Networking Core Protocols

DNS: Remembering Addresses

The Domain Name System (DNS) connects domain names (like example.com) to IP addresses, so users don't have to remember numbers.

Layer: In the OSI model, DNS operates at Layer 7 (Application Layer).

Ports: UDP port 53 is used by default, while TCP 53 is a backup port.

Important Types of DNS Records:
Example.com → 172.17.2.172 is an example of a record that links a domain to an IPv4 address.

An IPv6 address is linked to a domain using a AAAA record.

A CNAME record links one domain to another (alias).

MX Record: Shows the mail server where emails are processed.

Use tools like nslookup from the terminal to find DNS information, such as an IP address.

WHOIS

  • WHOIS is a service that lets you look up details about registered domain names.

  • It provides public info such as:

    • Registrant's name, email, phone number, and address

    • Domain’s creation date, last updated date, and expiration date

  • Privacy note: If you don't want your personal info visible, you can use privacy protection services offered by registrars to hide your details.

  • You can use the whois command-line tool on Linux or visit online WHOIS lookup services.

HTTP(S): Accessing the Web

HTTP (Hypertext Transfer Protocol) is the basic protocol your browser uses to connect to websites and load pages.

  • It defines how messages are formatted and transmitted between a client (your browser) and a server (the website).

  • It's not secure, so data is sent in plain text—anyone intercepting it can read it.

HTTPS (HTTP Secure) is the secure version of HTTP.

  • It uses encryption (via SSL/TLS) to protect your data from being seen by others.

  • When you see a 🔒 lock icon in the browser, you're using HTTPS.

Common Commands:

  • GET – Get data (like a web page).

  • POST – Send data (like a form).

  • PUT – Add or update something.

  • DELETE – Remove something.

FTP: Transferring Files

File Transfer Protocol (FTP) is designed to transfer files. As a result, FTP is very efficient for file transfer, and when all conditions are equal, it can achieve higher speeds than HTTP.

Example commands defined by the FTP protocol are:

  • USER is used to input the username

  • PASS is used to enter the password

  • RETR (retrieve) is used to download a file from the FTP server to the client.

  • STOR (store) is used to upload a file from the client to the FTP server.

  • Issuing ls returned a list of files available for download

  • type ascii switched to ASCII mode as this is a text file

  • get coffee.txt allowed us to retrieve the file we want

FTP server listens on TCP port 21 by default; data transfer is conducted via another connection from the client to the server.

SMTP: Sending Email

As with browsing the web and downloading files, sending email needs its own protocol. Simple Mail Transfer Protocol (SMTP) defines how a mail client talks with a mail server and how a mail server talks with another.

The analogy for the SMTP protocol is when you go to the local post office to send a package. You greet the employee, tell them where you want to send your package, and provide the sender’s information before handing them the package. Depending on the country you are in, you might be asked to show your identity card. This process is not very different from an SMTP session.

Let’s present some of the commands used by your mail client when it transfers an email to an SMTP server:

  • HELO or EHLO initiates an SMTP session

  • MAIL FROM specifies the sender’s email address

  • RCPT TO specifies the recipient’s email address

  • DATA indicates that the client will begin sending the content of the email message

  • . is sent on a line by itself to indicate the end of the email message

The terminal below shows an example of an email sent via telnet. The SMTP server listens on TCP port 25 by default.

POP3: Receiving Email

You’ve received an email and want to download it to your local mail client. The Post Office Protocol version 3 (POP3) is designed to allow the client to communicate with a mail server and retrieve email messages.

Without going into in-depth technical details, an email client sends its messages by relying on SMTP and retrieves them using POP3. SMTP is similar to handing your envelope or package to the post office, and POP3 is similar to checking your local mailbox for new letters or packages.

Some common POP3 commands are:

  • USER <username> identifies the user

  • PASS <password> provides the user’s password

  • STAT requests the number of messages and total size

  • LIST lists all messages and their sizes

  • RETR <message_number> retrieves the specified message

  • DELE <message_number> marks a message for deletion

  • QUIT ends the POP3 session applying changes, such as deletions

In the terminal below, we can see a POP3 session over telnet. Since the POP3 server listens on TCP port 110 by default, the command to connect to the TELNET port is telnet 10.10.95.249 110. The exchange below retrieves the email message sent in the previous task.

IMAP: Synchronizing Email

POP3 is enough when working from one device, e.g., your favourite email client on your desktop computer. However, what if you want to check your email from your office desktop computer and from your laptop or smartphone? In this scenario, you need a protocol that allows synchronization of messages instead of deleting a message after retrieving it. One solution to maintaining a synchronized mailbox across multiple devices is Internet Message Access Protocol (IMAP).

IMAP allows synchronizing read, moved, and deleted messages. IMAP is quite convenient when you check your email via multiple clients. Unlike POP3, which tends to minimize server storage as email is downloaded and deleted from the remote server, IMAP tends to use more storage as email is kept on the server and synchronized across the email clients.

The IMAP protocol commands are more complicated than the POP3 protocol commands. We list a few examples below:

  • LOGIN <username> <password> authenticates the user

  • SELECT <mailbox> selects the mailbox folder to work with

  • FETCH <mail_number> <data_item_name> Example fetch 3 body[] to fetch message number 3, header and body.

  • MOVE <sequence_set> <mailbox> moves the specified messages to another mailbox

  • COPY <sequence_set> <data_item_name> copies the specified messages to another mailbox

  • LOGOUT logs out

Knowing that the IMAP server listens on TCP port 143 by default, we will use telnet to connect to 10.10.95.249’s port 143 and fetch the message we sent in an earlier task.

ProtocolTransport ProtocolDefault Port Number
TELNETTCP23
DNSUDP or TCP53
HTTPTCP80
HTTPSTCP443
FTPTCP21
SMTPTCP25
POP3TCP110
IMAPTCP143
0
Subscribe to my newsletter

Read articles from MD MUNIF MUBTASHIM directly inside your inbox. Subscribe to the newsletter, and don't miss out.

Written by

MD MUNIF MUBTASHIM
MD MUNIF MUBTASHIM

CSE student | Cybersecurity Learner | Red Team Path | Blogging my CTF & hacking journey .