Basic Network Protocols
ICMP
The Internet Control Message Protocol reports network errors and supports diagnostics. ping uses
ICMP Echo messages to test whether a host responds and to measure round-trip time. traceroute uses
changing IP TTL values and the resulting ICMP replies to discover the path to a host.
ICMP is not a transport protocol for application data. A firewall or host can block ICMP while the host's other services remain reachable.
DNS
The Domain Name System maps names to data such as IP addresses. It normally uses UDP port 53, but TCP port 53 is also used for larger responses, zone transfers, and some retry cases.
Common records include:
- A - maps a name to an IPv4 address.
- AAAA - maps a name to an IPv6 address.
- CNAME - makes one name an alias for another name.
- MX - identifies mail servers for a domain.
dig performs detailed DNS lookups. whois queries registration information and is separate from
the DNS lookup process.
POP3 and IMAP
POP3 downloads mail, traditionally making it suitable for a single-device workflow. It has limited support for keeping mailbox state synchronised across devices.
IMAP keeps messages and state such as \Seen and \Flagged on the server. Multiple clients can
therefore see the same folders and message state. The tradeoff is that the server stores more of the
mailbox.
SMB
Server Message Block is a client-server protocol for sharing files, printers, and other resources on a network. A client connects to a server and exchanges request/response messages to access a share. Modern SMB normally runs directly over TCP, commonly on port 445.
FTP
File Transfer Protocol uses separate connections for control messages and file data. The control connection normally uses TCP port 21.
In active mode, the server opens the data connection back to a client-selected port. In passive mode, the server opens a listening port and the client connects to it. Passive mode is usually easier to use through client-side firewalls and NAT because the client initiates both connections.
FTP does not encrypt credentials or file contents. SFTP is a separate file-transfer protocol that runs over SSH; FTPS is FTP protected with TLS.
Common ports
| Protocol | Transport | Port | Purpose |
|---|---|---|---|
| Telnet | TCP | 23 | — |
| DNS | UDP/TCP | 53 | Queries / responses |
| HTTP | TCP | 80 | Web traffic |
| HTTPS | TCP | 443 | Encrypted web traffic |
| FTP | TCP | 21 | Control connection |
| FTP (active) | TCP | 20 | Data connection |
| FTP (passive) | TCP | high port | Data connection |
| SMTP | TCP | 25 | Mail transfer |
| POP3 | TCP | 110 | Mail retrieval |
| IMAP | TCP | 143 | Mail retrieval |
Ports identify application endpoints at the transport layer. The OS uses them to determine which socket/process should receive the data. The port number alone does not indicate or care which application protocol or service is actually running there.