In my last post, I discussed different devices that move your piece of information (“packets”) around your network, and also out to OTHER networks on the internet. In this post, I’ll look at a few different TYPEs of packets and what they do. Additionally, some protocols use custom “Ports” – not a physical port like a plug, but a software-defined port which is added as a “tag” to the network traffic to help the network devices understand what it is & where it’s going.
Ping
Ping is great for troubleshooting connection issues (which will be discussed more in a later post). Ping sends a packet out to an IP address that’s designated in the command and reports how long it takes to get a response, OR the error that arises if no response is given. There’s also the helpful -a flag which will try to resolve the Hostname for the IP via DNS (see below).
Tracert
Tracert is great for 1) determining how the traffic is flowing from your PC to the remote IP and 2) see where the connection is “breaking down” if it’s not resolving. It’s a pretty brilliant piece of software under the hood – basically, it increments the number of allowed “hops” (moves from one IP to another) and builds the chain that way. So first it tries to go to your destination IP but only allows 1 hop – so it’ll stop at the next IP in the chain (either your switch or router, probably), which then will report that there’s no more allowed hops and will give its name/IP. Then, tracert increments the allowed hops to ‘2’ so it will get to the next device IP, which will report on itself. It does this until it finally gets to its destination, and then reports the full list of IPs & hostnames. OR, if it fails to reach, you can see WHERE the failure occurred – somewhere AFTER the last successful IP/device.
SSL/TLS
Secure Sockets Layer and Transport Layer Security are cryptographic protocols for increasing security of network traffic. While the encryption methods & authentication systems are outside the scope of this post, they use a series of secret keys to encrypt & decrypt the data at each end of the traffic. Many older protocols will have a version with “S” appended to the end, indicating that it’s the Secure version.
SMTP/SMTPS
This is an actual data protocol, versus a troubleshooting one. In our setting, Simple Mail Transfer Protocol is used by 1) email servers delivering & receiving email to each other and 2) hacked computers sending spam. So on our firewalls, we ALLOW a local email server to send SMTP traffic, but BLOCK anything else from doing so.
A variant of SMTP is SMTPS (the S is for Secure) which is more secure as it uses TLS (Transport Layer Security) to authenticate the servers to each other to prevent security leaks. SMTP uses port 25, while SMTPS uses port 465. Some common email providers use alternate ports for SMTPS.
HTTP/HTTPS
This is your “web browsing” traffic – hence all webpages start with “HTTP(s)://). Hyper Text Transfer Protocol allows you to click on webpages and go to other webpages, or download something, etc. HTTP uses ports 80, while HTTPS (secure) uses 443.
FTP
File Transfer Protocol is used for transferring files from one system to another. It uses ports 20 & 21, based on what exactly is being done in the protocol (setting up the connection, reading files, or writing/sending them).
SSH
Secure SHell is used to remotely connect to other systems via a command line. It uses port 22. It’s helpful for remotely managing and working on other systems without having to setup a full Graphical User Interface. It can also be used to transfer files (SCP, SFTP).
DNS
Domain Name System is used to resolve IP address (like 64.233.177.138) to a Hostname (in this case, “google.com”). Computers only know numbers, while Humans prefer names. DNS is the “glue” to convert one to the other. It uses port 53.
DHCP
Dynamic Host Configuration Protocol, usually on ports 67 & 68, is used to determine what IP address a new device on the network will have assigned. A dedicated DHCP server is responsible for assigning the minimum information required to devices that ask. Generally, that’s
- The IP address (what’s my local address on this network),
- The subnet mask, used to determine how large the local network is so a device knows if an IP is nearby OR if it needs to send the traffic to
- The IP of the Default Gateway, which is a routing device that will handle traffic needing to leave the local network.
The local PC will get its IP address, and then use the Subnet Mask to calculate what OTHER IPs will be on its local network. That way, if it needs to communicate with something directly, it’ll do so. Otherwise, it’ll know the IP address of the Default Gateway and will send the network traffic to THAT IP and allow the Gateway to handle moving it to its correct destination. Every device on the way will use this same structure to get the packet to where it needs to go.
This is already longer than I had intended, but this hopefully addresses the more commonly encountered ports & protocols.
Recent Comments