Chapter 8: TCP/IP Applications

Different forms of data as it moves through the network layers:

Ethernet Frame (MAC addresses, switches)

IP Packet (IP addresses, routing)

TCP Segment / UDP Datagram (Transport layer)

TCP → Connection-oriented, reliable, uses handshake.

UDP → Connectionless, faster, no handshake.

SYN – Client starts connection.

SYN-ACK – Server acknowledges.

ACK – Client confirms, connection established.

When speed matters more than reliability (e.g., live streaming, VoIP, TFTP).

netstat (displays open connections).

A data unit at the Ethernet layer containing MAC addresses, IP packet, and other header info.

Protocol Data Unit.

Ethernet layer → Ethernet frame

IP layer → IP packet

TCP layer → TCP segment

UDP layer → UDP datagram

Connection-oriented.

Connectionless.

SYN → SYN-ACK → ACK.

UDP.

TCP (≈ 98–99%).

TFTP (Trivial File Transfer Protocol).

When speed is more important than reliability, or for quick local transfers.

Use the netstat command.

ICMP (Internet Control Message Protocol) operates at the IP layer and is used for network diagnostics and error reporting (e.g., Ping, Traceroute).

No, ICMP operates at the IP layer, so it doesn’t use port numbers.

Ping (Uses ICMP Echo Request/Reply).

IGMP (Internet Group Management Protocol) enables multicast communication, allowing devices to join a 224.x.x.x multicast group and receive a single stream instead of individual copies.

Live video streaming (e.g., a webinar with thousands of viewers) where a single multicast stream is sent instead of thousands of individual streams.

224.0.0.0 to 239.255.255.255 (Always starts with 224.x.x.x).

It reduces bandwidth usage by sending one stream to multiple recipients instead of separate streams for each.

Internet (IP) layer.

The Type field.

“No route to host” and “Host unreachable.”

Internet Group Management Protocol.

Multicast

The multicast address to join/listen to.

The sender’s IP address.

Sends one stream to many recipients instead of separate unicast streams.

Yes

No, they are Internet layer protocols.

Unicast (1-to-1), Multicast (1-to-many), Broadcast (1-to-all), Anycast (1-to-nearest).

North-South: Traffic entering/exiting a network (e.g., internet access).

East-West: Internal traffic (e.g., VM-to-VM communication in a data center).

Wireshark (packet sniffer), netstat (active connections), traceroute (path analysis).

Multicast sends one stream to many receivers, reducing bandwidth usage.

Controlling data flow to prioritize critical traffic (e.g., Zoom calls over YouTube).

Congestion (too much traffic), long distances, or inefficient routing.

It routes requests to the nearest DNS server, reducing response time.

All data moving over a network at any time, regardless of format or purpose.

Packets, frames, segments.

Protocol Data Units (PDUs).

Electrical impulses representing binary-encoded text.

Between two devices on the same LAN.

Across a WAN.

From the internet to an internal network.

One-to-one communication.

One-to-multiple specific nodes.

One-to-all nodes on a segment.

One-to-nearest node in a group.

Topology, switchouter configuration, routing protocols.

Peak-time congestion, high-bandwidth apps, misconfigured hardware.

Manually (gateway/internal device) and automatically (software tools).

Traffic shaping, load balancing, bandwidth management.

tracert = Windows command (uses ICMP).

traceroute = Linux/macOS command (uses UDP by default).

The router is blocking ICMP/UDP responses (common for security).

Adds ping statistics (latency/packet loss) for each hop.

Downloadpload speeds (Mbps) and latency (ms).

Wi-Fi interference, outdated router, ISP congestion, or background downloads.

If it can’t handle your ISP’s speeds (e.g., gigabit internet needs a Wi-Fi 6 router).

Diagnosing why a website is unreachable (e.g., stops at ISP’s gateway → ISP issue).

As electrical impulses representing binary-encoded data.

It lists each hop (router) a packet takes from your computer to a target destination.

tracert

traceroute

To establish a baseline for comparison during network issues.

Some routers don’t respond to traceroute requests.

Pathping

Pathping uses ping-based tests to gather route info and can work when traceroute is blocked.

The local computer.

Both trace the same actual network path between source and destination.

To check your internet download and upload speeds against your ISP’s advertised speeds.

Yes, 70–80% of advertised speeds is generally good.

Latency issues and poor-quality routers.

They may not handle multiple simultaneous high-bandwidth users well.

Upgrade to a higher-quality router.

Network protocol analysis, troubleshooting, and security auditing.

Use http in the filter bar.

Reconstructs a full conversation (e.g., HTTP requestesponse).

For scripting, remote captures, and scheduled logging.

Filter arp and look for duplicate IP-MAC mappings.

A free protocol analyzer used to capture and analyze network traffic.

The capture tool (collects network packets) and the analyzer (interprets the packets).

Number, timestamp, source/destination addresses, protocol, and brief description.

In layered form — Ethernet → IP → TCP/UDP → Application data.

The raw hexadecimal data of the selected frame.

Follow TCP Stream.

BOOTP is the older protocol that DHCP is based on; Wireshark uses that label.

It can be slower and may miss some packets.

A command-line packet capture tool; captures can be saved and opened in Wireshark for analysis.

Scheduling captures, pre-filtering by IP or protocol, capturing at specific times.

Windows, macOS, and Linux.

Wi-Fi, Bluetooth, VoIP, and more

A command-line tool that displays active network connections, listening ports, and routing tables.

Shows IP addresses and port numbers (no DNS resolution).
▶ Example: 192.168.1.5:443 instead of google.com:https.

Use netstat -b (requires Admin rights).
▶ Output: [chrome.exe] next to connections.

All active + listening ports (even unused ones).
▶ Key ports:

80 (HTTP)

443 (HTTPS)

3389 (RDP)

Use netstat -o, then check Task Manager for the PID.

ESTABLISHED = Active connection.

LISTENING = Port is open but idle.

netstat -r or route print.
▶ Key output: 0.0.0.0 = Default gateway.

Combines:

-a (all ports)

-n (raw IPs)

-o (PIDs)
▶ Best for troubleshooting!

ss -tulnp or lsof -i.

Run netstat -b -n → Look for:

Unknown executables (e.g., [malware.exe]).

Suspicious foreign IPs.

Netstat is a command-line tool used to monitor all active network connections, including TCP and UDP connections, their local and foreign addresses, ports, and associated processes.

Protocol type (TCP/UDP), local IP and port, foreign IP and port, and connection state.

Displays raw IP addresses and port numbers instead of translating them into hostnames or service names.

It provides clear, unambiguous information about active connections, making it easier to identify IPs and ports quickly.

By using the -b option, which shows the executable or program for each connection (requires administrator privileges).

Shows the Process ID (PID) of each connection, which can be cross-referenced in Task Manager to find the application.

Displays all active and listening ports, even if no current connections exist on those ports.

Using the -r option, which shows the routing table, equivalent to route print.

States like ESTABLISHED (active connection) and TIME_WAIT (connection recently closed but not fully terminated).

It helps detect unauthorized connections, identify which processes are using network ports, troubleshoot connectivity issues, and audit open ports for security.

Look up the port number to determine the associated protocol or service.

Process Explorer and TCPView from Sysinternals.

It is lightweight, command-line based, universally available, and excellent for quick diagnostics.

Control: Port 21 (TCP)

Data: Port 20 (TCP) in active mode.
Key Point: Passive mode uses random ports (client-initiated).

Username: anonymous

Password: (empty) or email (optional)

Grants read-only access to public directories.

Risk: Plaintext credentials/data.

Fix: Use SFTP (port 22) or FTPS (ports 989/990).

Active: Server connects back to client (issues with firewalls).

Passive: Client connects to server (firewall-friendly).

ftp server.com
> get file.txt # Download
> put file.txt # Upload
> dir # List files

Trivial FTP (UDP port 69).

Use: Network device configurations (e.g., Cisco IOS updates).

Default folder a user lands in after login (set by server admin).

Wireshark (filter ftp to see plaintext).

Tcpdump: tcpdump -i eth0 port 21.

Disable anonymous login if unused.

Use IP whitelisting.

Enforce strong passwords.

Log all access attempts.

FTP: Faster for large files, stateful connections.

HTTP: Stateless, better for web integration.

File Transfer Protocol, used to transfer files over a network or the Internet.

It is reliable for transferring very large files and predates the World Wide Web.

A system that hosts files and responds to requests from FTP clients.

Software that connects to an FTP server to upload or download files (e.g., WS_FTP, FileZilla, command-line clients).

The server folder assigned to a user where they have permissions to read, list, or write files.

Read, write, and create directories.

Allows public users to log in without a password, typically for reading or listing files.

Users often enter their email address as a password, though it is optional.

It transmits usernames, passwords, and files in plaintext, making it vulnerable to eavesdropping.

By using SFTP or FTPS, which encrypt data using SSL or TLS.

Trivial FTP (TFTP) is a lightweight, UDP-based protocol running on port 69, lacking FTP’s robust features.

With protocol analyzers like Wireshark, capturing login, file transfers, and directory commands.

Because FTP uses two ports (21 for commands and 20 for server responses), routers may need configuration to allow proper communication.

Yes, Windows and Linux include command-line FTP clients for connecting to FTP servers.

TCP 25 (unencrypted), 587 (with TLS).
Key Point: SMTP sends mail; POP3/IMAP receive it.

POP3: Downloads/deletes emails from server (port 110).

IMAP: Syncs emails across devices (port 143).

Transfers credentials and data in plaintext (use ports 587/993/995 for encryption).

Syncs folders/emails server-side (accessible from any device).

Enforce SMTPS (587), IMAPS (993), POP3S (995).

Use SPF/DKIM/DMARC to prevent spoofing.

IMAP (POP3 deletes unless configured to keep copies).

Wireshark (filter smtp to see plaintext emails).

SMTP server (port 25/587).

POP3/IMAP server (port 110/143 or 995/993).

Webmail (e.g., Gmail) or encrypted protocols (OAuth 2.0).

Simple Mail Transfer Protocol; used to send email.

Port 25.

Post Office Protocol version 3; used to download emails from the server to the client.

Port 110.

Internet Message Access Protocol version 4; used to access and manage emails on the server while keeping them synchronized with the client.

Port 143.

POP3 downloads emails to the client and often deletes them from the server; IMAP keeps emails on the server and synchronizes them across clients.

Most modern email server software, e.g., Mail Server, can serve both functions

Example: Timmy.local.

No; they transmit usernames, passwords, and messages in cleartext.

Wireshark

Because these are standard email ports frequently tested on the exam.

Traditional TLS: Starts unencrypted, upgrades later (ports 465/995/993).

STARTTLS: Begins encryption immediately (ports 587 for SMTP, 110/143 with STARTTLS command).

587 (STARTTLS). 465 is deprecated but still seen in legacy systems.

Defaults to plaintext; attackers can intercept credentials/data. Mitigation: Use 587 + STARTTLS.

Implicit TLS: Port 993 (always encrypted).

STARTTLS: Port 143 (upgrades to encryption via STARTTLS).

Selecting "SSL/TLS" in Thunderbird when you mean STARTTLS (check port numbers!).

Disable plaintext ports (25/110/143) or require STARTTLS.

Use smtpd_tls_security_level=encrypt in Postfix.

Initial handshake is plaintext, exposing usernames/passwords.

995 (POP3S). Port 110 requires STARTTLS.

Eliminates the unencrypted phase, reducing MITM risks.

openssl s_client -connect mail.example.com:587 -starttls smtp

They transmit usernames, passwords, and emails in cleartext (unencrypted).

Transport Layer Security; it encrypts email communication after initially starting on a traditional port.

It started communication on the standard port, then switched to an encrypted port:

IMAP → 143 → 993

POP3 → 110 → 995

SMTP → 25 → 465

Initial communication on unencrypted ports allowed potential interception by attackers (man-in-the-middle).

A modern method of encrypting email where encryption begins immediately without an unencrypted phase.

Port 587 for SMTP (although older references may show 465).

Variance in server/client settings, backward compatibility, and inconsistent phrasing in clients like Thunderbird.

It eliminates unencrypted communication and simplifies port usage.

No; the exam focuses on server-client email setups and proper protocol configuration.

TCP 23 (unencrypted).

Transmits all data in plaintext (credentials/commands visible in Wireshark).

Encrypts all traffic (AES/3DES) and supports key-based authentication.

Server sends a public key; client verifies it before allowing login.

Wireshark (filter telnet to see plaintext).

No authentication—grants access based on IP/MAC alone (port 513).

Local device management (e.g., configuring routers in a lab).

Disable password logins (use key pairs).

Change default port (not 22) to evade bots.

Enable fail2ban to block brute-force attacks.

Both Telnet (port 23) and SSH (port 22) connections.

Clients verify the server’s public key fingerprint on first connect.

Remote command-line access to a faraway computer.

TCP port 23.

All data, including usernames and passwords, is transmitted in cleartext.

Putty

Secure Shell, an encrypted replacement for Telnet providing secure remote command-line access.

TCP port 22.

By generating an encryption key between client and server, encrypting all traffic.

In local, trusted environments, such as direct access to routers or switches.

An old remote login protocol (port 513) with no authentication, now rarely used.

NTP (Network Time Protocol) and SNTP (Simple Network Time Protocol).

UDP Port 123.

Stratum 0 (atomic clocks/GPS).

NTS (Network Time Security), which adds encryption via TLS.

PTP (Precision Time Protocol - IEEE 1588).

One-step (direct sync) & Two-step (uses transparent clocks).

Finance, Telecom, Video Streaming, Industrial Automation.

Kerberos requires synchronized clocks for authentication tickets to work.

Not precise beyond milliseconds; vulnerable to network delays/attacks.

Specialized NICs with hardware timestamping support.

Synchronize clocks across network devices to ensure consistent time.

UDP port 123.

Simple Network Time Protocol, a lightweight version of NTP.

Hierarchical levels of time accuracy:

Stratum 0: Atomic clocks/GPS

Stratum 1: Servers synced to Stratum 0

Stratum 2: Clients synced to Stratum 1

… down to Stratum 15

Adds encryption and authentication to NTP to prevent tampering and attacks.

Uses NTS Key Exchange (NTS-KE) with TLS to create secret keys and cookies for secure time queries.

Microsecond-level time synchronization for distributed networks.

One-step: Direct sync from master clock to device

Two-step: Sync via intermediate transparent clocks

Financial trading, VoIP, video streaming, industrial automation, robotics.

Automatically assigns IP addresses to devices on a network.

APIPA address – DHCP server is unreachable or scope is exhausted.

Prevents DHCP from assigning the gateway’s IP, which would break routing.

Assigns a fixed IP to a device based on its MAC address.

In public Wi-Fi networks (e.g., coffee shops) to prevent IP exhaustion.

IP Address Management – Automates IP tracking, DHCP, and reservations.

Cameras can use DHCP but need consistency; servers should have static IPs.

Limit the range (e.g., .100-.254) and reserve lower IPs for static devices.

Devices hold IPs after disconnecting, leading to scope exhaustion.

Automates IP assignments for VMs and prevents conflicts.

Assigning a specific IP address to a device to ensure it always receives the same IP.

Assigning an IP address based on a device’s MAC address, ensuring it always gets an IP even if the IP isn’t fixed.

The DHCP server may assign the gateway IP to a client, disrupting network connectivity.

Too many devices, long lease times, or insufficient IP addresses in the scope.

Long leases can prevent new devices from obtaining IPs, especially for transient users (e.g., coffee shops, Wi-Fi hotspots).

IP Address Management; automates tracking, allocation, and management of IP addresses in large networks.

Large networks, virtualized environments, or networks using both IPv4 and IPv6.