Ops 301: Class 02

This topic matters as it relates to what I'm studying in this module because we are studying networks and how to use Wireshark.

To begin, a port is a virtual location where networking communication starts and ends (in a nutshell).

A port scanner sends a connection request to check its current status.

The three different types of responses that a port scanner can get when sending that connection request are:

* Open, Accepted: The computer responds and asks if there is anything it can do for you.

* Closed, Not Listening: The computer responds that “This port is currently in use and unavailable at this time.”

* Filtered, Dropped, Blocked: The computer doesn’t even bother to respond.

The difference between TCP (Transmission Control Panel) and UDP (User Datagram Protocol) is that TCP is a nice orderly transaction protocol: TCP sends each packet in order, complete with error checking, verification, and a 3-way handshake to confirm each packet is successful. UDP doesn’t have any error checking but tends to be faster. Live streaming and online video games often use UDP for this reason. UDP is a connectionless protocol, so programs that use UDP just send the data – and if you miss a packet, you will never get it again.

Telnet is used for remote access to network devices and it communicates over TCP port 23.

SSH (Secure Shell) is a secure protocol and it communicates over TCP port 22.

DNS (Domain Name System) communication is commonly used to convert the name that you’re typing in to the IP address of the service. For example, the web server www.professormesser.com might have this IP address associated with it.

SMTP (Simple Mail Transfer Protocol) is server-to-server communication and it's one of the most common ways to send email messages over the internet. If you’re communicating in the clear– or what we call plaintext– using SMTP, then you’re probably using TCP port 25.

HTTP (Hypertext Transfer Protocol) is a protocol used for accessing web pages and uses port 80 for communication.

HTTPS (Hypertext Transfer Protocol Secure) is a secure version of HTTP used for accessing web pages and uses port 443 for communication. This encrypted communication historically used SSL, or Secure Sockets Layer, although newer web servers will use a newer version of SSL called TLS, or Transport Layer Security.

RDP (Remote Desktop Protocol) provides that shared desktop view used for remote access to Windows computers, and it commonly communicates using TCP port 3389.

Ping is a tool used for testing network connectivity between two devices. It does not use a specific port as it is based on the Internet Control Message Protocol (ICMP), which is an Internet Layer protocol in the TCP/IP protocol suite. However, some firewalls may block ICMP packets, preventing the use of Ping.

Things I want to know more about consist of the port scanner and what to do when I get a response that I was not looking for.

References

Buckbee, M. (2020, November 23). What is a Port Scanner and How Does it Work?. Varonis. Inside Out Security

Common Ports – N10-008 CompTIA Network+ : 1.5. Professor Messer. Retrieved March 13, 2023 from Common Ports