aex.red

TCP-IP & Protocols

TCP/IP & Core Protocols

The TCP/IP Model

Layer 4 — Application   HTTP, HTTPS, DNS, SMTP, FTP, SSH, RDP
Layer 3 — Transport     TCP, UDP
Layer 2 — Internet      IP, ICMP, ARP
Layer 1 — Network       Ethernet, Wi-Fi (physical + data link)

IP Addressing

IPv4:

  • 32-bit address, dotted-decimal notation: 192.168.1.1
  • Private ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
  • Loopback: 127.0.0.0/8
  • Link-local: 169.254.0.0/16

CIDR notation:

/24 = 255.255.255.0  = 256 addresses (254 usable)
/25 = 255.255.255.128 = 128 addresses (126 usable)
/16 = 255.255.0.0    = 65536 addresses
/8  = 255.0.0.0      = 16,777,216 addresses

IPv6:

  • 128-bit, hex colon notation: 2001:0db8:85a3::8a2e:0370:7334
  • ::1 = loopback, fe80::/10 = link-local, fc00::/7 = unique local

TCP

Connection-oriented, reliable, ordered delivery.

Three-way handshake:

Client → Server: SYN
Server → Client: SYN-ACK
Client → Server: ACK

Four-way teardown:

FIN → FIN-ACK → FIN → FIN-ACK

TCP flags:

FlagMeaning
SYNSynchronise (start connection)
ACKAcknowledge
FINFinish (close connection)
RSTReset (abrupt close)
PSHPush data immediately
URGUrgent data

UDP

Connectionless, unreliable, no ordering guarantee. Lower overhead — used where speed > reliability (DNS, DHCP, VoIP, gaming).

ICMP

Control messages: ping (echo request/reply), traceroute, unreachable notifications.

ping 192.168.1.1
ping -c 4 192.168.1.1   # 4 packets only (Linux)
 
traceroute 8.8.8.8      # Linux (uses UDP by default)
tracert 8.8.8.8         # Windows (uses ICMP)
 
# ICMP-based traceroute (Linux)
traceroute -I 8.8.8.8

ARP

Resolves IP → MAC at layer 2. Operates only within a broadcast domain (subnet).

arp -a                  # View ARP table (Windows/Linux)
arp-scan --localnet     # Discover local hosts

ARP spoofing: An attacker can poison ARP caches to redirect traffic (MitM).

Common Ports Quick Reference

PortProtocolService
21TCPFTP
22TCPSSH
23TCPTelnet
25TCPSMTP
53TCP/UDPDNS
67/68UDPDHCP
80TCPHTTP
88TCP/UDPKerberos
110TCPPOP3
111TCP/UDPRPC/portmapper
135TCPMicrosoft RPC
137-139TCP/UDPNetBIOS
143TCPIMAP
161/162UDPSNMP
389TCP/UDPLDAP
443TCPHTTPS
445TCPSMB
464TCP/UDPKerberos (kpasswd)
465/587TCPSMTP over TLS
500UDPIKE (IPSec)
514UDPSyslog
587TCPSMTP submission
636TCPLDAPS
993TCPIMAPS
995TCPPOP3S
1433TCPMicrosoft SQL Server
1723TCPPPTP VPN
3306TCPMySQL
3389TCPRDP
5432TCPPostgreSQL
5900TCPVNC
5985/5986TCPWinRM (HTTP/HTTPS)
6379TCPRedis
8080/8443TCPHTTP/HTTPS alt
8888TCPJupyter / misc
9200TCPElasticsearch
27017TCPMongoDB

See Also

Graph View

Backlinks