RANGER GAMEZ

CompTIA Network+ (N10-009) · chapter 4 of 29

Week 1: Doors, numbers and who is listening

In this chapter Objectives 1.4

  1. Common ports and protocols
  2. IP protocol types
  3. Traffic types
  4. Practice questions
  5. Chapter recap

Objective 1.4

Common ports and protocols

Ports 101

A port is a 16-bit number (0-65535) that identifies a service on a host. Well-known ports are 0-1023, registered 1024-49151, and dynamic/ephemeral 49152-65535 (the random source port your PC picks). A server listens on a well-known destination port; the client uses an ephemeral source port. Each service also runs over TCP, UDP or both.

Exam tip A socket = IP address + protocol + port, e.g. 10.50.1.10 TCP 443. Firewall rules match on these.

Moving files and managing devices

File transfer and remote access ports. Telnet and FTP send everything, passwords included, in clear text; replace them with SSH and SFTP.

FTP     20/21 TCP  20 data, 21 control
SFTP    22    TCP  file transfer in SSH
SSH     22    TCP  encrypted remote CLI
Telnet  23    TCP  clear-text remote CLI
TFTP    69    UDP  no login (configs)
SMB     445   TCP  Windows file/print
RDP     3389  TCP  Remote Desktop

Exam tip SFTP shares port 22 with SSH because it runs inside SSH. Trap: FTPS (FTP over TLS) is a different protocol.

The infrastructure services

These keep the network itself running. DNS uses UDP 53 for most lookups and TCP 53 for zone transfers and large replies. DHCP servers listen on 67 and clients on 68.

DNS     53      UDP/TCP names to IPs
DHCP    67/68   UDP     67 srv, 68 client
NTP     123     UDP     time sync
SNMP    161/162 UDP     161 poll, 162 trap
Syslog  514     UDP     logs to collector
LDAP    389     TCP     directory, clear
LDAPS   636     TCP     LDAP over TLS

Exam tip SNMP: the manager polls agents on 161; agents send unsolicited traps to the manager on 162. Use SNMPv3 for authentication and encryption.

Web, email, databases and voice

The services users actually feel. SMTP sends mail between servers on 25; mail clients submit mail securely on 587. N10-009 lists 587 as SMTPS (secure submission with STARTTLS).

HTTP   80        TCP      web, clear text
HTTPS  443       TCP      web over TLS
SMTP   25        TCP      server to server
SMTPS  587       TCP      secure submission
SQL    1433      TCP      MS SQL Server
SIP    5060/5061 TCP/UDP  VoIP; 5061=TLS

Exam tip SIP only sets up and tears down the call. The voice itself rides RTP on high UDP ports, so a "rings but no audio" call is usually RTP being blocked.

Objective 1.4

IP protocol types

TCP vs UDP vs ICMP

Inside the IP header a protocol number says what is carried. TCP (6): connection-oriented, reliable, ordered, uses a three-way handshake. UDP (17): connectionless, no acknowledgments, low overhead; DNS queries, DHCP, TFTP, SNMP, syslog, VoIP. ICMP (1): no ports at all; used by the network to report errors and test reachability (ping = echo request/reply, "destination unreachable", "time exceeded").

Sequence diagram between a client and a server. First the client sends SYN, the server answers SYN-ACK, and the client sends ACK: the three-way handshake. Then data flows and each segment is acknowledged. A note says UDP skips all of this: it just sends, with no handshake and no acknowledgments.
TCP opens every connection with SYN, SYN-ACK, ACK. UDP just sends.

Exam tip Trap: ICMP has no port numbers. "Block ping" = block ICMP echo, not a port.

GRE: the generic tunnel

GRE (Generic Routing Encapsulation, IP protocol 47) wraps one packet inside another to create a point-to-point tunnel between two routers. It can carry multicast and routing protocol traffic, which plain IPsec tunnels cannot. GRE has no encryption, so it is often run inside IPsec (GRE over IPsec) when it crosses the internet.

Exam tip GRE = tunnel without security. IPsec = security. Together: a tunnel that can carry routing protocols AND is encrypted.

IPsec: AH, ESP and IKE

IPsec secures IP packets, usually for site-to-site VPNs. IKE (Internet Key Exchange, UDP 500) authenticates the peers and negotiates keys, building the security associations. AH (Authentication Header, protocol 51) gives integrity and authentication but no encryption. ESP (Encapsulating Security Payload, protocol 50) gives encryption plus integrity, so almost every VPN uses ESP. Modes: tunnel (whole packet wrapped, site-to-site) and transport (payload only, host-to-host).

Exam tip AH = Authentication only. ESP = Encrypts. IKE = keys. NAT breaks AH; ESP works through NAT using NAT-T on UDP 4500.

Objective 1.4

Traffic types

Unicast, broadcast, multicast, anycast

Who receives the packet?

  • Unicast: one sender to one receiver. Most traffic: web, SSH, file copies.
  • Broadcast: one to ALL hosts on the local network (IPv4 only), e.g. ARP requests, DHCP Discover. Routers do not forward it.
  • Multicast: one to a group that joined (224.0.0.0/4 in IPv4, ff00::/8 in IPv6). Video streams, routing protocols like OSPF.
  • Anycast: one address configured in many places; routing delivers to the nearest one. Public DNS resolvers, CDNs.
Four small diagrams of who receives a packet. Unicast: one sender to one receiver. Broadcast: one sender to every host on the local network; routers do not forward it, and IPv6 has none. Multicast: one sender to only the hosts that joined a group. Anycast: several servers share one address and routing delivers to the nearest one.
Unicast one, broadcast all, multicast a group, anycast the nearest.

Exam tip IPv6 has no broadcast at all. It uses multicast (and anycast) instead. "Nearest of several servers sharing one IP" = anycast.

Check yourself 1A network admin must replace a clear-text protocol used to configure switches remotely. Which protocol and port should be allowed instead?

  1. Telnet on TCP 23
  2. SNMP on UDP 161
  3. SSH on TCP 22
  4. RDP on TCP 3389
Show the answer

Answer: C. SSH on TCP 22

SSH (TCP 22) gives an encrypted command line and is the standard replacement for Telnet. SNMP monitors devices; RDP is for Windows desktops.

Check yourself 2Which IPsec component encrypts the payload of each packet?

  1. IKE
  2. ESP
  3. AH
  4. GRE
Show the answer

Answer: B. ESP

ESP (protocol 50) provides confidentiality (encryption) plus integrity. AH gives integrity and authentication only, and IKE just negotiates keys.

Practice questions

Answer in your head, then open the answer. Ranger's Packet Trail has 483 questions like these for Network+, with mock exams.

Question 1An administrator needs encrypted command-line access to manage a remote switch. Which port must be open on the switch's management interface?

  1. 23
  2. 161
  3. 22
  4. 3389
Show the answer

Answer: C. 22

SSH uses TCP 22 and encrypts the remote session. Telnet on port 23 sends everything, including passwords, in clear text.

Question 2After a firewall change, no clients can resolve hostnames, but they can still reach servers by IP. Which port should the firewall team check first?

  1. 123
  2. 67
  3. 389
  4. 53
Show the answer

Answer: D. 53

DNS uses port 53 for name resolution queries. Port 67 is DHCP, which hands out addresses rather than resolving names.

Question 3Clients on a new VLAN get APIPA addresses. A DHCP relay forwards their requests across a firewall to the DHCP server. Which ports must the firewall allow for address assignment to work?

  1. UDP 161 and 162
  2. UDP 53 and 123
  3. TCP 20 and 21
  4. UDP 67 and 68
Show the answer

Answer: D. UDP 67 and 68

DHCP uses UDP 67 for the server and UDP 68 for the client. Ports 53 and 123 are DNS and NTP.

Question 4After a perimeter firewall was replaced, branch users can browse the web but can no longer map drives to the Windows file server at headquarters. Which port is MOST likely blocked?

  1. 445
  2. 636
  3. 1433
  4. 389
Show the answer

Answer: A. 445

Windows file sharing uses SMB on TCP 445. Port 389 is LDAP, which handles directory lookups rather than file shares.

Question 5A web application reads user accounts from the company directory. Security requires the directory queries to be encrypted with TLS. Which port should the application connect to?

  1. 587
  2. 445
  3. 389
  4. 636
Show the answer

Answer: D. 636

LDAPS (LDAP over SSL/TLS) uses port 636. Port 389 is standard, unencrypted LDAP.

Practice it in Ranger's Packet TrailThe same lessons as a story, with drills, hands-on labs and mock exams. Free, in your browser.
Play free

CompTIA, A+, Network+, Security+ and Linux+ are trademarks of CompTIA, Inc. Ranger Gamez is not affiliated with or endorsed by CompTIA. The practice questions are written to the published exam objectives; they are not real exam questions.