic/ephemeral ports 49152–65535 (used by clients for source ports).
Network and Data Link Protocols
IP (IPv4 and IPv6): Layer 3 addressing and routing. IPv4 uses 32-bit addresses, IPv6 uses 128-bit. ICMP (Internet Control Message Protocol): error reporting and diagnostics — ping (echo request/reply), traceroute (TTL exceeded), port unreachable. ICMPv6 also handles neighbor discovery in IPv6.
ARP (Address Resolution Protocol): resolves IPv4 addresses to MAC addresses. ARP request is broadcast; ARP reply is unicast. 'arp -a' displays the ARP cache. Gratuitous ARP: a device announces its own IP-to-MAC mapping — used after IP change, can be exploited for ARP spoofing. NDP (Neighbor Discovery Protocol): IPv6 equivalent of ARP, uses ICMPv6.
Ethernet (IEEE 802.3): Layer 2 LAN protocol. MAC addresses: 48-bit, written as colon- or hyphen-separated hex pairs. Frame format: destination MAC, source MAC, EtherType/length, data, FCS. 802.1Q: VLAN tagging — adds 4-byte tag to Ethernet frame including VLAN ID (VID). 802.1X: port-based access control — devices authenticate before network access.