Skip to main content
Loading Explore guides…
Common Network Protocols & Port Numbers · Acedra
Home
Explore
Computer Science
Common Network Protocols & Port Numbers
Sign in to save
Chat
If YouTube asks you to sign in, open the video on YouTube.
Watch on YouTube
Reload player
Transcript
68 segments
Copy
Hide video
0:02
that you're going to have to know about and that's going to be ftp okay so just to quiz you what is the port number for ftp do you remember it well hopefully that was your answer port 21. so let's go ahead and now get some hands-on with ftp in this trace file now you're going to notice throughout this video sometimes i'm going to set a filter in wireshark for the name of the protocol and sometimes i'm going to set it for the port number itself but what's the difference
0:30
well let's actually learn this right out the gate we're going to be filtering for ftp so if i come in here and i go to display filter and i just type in ftp check out the number of packets that i have i've got 33 packets that are displayed notice what i don't have i don't have anything that says tcp here so i don't have any of the handshake i don't have any of the acknowledgements or any of the resets or anything like that i just have whatever packets actually carried
0:55
ftp data but if i want to see some of those other supporting packets especially the ones that show me the handshakes and such that's where i need to go in and i need to do tcp port equals equals 21. so now check out how many packets we have we have 101 packets so when we filter on port number we're taking a look at it from the tcp perspective including any payload if we filter from a protocol
1:21
we're only focusing in on that protocol not on the tcp overhead information that's why personally a lot of times when i'm doing analysis i'll use the port number to set the filter instead of the actual name of the protocol now something that you're going to need to know about ftp is historically ftp has used at least two ports one was a control port where it established a login and an initial connection like we see here on port 21 but then data would be exchanged on a different
1:49
port sometimes that's port 20 or a different port that's designated within the control traffic so that's fuel for another conversation but we want to remember is usually it's port 21 and then if not poor another port to actually move the data so let's go ahead and take a look at ftp and how it works so here we can see ftp is a tcp based protocol we can see the tcp handshake here syn synack and notice that ftp is clear text that's why it's kind of fun to play with we can
2:16
see here here's a user login and then the server comes back and says okay go ahead and give me that password and look at our password is clear text password you're also going to see in this trace file that there's a lot of the different request methods that we have so go ahead and explore some of those on your own might get you a little bit more hands-on with ftp now you're going to notice
2:37
at the bottom of the ftp conversation you're going to see basically what looks like a port scan and you should that's exactly what it was uh here one station was testing this other station with a lot of different sins and just seeing those resets as a part of a scan okay so but the actual protocol itself we can see here is up at the top now something you're going to notice as i'm going through this is that my time column is listed as the time of day and that's what i would
3:06
suggest for you instead of starting at zero and going through it like a stopwatch instead let's go ahead and go up to view time display format and we're just going to do time of day now why are we doing this because to create this trace file i had to merge a lot of different other pcaps together to get all of these protocols in one place for you and they came from a lot of different time periods
3:28
so to make that easier let's just use time of day and that will simplify our analysis not get all tied up with the time all right so now that we talked about ftp let's talk about the next one ssh secure shell now what is the port number for ssh do you remember well hopefully that's the one that you got all right port 22. let's go ahead and talk about port 22 as we're setting a filter for
3:52
it so let's go back to our trace file let's set up a filter for port 22 and let's see what we got here now we can see that there's a few sends we see a reset there that was also part of that scan but also below that we can see that we have a little bit of ssh conversation now there's a not a whole lot of ssh in this trace file and you're going to find that if you ever capture ssh with wireshark it's encrypted right so um and we want it to be right when we're interacting with
4:19
a network device or for ssh into a server we want to make sure that that's encrypted traffic we're going to talk about why that is in just a moment but as we can see here we establish our handshake we go to send synapk and then the server actually comes back and it just gives us a version here we're just doing a version request for it so let's come down and see what kind of ssh we're dealing
4:40
with if we open up ssh we can see this is ssh 2.0 open ssh and then debian made in boontu1 so that just gives us an idea of what type of ssh server that we're talking to now just remember about ssh that's how we're going to remote into a device to do some control and configuration okay so let's just remember that ssh poor 22. all right let's move on to the next one okay telnet that's often one that you're going to see come up on a certification exam certainly one
5:13
that we want to know if we're into networking what's the port number hopefully that's what you got port 23. now there's a reason why you don't see a whole lot of telnet anymore let's find out what that is okay let's go ahead and go up to tcp port and we're going to come back and just say port 23. so here's some telnet stuff we have in this trace file you can see i got 104 packets now telnet uses tcp as a layer 4 transport protocol so we can see that there's our handshake
5:39
and here we got telnet data telnet data now here's what's kind of fun about telnet if we take a look at our ascii characters or we take a look at the clear text view we're going to start to see that there's some data in here so if you come down to packet 338 you can start to see some clear text stuff come through in fact one way that we can analyze telnet with wireshark is just to click through and to take a look at everything one packet at a time
6:05
or what we can do is we can do a follow tcp stream so let's do that if we right click any telnet packet that's in this first part of our conversation we can come down to follow and we're going to do tcp stream basically what this does is wireshark takes the raw data out of each of these telnet packets or any whatever tcp protocol we're using it takes the payload and it assembles it in one place and then it allows us to manipulate how we view it now right now we're showing this
6:33
data as ascii characters okay so if we wanted to we could say raw so do i just want to see the actual hexadecimal values that made up this flow well that's not very useful for me i'm going to go back to ascii so here i can see all of this was sent over clear text this is really what a clear text protocol is now in this all i did was i just telnet it into a metasploitable server and my purpose here was just to get some data going that we could take a look at now notice
6:59
the login telnet echos things so we can see in red that's the client sending data to the server the blue is the server coming back to the client okay so notice that the client sends m s f a d m i n okay so msf admin and then in blue right away the server is actually echoing back every character if i send m it echoes back him if i send s it echoes back s to make this easier for me what i can do is i can come down an entire conversation if i just want to see
7:34
from the client to the server then i can just take a look at this one direction and this is where i can see msf admin all together without the echoes and then exit so here we can see the login and then the password and then just exit very simply now this is also interesting to look at if you ever telnet into a network device you can see whatever you show on your screen with telnet you can also see that within the packets as well and really due to the clear text
8:01
nature of how telnet works is really the reason why we don't use it as much anymore anymore now we're going to be using more ssh because it's going to be encrypted all right so that was telnet so let's go and get on to the next one all right smtp what's the port number for smtp
8:18
all right very good port 25. all right so there's three major mail protocols and this is one of them smtp also in a minute we're going to take a look at pop or post office protocol and we're also going to take a look at imap those are your big three okay so something that you want to remember about smtp as opposed to the other email protocols is that you're going to use smtp to send emails okay from an email client to that email server we're sending the email you retrieve it
8:46
with the other protocols that we're going to talk about in a little bit but let's get back to our port so we're going to come up here to our display filter let's go ahead and type in tcp.port equals equals 25 and that's going to show us our smtp traffic now smtp can either be encrypted or unencrypted we actually have examples of this or both of them here in this pcapp if we take a look
9:09
at the first one here we can see that we have tcp connections in sync ack so here we see that the server comes back and it's telling us its version and we can come down to smtp it shows us the type of server that it is we can come down here we see that the client is saying hello now to make this a little bit easier to read if we just right click here we can come down to follow tcp stream
9:30
all right so here with our follow tcp stream we can actually see all this data in one place just like we could with telnet now we can actually read this email now this is just a test email that was being sent out it's just something to take a look at and we can see that the email address that it's being sent to after the email is sent afterward we can see okay the message was accepted we'll go
9:51
ahead and quit and we're going to sign off we've come down here to close also in our trace file let's go ahead and back out from our stream filter we're going to come back and just do another tcp port equals equals 25 and so if you scroll down a little bit further if you come down to packet number 1407 around there we see another connection over report 25. so let's go ahead and see what happens here this time i'm just going to right click i'm just going to say instead of
10:17
follow tcp stream let's come to conversation filter tcp that's going to filter in just that one conversation this time we set up our tcp handshake we go ahead and establish ourselves with the server say hello but notice what happens the server comes back in packet number 1413 if we expand out the response we can see that the server says hey start tls client says cool start tls let's go ahead and start up a transport layer security conversation okay so this is where we see
10:45
client hello server hello and that will establish a secure connection between the client and the server now the rest of this is going to be encrypted so this time if we right click we say follow tcp stream we can see the initial smtp information after that this is what the email looks like a lot different than before we don't see that clear text ascii characters readable stuff this is actually encrypted so remember the smtp overport 25 can
11:11
either be encrypted or it's possible to use tls over port 25. so what should we look for with smtp well a couple of the port numbers that you want to keep your eyes open for is going to be 587 and 25 25. there are some other ones but those are going to be the big ones now that is going to be secure smtp and that's going to be non-clear text readable on the wire with wireshark all right so
11:35
let's go on to our next protocol how about this one dns okay so what's the port number for dns
11:44
53 there we go now this is going to be a little bit of a shift for us let's see why let's go ahead and go to our trace file and let's pop in port 53. now here i can see i have some scan traffic we went ahead and tried to establish a connection over port 53 but notice that i don't have any dns information here this is all just tcp handshake info that's one reason why i like to have tcp segment length on my wireshark profile because then i can see whether there's a payload that's
12:11
actually being carried by this frame in this case this is all just headers it's all overhead right so syn synack reset those kinds of things but no actual data well what's wrong here well first of all dns while it can support tcp the majority of the time you're going to be running dns over udp okay so let's go ahead and change this from tcp port 53 let's go ahead and back this up instead
12:37
we're going to do udp all right port 53 and here we have one dns call now notice when wireshark recognizes dns when it actually sees that payload there it's able to go oh this isn't just udp this is dns this is great so when it sees that actual application using it that's why instead of seeing udp here we're actually going to see the application itself and that's going to be dns all right so here we can see a request for dns go 34 milliseconds later we see a dns response so
13:07
dns there's a lot of different ways we can use it but if you just keep it very simple it's the phone book of the internet when you go out to a web browser and you type in a name dns is resolving that name to an ip address that you can then go connect to but how do we find out about dns how do we know what our dns server is well that brings us to our next protocol that we want to make sure we
13:27
know and that is dhcp dynamic host configuration protocol all right so what port or ports does it use well in this case we actually have to know about two of them okay so just remember this 67
13:43
what's the other one 68. all right basically one's a client one's a server and let's take a look at that in wireshark so this time in wireshark instead of denoting a port number what i'm going to do is i'm going to come back here i'm just going to say dhcp all right so here we have the four packets that make up a dhcp conversation and this is when we first come on to the network we don't know who we are yet we don't yet have an ip address we don't know who our dns
14:11
server is we don't have our gateway or what our sudden it is we're just coming up we're waking up and we're just joining this network and we need some help right all we know is our mac address so with dhcp we're able to find first of all that's why it says discover that's the first packet there we're able to find who out there is offering dhcp that dhcp server responds and says oh you're new here you want an address so here you go dynamic host configuration protocol
14:37
that's what we're using notice for a second the port numbers if you take a look at udp so the server is going to be using 67 port 67 the client usually uses port 68. okay and again that's udp 67 and 68. now wireshark recognizes that so we can go a little deeper into dhcp without going too far for the purposes of this video but here we have the client address that was sent in the discover and now the server is coming back and saying oh great okay here's an address
15:04
for you here's a subnet mask here's a lease time here's dhcp and usually in many cases you also get a dns in there as well and in some cases you'll even get more instructions if you're a phone of who to download your configuration from and so on all right so four packets discover offer request acknowledge that's the flow for dhcp it's udp based and there's two ports what are those again
15:28
67 and 68. next let's just keep on going in the 60s right we had 67 68 let's go and go to port 69 and that is what's the name let's do it reverse here okay we know the 469 what's the name
15:43
tftp good job if you got that all right so port 69 tftp okay so let's take that closer look at tftp trivial file transfer protocol let's get into wireshark now if we go to the beginning of our conversation here at the beginning of this trace file here we can see we have a read request so basically this protocol is used for moving files but unlike ftp it just does it in a more simple way okay so there's a lot going on here but let's just go ahead and keep this simple
16:12
right here the client is just saying hey give me this file rfc1350.txt now notice that this is over udp right so this is a udp exchange this isn't over tcp that's why we don't have a three-way handshake that's why we don't have to set up this connection or conversation really this is just best effort go get that file and let's see what happens so first we ask for that file and notice right after this at least in this conversation
16:42
we're no longer using port number 69 here now we're using these higher numbered ports and we can see that this is data actually starting to come across and wireshark is recognizing it as tftp now like its cousin ftp tftp as well can have a control port or a control conversation and that's what we see in port 69 and then it can actually move the data over a different port between client and server okay next very popular one one you're definitely going to be
17:09
tested on or need to know and that is http okay so let's talk about this what port number is http
17:18
okay good job hopefully that's one that you got port 80. let's go ahead and peek at what we have in the pcap so we're just going to do tcp this time flipping back to tcp for a little bit tcp port equals equals 80. and here we got some http stuff now this is a fun protocol to take a look on the wire because http is still going to be clear text we can still read what's actually happening
17:43
we can see the gets we can see the responses and what i'd like you to do is come down here if you take a look at the get that you see let's go and jump over that scan traffic up there we're going to take a look at that first get hopefully you see it within a few packets you're going to right click it you're going to go to conversation filter tcp okay so here we can see we have a cincinnati and then we can see a retransmission and so on what i'd like you to do instead of
18:07
worrying about too much about that tcp setup what we're going to do is come down here just to get and we can see that we're just asking a question of that server hey get http 1.0 get slash give me your root page all right and we can see that in clear text down below now the server acknowledges and then right away it comes back with ok so this is where we can see some more clear text stuff
18:31
so this is telling us the type of server that's running oh and we have one of those interesting pictures that we can see on the command line let's go and investigate this and see what kind of server it was if we right click and go to follow tcp stream what we're going to see here is again that metasploitable 2 so what type of server is it running uh here we can see that it's running apache 2.2.8 and powered by php and so on now that banner that we just grabbed and we can see that
18:58
clear text from the wire itself so http hypertext transfer protocol that's used for moving that web data for getting web pages and even for sending and receiving files but anymore you're not going to see as much port 80 especially going out to the web because it's not secure we can see the data right there on the wire all right our next protocol now let's shift this up a bit i'm going to give you a port number and you tell me the protocol itself so here's the port number 110
19:25
what do we got pop post office protocol now pop has gone through a lot of versions and iterations now back in the 1980s is when the rfcs came out for the post office protocol and it started with pop one pop two and now really if we see it anymore it's gonna be pop three so pop three is over port 110 but let's go ahead and check it out on the wire okay so i'm going to come in here now pop3 is going to be moving important data around right it's an email based protocol post
19:54
office protocol so let's go ahead and take a look at tcp we're going to do port and let's check out port 110 so here i can see pop3 the client is going out and establishing a connection and we can see the response come back from that server and we see dovecot ready and so on there's several things that we can see here in clear text that's interesting to note let's go ahead and take a closer look let's right-click we're going to go to follow tcp stream and here is where we can see
20:25
some of the login and authentication information if we come down here we can actually see some of the message information this is actually an email that we can see here in clear text uh oh right so we can see that pop3 over port 110 is not going to be secure we can see it in clear text so what has the industry done about this well remember this one as well when you think pop3 also remember port
20:53
995. now 995 is going to use like we see here at the bottom of our screen here we can actually see it just spelled out for us pop3 over port 995 is actually going to use tls transport layer security so that's going to be encrypted so pop3 unencrypted port 110 pop3 encrypted is going to be 995. now while we're here let's go ahead and talk about another email protocol imap all right and you can see it here in our follow tcp stream what are the port numbers for imap well
21:28
if we're not going to be using it securely then that's going to be port 143 however anymore if we do see it it's going to be over port 993 that's going to be the secure tls version of imap okay so one other protocol that might show up on your test and that is
21:47
what is this network time protocol ntp now the port number
21:54
easy as counting to one two three port 123. let's see it in action now wireshark can recognize ntp as an application so let's go ahead and pop that in uh ntp if we come down here we can see this is over udp and in both directions we have port 123. now what's the point of ntp well it's a mechanism for devices to be able to check in with an authority to be able to accurately set their time and that's for synchronization we want to make sure that everybody is on the same
22:23
page when it comes to timing and that's what ntp is used for so remember that udp port 123. all right keeping with udp let's go ahead and take a look at one more this time i'm going to show you the port number okay udp 161. what's the application or what's the protocol that uses it
22:42
snmp so especially in the networking world we want to make sure that we understand this one so let's take a look at it now i just said that's udp based so let's go ahead and let's just do it from a port perspective udp port equals equals one six one all right okay snmp simple network management protocol all right this is a get response get response type protocol but what does it do well just like the name implies it allows us to simply get management information
23:11
off of our network or infrastructure so instead of logging into a switch and saying hey how many errors are on port 2. that's something that an snmp tool can do it can query the network and ask snmp questions and get responses back so we can have all of that in a central location really it just allows us to monitor the network from a central point now there's other ways that we can use snmp but that's the big one okay let's go to the next protocol how about this one
23:39
ldap lightweight directory access protocol what's the port number good job 3.89 that's what we're going to use so let's go ahead and take a look at it in wireshark okay simply what does ldap do it's authentication and directory services it's a way of accessing information and authenticating to the system now it's open it's vendor neutral it can be used in a lot of different environments but let's go ahead and take a look at it on that port 389. all right i went ahead and set the
24:09
filter for ldap or for port tcp port 389 and we can see that it's tcp based so just to keep this at a high level without app we're just doing our buying request here's just a simple login great success wonderful come on in let's go ahead and look lurk around see what you want to get and here we're taking a look at the whole subtree and then we go ahead and shut down our connection so a simple ldap check-in and that's what we're doing here in this p-cap so really we're just
24:34
knocking on the door here we're not doing a whole lot with ldap there's a whole lot that we could say about it but just remember that lightweight directory access protocol okay another one another protocol you're absolutely going to be tested on and that is https what's the port number tcp
24:50
443 all right good now just so you remember as well it's also possible that we could have udp 443 now that's going to be http 3 over quick now if you're watching this on a chrome browser or even firefox and your network is allowing it the firewalls are allowing it through it's possible you're even watching this video over udp443 okay so what's it look like on the wire let's take a look let's go ahead and go into our display filter this time we're going to type in tcp.port
25:20
equals equals four four three okay so we can see here that we have uh cincinnati and so on so let's come down here to this conversation now we're just coming down to the client hello and notice here if you take a look at that client hello down here i'm just gonna right click and i'm going to say conversation filter tcp just to focus in on that one conversation right away the nice thing at least at this point in time if i go to the client hello in tls i can come down and i
25:47
can see clear text wireshark that's about the only cleartext stuff that you're going to get though just at the very beginning what the client is just saying to the server hey i want to talk to the wireshark server on you that way a server can host multiple different sites i want to talk to the wireshark one and then that server can come back with a server hello now everything after this is going to be encrypted especially if we're using tls 1.2 or 1.3 and of course quick which
26:13
is over udp now more information about how those protocols work on other videos but our point here http secure web is going to be over tcp 443 or when it's using quick it's going to be udp 443 all right one last protocol we're going to talk about smb what's the port number
26:33
445 okay nice job now what does smb do server message block it's basically moving files okay especially in a windows environment if we're connecting to a shared drive on a network and we're uploading and downloading files a lot of times that's going to be over port 445 smb so let's see how it looks if we come in here i'm just going to remove this filter just going to do tcp dot port equals equals 445. all right so we have some smb stuff let's go and
27:01
take a look at this first conversation let's right click just going to go to conversation filter tcp just take a look at this very first one now smb has a lot of versions okay so here we're just tinkering around with uh smb version two what version are you running on your network all right so really we log into a system we manipulate files and then we're able to download or upload files to
27:23
another system on our network that's the point of smb so if you're going into network engineering or you're studying for a cyber security certification or any network certification for that matter these are the common protocols that you're gonna have to remember hopefully you found this more useful than just going through a bunch of flash cards you can go ahead and take this video watch it
27:41
through a few times and hopefully it helps you to remember those common protocols and port numbers that you're gonna need to know thanks for sticking around with me and i'll see you on another video
Here to help you learn
Sign in to keep a private conversation with your course tutor.
Ask me anything about the material…
Sign in to chat