1. Learning Objectives

By the end of this lesson, you will be able to:

• Explain what network protocols and services are.
• Understand the difference between a protocol, service, and port.
• Identify common network protocols and their default ports.
• Differentiate between SSH and Telnet.
• Understand FTP, SFTP, and FTPS.
• Explain SMTP, POP3, and IMAP.
• Understand SMB and NFS file-sharing services.
• Explain SNMP and NTP.
• Understand LDAP and Kerberos fundamentals.
• Identify insecure protocols and their security risks.
• Recognize exposed network services.
• Apply basic service hardening and monitoring practices.

2. What Are Network Protocols?

A network protocol is a defined set of rules that determines how devices communicate and exchange information over a network.

Protocols define things such as:

• Message formats.
• Communication procedures.
• Data exchange rules.
• Error handling.
• Authentication mechanisms.
• Session management.

Without protocols, different devices and applications would not have a common way to communicate.

Real-world example

Imagine an organization with:

• Employee computers.
• Email servers.
• File servers.
• Database servers.
• Network switches.
• Routers.
• Printers.

Each system uses different protocols to communicate.

Examples:

• SSH for secure remote administration.
• HTTPS for secure web communication.
• SMTP for sending email.
• IMAP for accessing email.
• SMB for Windows file sharing.
• SNMP for network monitoring.
• NTP for time synchronization.
• LDAP for directory services.

3. What Is a Network Service?

A network service is a software function that provides a capability to other systems over a network.

Examples:

• A web server provides web content.
• An SSH server provides secure remote administration.
• An SMTP server handles email transmission.
• An SMB server provides file sharing.
• An NTP server provides time synchronization.

A service typically listens for incoming communication on a network interface and uses one or more protocols and ports.

Protocol vs Service vs Port

These terms are related but different.

Example:

An administrator connects to a Linux server using SSH.

• Protocol: SSH.
• Service: SSH server.
• Transport: TCP.
• Default port: 22.

Important: A port being open does not prove that a service is secure or vulnerable. It only indicates that something is accepting or handling traffic at that endpoint.

4. Common Network Protocols and Ports

The following table contains commonly encountered default ports.

Port note: These are common defaults, not guaranteed configurations. Services can use non-standard ports, and modern implementations may support different transport options.

5. SSH – Secure Shell

SSH stands for Secure Shell.

SSH is a protocol used to securely access and administer remote systems over an IP network.

It is widely used by:

• Linux administrators.
• Developers.
• DevOps engineers.
• Network administrators.
• Security professionals.

SSH commonly uses TCP port 22.

5.1 How SSH Works

Suppose an administrator wants to manage a Linux server remotely.

Server IP:

192.168.10.20

The administrator executes:

ssh admin@192.168.10.20

A simplified process:

1. The client connects to the SSH server.
2. Both sides negotiate supported cryptographic algorithms.
3. The server proves its identity using its host key.
4. The client validates the server's host key.
5. The user authenticates.
6. An encrypted SSH session is established.
7. The administrator can execute permitted commands.

5.2 SSH Authentication Methods

Common authentication methods include:

Password authentication

The user provides a username and password.

Public-key authentication

The client proves possession of a private key corresponding to an authorized public key.

Certificate-based authentication

SSH certificates can be used to manage identity and access in larger environments.

5.3 SSH Security Best Practices

• Use strong authentication.
• Prefer public-key authentication where appropriate.
• Protect private keys with suitable permissions and passphrases.
• Disable direct root login where practical.
• Restrict access to authorized users.
• Use modern cryptographic algorithms.
• Keep SSH server software updated.
• Monitor authentication logs.
• Restrict SSH access through firewalls or management networks.

Security note: Changing SSH from port 22 to another port may reduce background scanning noise, but it is not a substitute for authentication and access controls.

6. Telnet – An Insecure Remote Access Protocol

Telnet is an older protocol used for remote terminal communication.

Its traditional default port is TCP 23.

Why Is Telnet Insecure?

Traditional Telnet does not provide encryption.

Communication may expose:

• Usernames.
• Passwords.
• Commands.
• Session data.

If an attacker can capture traffic on the communication path, sensitive information may be exposed.

Telnet vs SSH

Security Recommendation

Do not use Telnet for remote administration across untrusted networks.

Use SSH or another secure management method.

7. FTP – File Transfer Protocol

FTP is a protocol used to transfer files between a client and a server.

Traditional FTP commonly uses:

• TCP 21 for control.
• TCP 20 for data in active mode.

FTP can use different data connections depending on active or passive mode.

7.1 How FTP Works

A simplified process:

1. The client connects to the FTP server.
2. The client authenticates.
3. The client requests file operations.
4. The server establishes or negotiates a separate data connection.
5. Files are transferred.

7.2 Active vs Passive FTP

Active FTP

The server initiates the data connection back towards the client.

This can create problems when the client is behind NAT or a firewall.

Passive FTP

The client initiates both the control and data connections.

Passive mode is often easier to use through client-side NAT and firewalls, although the server must permit its configured passive port range.

7.3 FTP Security Risks

Traditional FTP does not encrypt usernames, passwords, or file contents.

This creates risks such as:

• Credential exposure.
• Data interception.
• Unauthorized file access.
• Modification of transferred files.

8. SFTP vs FTPS

SFTP and FTPS both provide secure file-transfer capabilities, but they are different protocols.

8.1 SFTP

SFTP stands for SSH File Transfer Protocol.

SFTP operates over the SSH protocol and commonly uses TCP port 22.

It supports secure file operations such as:

• Uploading files.
• Downloading files.
• Renaming files.
• Deleting files.
• Listing directories.
• Managing remote file permissions where supported.

8.2 FTPS

FTPS is FTP protected using TLS.

It commonly operates in two modes:

• Explicit FTPS: Starts with FTP and upgrades the connection using TLS.
• Implicit FTPS: Uses TLS from the beginning, commonly associated with TCP port 990.

FTPS may require additional data-channel port configuration.

Comparison

Remember: SFTP is not simply FTP with encryption. It is a separate protocol that operates over SSH.

9. Email Protocols

Email communication uses multiple protocols.

Three important protocols are:

• SMTP.
• POP3.
• IMAP.

9.1 SMTP – Simple Mail Transfer Protocol

SMTP is used to send email.

Common ports:

How SMTP Works

Imagine an employee sends an email to a customer.

1. The employee writes the email in a mail client.
2. The mail client submits it to an outgoing mail server.
3. The server processes the message.
4. DNS MX records help identify the recipient's mail server.
5. The sending server communicates with the receiving server using SMTP.
6. The recipient retrieves the email using IMAP or POP3.

Important: SMTP is used for sending and transferring email. IMAP and POP3 are commonly used for retrieving or accessing received email.

9.2 POP3 – Post Office Protocol Version 3

POP3 is an email retrieval protocol.

Its traditional default port is TCP 110.

POP3S commonly uses TCP 995.

POP3 typically allows a client to download messages from a mail server.

Depending on client settings, messages may be removed from the server after downloading or retained for a configured period.

9.3 IMAP – Internet Message Access Protocol

IMAP is an email access and synchronization protocol.

Its traditional default port is TCP 143.

IMAPS commonly uses TCP 993.

IMAP allows users to manage messages while keeping mailbox state synchronized with the server.

Common features include:

• Multiple folders.
• Message status synchronization.
• Server-side mailbox management.
• Access from multiple devices.

POP3 vs IMAP

Email Security Best Practices

• Use TLS for mail submission and retrieval.
• Require authentication where appropriate.
• Disable insecure legacy authentication.
• Use MFA for user accounts.
• Configure SPF, DKIM, and DMARC.
• Monitor suspicious mail access.
• Restrict administrative access to mail servers.
• Keep mail server software updated.

Important: TLS protects communication between specific endpoints. It does not guarantee that email content is end-to-end encrypted across every mail system.

10. SMB – Server Message Block

SMB is a network protocol used for file and printer sharing and other network resource access.

It is widely used in Windows environments.

Modern SMB commonly uses TCP port 445.

10.1 How SMB Works

Imagine an organization has a shared file server.

Employees access a shared folder:

\\192.168.10.20\CompanyFiles

The SMB client communicates with the SMB server to perform authorized file operations.

Examples include:

• Opening documents.
• Reading files.
• Writing files.
• Creating directories.
• Accessing shared printers.

10.2 SMB Security Risks

Incorrectly configured SMB can create serious risks.

Common issues include:

• Anonymous or guest access.
• Weak credentials.
• Excessive share permissions.
• Unpatched SMB vulnerabilities.
• Exposure to untrusted networks.
• Legacy SMBv1 usage.

10.3 SMBv1 vs SMBv2 vs SMBv3

SMBv3 supports encryption when configured and supported by the endpoints.

SMB signing can help protect against certain message-tampering and relay scenarios, but it is not the same as encryption.

10.4 SMB Security Best Practices

• Disable SMBv1.
• Use supported SMB versions.
• Require strong authentication.
• Restrict TCP 445 to trusted network segments.
• Apply least-privilege share permissions.
• Use SMB signing where appropriate.
• Enable SMB encryption for sensitive data where supported.
• Patch systems regularly.
• Monitor unusual file-share access.
• Avoid exposing SMB directly to the public internet.

11. NFS – Network File System

NFS is a protocol used to share files and directories across networked systems.

It is commonly used in Linux and Unix environments.

NFS allows a client system to access remote directories as if they were part of its local filesystem.

Example

A Linux server exports a shared directory:

/shared/projects

An authorized client mounts the directory and accesses permitted files.

NFS Versions

• NFSv2: Legacy version.
• NFSv3: Commonly used older version.
• NFSv4: Provides improvements including integrated locking and stronger security capabilities.

NFSv4 commonly uses TCP port 2049.

Older NFS deployments may involve additional services and ports.

NFS Security Risks

• Overly broad export permissions.
• Unauthorized network access.
• Weak identity and authorization controls.
• Insecure legacy configurations.
• Exposure of sensitive shared files.

NFS Hardening

• Prefer supported NFS versions.
• Restrict exported directories to authorized clients.
• Apply least privilege.
• Use appropriate authentication and security mechanisms.
• Restrict network access using firewalls.
• Avoid exporting sensitive directories unnecessarily.
• Monitor mount and file-access activity.

12. SNMP – Simple Network Management Protocol

SNMP is used to monitor and manage network devices.

It is commonly used for:

• Routers.
• Switches.
• Firewalls.
• Printers.
• Servers.
• UPS systems.
• Network monitoring infrastructure.

Common ports:

12.1 How SNMP Works

SNMP commonly uses three important components.

SNMP Manager

The monitoring system that collects information from devices.

SNMP Agent

Software running on the managed device that provides information.

MIB – Management Information Base

A structured collection of managed objects that can be queried or reported.

12.2 SNMP Versions

SNMPv1

The original version with limited security capabilities.

SNMPv2c

Adds improvements over SNMPv1 but commonly relies on community strings rather than strong user authentication and encryption.

SNMPv3

Provides stronger security capabilities, including authentication and privacy options.

12.3 What Is a Community String?

In SNMPv1 and SNMPv2c, a community string acts like a shared access value.

Common examples found in poorly configured environments include:

• public
• private

These are well-known defaults and should never be used as production secrets.

SNMP Security Risks

• Default community strings.
• Exposed SNMP services.
• Unauthorized device information disclosure.
• Unauthorized management operations.
• Weak network access controls.
• Unencrypted management traffic in older versions.

SNMP Hardening

• Prefer SNMPv3.
• Use strong authentication and privacy settings.
• Restrict SNMP access to approved monitoring systems.
• Change default credentials or community strings where legacy use remains.
• Disable write access unless required.
• Monitor management activity.
• Restrict UDP 161 and 162 at network boundaries.

13. NTP – Network Time Protocol

NTP stands for Network Time Protocol.

It synchronizes system clocks across networked devices.

NTP commonly uses UDP port 123.

Why Is Time Synchronization Important?

Accurate time is essential for:

• Security logs.
• Incident investigation.
• Authentication systems.
• Certificate validation.
• Distributed applications.
• Database consistency.
• Monitoring systems.
• Event correlation in SIEM platforms.

13.1 How NTP Works

A client contacts an NTP server.

The server provides timing information.

The client calculates timing differences and adjusts its local clock according to its synchronization algorithm.

Organizations commonly use a hierarchy of trusted time sources.

NTP Stratum

Stratum describes the distance from a reference clock in an NTP synchronization hierarchy.

Examples:

• Stratum 0: Reference clocks such as GPS or atomic clocks.
• Stratum 1: Servers directly synchronized to reference clocks.
• Stratum 2: Servers synchronized to Stratum 1 systems.
• Stratum 3: Servers synchronized to Stratum 2 systems.

A lower stratum number generally indicates a closer position to the reference clock, but it does not automatically mean better accuracy in every situation.

NTP Security Risks

• Unauthorized NTP configuration.
• Malicious or unreliable time sources.
• Incorrect time synchronization.
• Exposed monitoring and control functions.
• Amplification attacks involving misconfigured legacy NTP services.

NTP Hardening

• Use trusted time sources.
• Configure appropriate NTP authentication where supported.
• Restrict management and control functions.
• Disable unnecessary NTP services.
• Monitor unexpected time changes.
• Avoid exposing unnecessary NTP functionality to the internet.
• Maintain consistent time synchronization across security systems.

Security principle: Incorrect system time can make security investigations significantly harder.

14. LDAP – Lightweight Directory Access Protocol

LDAP is a protocol used to access and manage directory information.

Organizations commonly use directory services to manage:

• Users.
• Groups.
• Computers.
• Organizational units.
• Authentication-related information.
• Access-related attributes.

LDAP commonly uses TCP/UDP port 389, while LDAP over TLS commonly uses TCP port 636.

14.1 What Is a Directory Service?

A directory service stores organized information about users, devices, groups, and other organizational resources.

Imagine a company has 500 employees.

Instead of maintaining separate user databases for every system, the organization may use a central directory.

Applications can query the directory to identify users and retrieve relevant information.

14.2 How LDAP Works

A simplified process:

1. A client connects to an LDAP server.
2. The client establishes an appropriate secure connection.
3. The client authenticates if required.
4. The client submits a directory query.
5. The server checks access permissions.
6. The server returns permitted directory information.

LDAP Security Risks

• Anonymous directory access.
• Unencrypted authentication.
• Weak bind credentials.
• Excessive directory permissions.
• Sensitive information exposure.
• LDAP injection in applications that construct unsafe directory queries.

LDAP Hardening

• Use TLS-protected LDAP connections.
• Disable anonymous access unless explicitly required.
• Apply least-privilege directory permissions.
• Use strong authentication.
• Protect service-account credentials.
• Monitor directory queries and authentication events.
• Keep directory software updated.

15. Kerberos Fundamentals

Kerberos is a network authentication protocol designed to provide secure authentication using tickets.

It is widely used in Microsoft Active Directory environments.

Instead of repeatedly sending a user's password to every service, Kerberos uses tickets to support authentication.

15.1 Important Kerberos Components

Client

The user or device requesting access.

KDC – Key Distribution Center

The trusted system that issues and manages authentication tickets.

AS – Authentication Service

The component that initially authenticates a client and provides a Ticket Granting Ticket.

TGS – Ticket Granting Service

The component that issues service tickets.

Service Server

The server the client wants to access.

Kerberos commonly uses TCP/UDP port 88.

15.2 Simplified Kerberos Authentication Flow

Step 1 – Initial authentication

The client requests authentication from the Authentication Service.

Step 2 – Ticket Granting Ticket

After successful authentication, the client receives a Ticket Granting Ticket (TGT).

Step 3 – Service ticket request

When the client wants to access a service, it presents the TGT to the Ticket Granting Service.

Step 4 – Service ticket

The TGS issues a ticket for the requested service.

Step 5 – Service authentication

The client presents the service ticket to the destination server.

Step 6 – Access

The server validates the ticket and grants access according to the applicable permissions.

15.3 Why Is Kerberos Important?

Kerberos supports:

• Centralized authentication.
• Mutual authentication in supported exchanges.
• Ticket-based access.
• Reduced need to repeatedly transmit passwords.
• Integration with enterprise identity environments.

Kerberos Security Risks

• Weak passwords.
• Compromised service accounts.
• Misconfigured service principal names.
• Ticket theft.
• Excessive account privileges.
• Incorrect system time.
• Poor Active Directory security.

Kerberos Hardening

• Use strong passwords and managed service accounts where appropriate.
• Apply least privilege.
• Protect domain controllers.
• Maintain accurate time synchronization.
• Monitor suspicious ticket activity.
• Disable obsolete authentication configurations where possible.
• Patch directory infrastructure.

16. Secure vs Insecure Network Protocols

Not every network protocol provides encryption or strong authentication by default.

Understanding the differences helps administrators choose safer alternatives.

Important: A protocol's name alone does not prove that a connection is secure. Configuration, certificate validation, authentication, encryption, and implementation quality matter.

For example:

• HTTPS without correct certificate validation can still expose users to impersonation.
• SSH with weak passwords can still be compromised.
• SNMPv3 without privacy settings may not encrypt management data.
• SMBv3 does not automatically mean every share is correctly secured.

17. What Is Service Exposure?

Service exposure occurs when a network service is reachable from a network or device that does not need access to it.

Example:

An organization runs a database server on its internal network.

If its database port is unnecessarily accessible from the public internet, attackers may attempt to:

• Discover the service.
• Identify its version.
• Guess credentials.
• Exploit vulnerabilities.
• Access sensitive information.
• Disrupt availability.

17.1 Common Exposed Services

A listed port is not automatically vulnerable. Risk depends on the service, its configuration, software version, access controls, and exposure.

18. Service Hardening

Service hardening means reducing the attack surface and strengthening the security configuration of network services.

18.1 Disable Unnecessary Services

If a server does not need FTP, Telnet, or another service, disable it.

Every unnecessary service creates additional maintenance and security requirements.

18.2 Restrict Network Access

Use firewall rules to permit only required source networks and destination services.

Example:

• SSH allowed only from the management network.
• SMB allowed only from authorized internal clients.
• Database connections allowed only from approved application servers.
• SNMP queries accepted only from monitoring systems.

18.3 Use Secure Protocols

Prefer:

• SSH instead of Telnet.
• SFTP or FTPS instead of FTP.
• HTTPS instead of HTTP.
• SNMPv3 instead of SNMPv1/v2c.
• Secure LDAP connections.
• Supported SMB versions with appropriate security settings.

18.4 Authentication and Authorization

• Remove default credentials.
• Use strong passwords.
• Enable MFA where supported.
• Use separate administrative accounts.
• Apply least privilege.
• Review service accounts regularly.

18.5 Patch Management

• Update operating systems.
• Update server software.
• Remove unsupported services.
• Review security advisories.
• Test updates before production rollout where required.

18.6 Logging and Monitoring

Monitor:

• Authentication failures.
• Unexpected service connections.
• Unusual outbound communication.
• Service restarts.
• Configuration changes.
• Unusual file access.
• Privilege escalation events.

19. Network Protocol Security in an Enterprise

Imagine CYNARKS operates an internal network containing:

• Linux application servers.
• Windows file servers.
• Email services.
• Network switches.
• Firewalls.
• Directory servers.
• Database servers.

A secure protocol design could look like this:

Example Firewall Policy

Security principle: A service should be reachable only by systems that genuinely require it.

20. Practical Lab 1: Inspect Listening Network Services

Objective: Identify services listening on your own computer.

Windows

netstat -ano

To display listening TCP ports:

Get-NetTCPConnection -State Listen

To inspect listening UDP endpoints:

Get-NetUDPEndpoint

To identify the process associated with a PID:

Get-Process -Id <PID>

Replace <PID> with the process ID shown in the output.

Linux

ss -tulpen

Alternative:

sudo lsof -i -P -n

macOS

lsof -i -P -n

Understand the Output

Tasks

1. Identify listening TCP services.
2. Identify listening UDP services.
3. Record the associated process.
4. Identify whether each service is required.
5. Check whether it listens on localhost, a specific interface, or all interfaces.
6. Document any unnecessary service that should be reviewed.

Expected outcome: Understand which services your computer makes available to other systems.

21. Practical Lab 2: Inspect Secure and Insecure Service Configuration

Objective: Review services on an authorized lab server.

Use a lab system you own or administer.

Review:

• SSH configuration.
• FTP or SFTP configuration.
• SMB version and share permissions.
• SNMP version.
• LDAP transport security.
• NTP configuration.

Tasks

1. Identify the services currently enabled.
2. Record their listening ports.
3. Identify whether encryption is enabled.
4. Identify authentication requirements.
5. Identify permitted source networks.
6. Recommend hardening changes.

Expected outcome: Understand how protocol security depends on configuration.

22. Practical Lab 3: Inspect Network Services Using Nmap

Objective: Identify services exposed by an authorized lab machine.

Nmap is a network discovery and service inspection tool.

Only scan systems you own or have explicit authorization to assess.

Scan your own machine:

nmap -sV 127.0.0.1

Scan a dedicated lab server:

nmap -sV 192.168.56.10

Replace the example IP address with the authorized lab server address.

Understand the Options

• -sV: Attempts to identify service versions.
• 127.0.0.1: Your local loopback address.
• 192.168.56.10: Example lab host.

Tasks

1. Identify open ports.
2. Record detected services.
3. Compare the results with the expected server configuration.
4. Identify unnecessary exposed services.
5. Recommend which services should be restricted or disabled.

Important: Service detection results are estimates and may not correctly identify every service or version.

23. Practical Lab 4: Protocol Security Analysis

Objective: Compare secure and insecure communication using a controlled lab.

Use your own test server and client.

Scenario A: HTTP vs HTTPS

Observe the difference between ordinary HTTP and HTTPS.

Discuss:

• Whether the communication is encrypted.
• How certificates help authenticate a server.
• Why certificate validation matters.

Scenario B: Telnet vs SSH

Compare:

• Authentication mechanisms.
• Encryption.
• Host identity verification.
• Suitable administrative use.

Scenario C: FTP vs SFTP

Compare:

• Transport security.
• Authentication.
• File transfer behavior.
• Firewall considerations.

Deliverable

Create a comparison report explaining why secure alternatives are preferred for sensitive communication.

Do not capture or inspect other people's credentials or traffic.

24. Practical Lab 5: Enterprise Service Hardening Assessment

Objective: Prepare a basic service security assessment for a fictional organization.

Environment

The organization has:

• One Linux server.
• One Windows file server.
• One database server.
• One router.
• One managed switch.
• One monitoring server.

Your Tasks

1. Identify the required network services.
2. Identify unnecessary services.
3. Record listening ports.
4. Map each service to its business purpose.
5. Define which source networks require access.
6. Identify insecure or legacy protocols.
7. Recommend secure alternatives.
8. Define firewall restrictions.
9. Define logging requirements.
10. Prepare a remediation report.

Expected Deliverable

Risk ratings are illustrative and should be adjusted based on actual exposure and impact.

26. Lesson Summary

In this lesson, you learned:

• Network protocols define communication rules.
• Services provide functionality through network communication.
• Ports identify logical communication endpoints.
• SSH is preferred over Telnet for secure remote administration.
• SFTP and FTPS provide secure file-transfer options.
• SMTP sends email, while IMAP and POP3 provide email access.
• SMB and NFS support network file sharing.
• SNMP supports network monitoring and management.
• NTP synchronizes time across devices.
• LDAP supports directory services.
• Kerberos uses tickets for network authentication.
• Secure protocols still require correct configuration.
• Unnecessary service exposure increases the attack surface.
• Service hardening requires least privilege, patching, access restrictions, encryption, and monitoring.

27. Coming Next: Network Attacks and Threats

In the next lesson, you will study common network-based attacks and how defenders detect and prevent them.

Topics include:

• IP spoofing.
• ARP spoofing.
• DNS spoofing.
• MAC flooding.
• DHCP starvation.
• Rogue DHCP servers.
• DoS and DDoS.
• SYN flood.
• Man-in-the-Middle attacks.
• Session hijacking concepts.
• Network reconnaissance.
• Detection and defense strategies.

CYNARKS Academy – Learn to Understand. Practice to Defend.

Practice networking and security testing only on systems you own or have explicit authorization to test.