Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/0xkayala/common-protocols

A Dictionary of Common-Protocols such as TCP, UDP, ICMP and VoIP
https://github.com/0xkayala/common-protocols

icmp protocols tcp udp voip

Last synced: 4 days ago
JSON representation

A Dictionary of Common-Protocols such as TCP, UDP, ICMP and VoIP

Awesome Lists containing this project

README 

        
# Common Protocols



Internet protocols are standardized rules and guidelines defined in RFCs that specify how devices on a network should communicate with each other. They ensure that devices on a network can exchange information consistently and reliably, regardless of the hardware and software used. For devices to communicate on a network, they need to be connected through a communication channel, such as a wired or wireless connection. The devices then exchange information using a set of standardized protocols that define the format and structure of the data being transmitted. The two main types of connections used on networks are Transmission Control Protocol (TCP) and User Datagram Protocol (UDP).


We need to deal with and know the different and most used protocols. As we have already learned, these protocols are the basis of all communication between our devices and computers in the networks. We have compiled below many of these protocols that we will be dealing with throughout the modules. The better we understand them, the more effectively we can work with them.



## Transmission Control Protocol

TCP is a connection-oriented protocol that establishes a virtual connection between two devices before transmitting data by using a Three-Way-Handshake. This connection is maintained until the data transfer is complete, and the devices can continue to send data back and forth as long as the connection is active.


For example, When we enter a URL into our web browser, the browser sends an HTTP request to the server hosting the website using TCP. The server responds by sending the HTML code for the website back to the browser using TCP. The browser then uses this code to render the website on our screen. This process relies on a TCP connection being established between the browser and the web server and maintained until the data transfer is complete. As a result, TCP is reliable but slower than UDP because it requires additional overhead for establishing and maintaining the connection.



Protocol

Acronym

Port

Description



Telnet

Telnet

23

Remote login service



Secure Shell

SSH

22

Secure remote login service



Simple Network Management Protocol

SNMP

161-162

Manage network devices



Hyper Text Transfer Protocol

HTTP

80

Used to transfer webpages



Hyper Text Transfer Protocol Secure

HTTPS

443

Used to transfer secure webpages



Domain Name System

DNS

53

Lookup domain names



File Transfer Protocol

FTP

20-21

Used to transfer files



Trivial File Transfer Protocol

TFTP

69

Used to transfer files



Network Time Protocol

NTP

123

Synchronize computer clocks



Simple Mail Transfer Protocol

SMTP

25

Used for email transfer



Post Office Protocol

POP3

110

Used to retrieve emails



Internet Message Access Protocol

IMAP

143

Used to access emails



Server Message Block

SMB

445

Used to transfer files



Network File System

NFS

111, 2049

Used to mount remote systems



Bootstrap Protocol

BOOTP

67, 68

Used to bootstrap computers



Kerberos

Kerberos

88

Used for authentication and authorization



Lightweight Directory Access Protocol

LDAP

389

Used for directory services



Remote Authentication Dial-In User Service

RADIUS

1812, 1813

Used for authentication and authorization



Dynamic Host Configuration Protocol

DHCP

67, 68

Used to configure IP addresses



Remote Desktop Protocol

RDP

3389

Used for remote desktop access



Network News Transfer Protocol

NNTP

119

Used to access newsgroups



Remote Procedure Call

RPC

135, 137-139

Used to call remote procedures



Identification Protocol

Ident

113

Used to identify user processes



Internet Control Message Protocol

ICMP

0-255

Used to troubleshoot network issues



Internet Group Management Protocol

IGMP

0-255

Used for multicasting



Oracle DB (Default/Alternative) Listener

oracle-tns

1521/1526

The Oracle database default/alternative listener is a service that runs on the database host and receives requests from Oracle clients.



Ingres Lock

ingreslock

1524

Ingres database is commonly used for large commercial applications and as a backdoor that can execute commands remotely via RPC.



Squid Web Proxy

http-proxy

3128

Squid web proxy is a caching and forwarding HTTP web proxy used to speed up a web server by caching repeated requests.



Secure Copy Protocol

SCP

22

Securely copy files between systems



Session Initiation Protocol

SIP

5060

Used for VoIP sessions



Simple Object Access Protocol

SOAP

80, 443

Used for web services



Secure Socket Layer

SSL

443

Securely transfer files



TCP Wrappers

TCPW

113

Used for access control



Network Time Protocol

NTP

123

Synchronize computer clocks



Internet Security Association and Key Management Protocol

ISAKMP

500

Used for VPN connections



Microsoft SQL Server

ms-sql-s

1433

Used for client connections to the Microsoft SQL Server.



Kerberized Internet Negotiation of Keys

KINK

892

Used for authentication and authorization



Open Shortest Path First

OSPF

520

Used for routing



Point-to-Point Tunneling Protocol

PPTP

1723

Is used to create VPNs



Remote Execution

REXEC

512

This protocol is used to execute commands on remote computers and send the output of commands back to the local computer.



Remote Login

RLOGIN

513

This protocol starts an interactive shell session on a remote computer.



X Window System

X11

6000

It is a computer software system and network protocol that provides a graphical user interface (GUI) for networked computers.



Relational Database Management System

DB2

50000

RDBMS is designed to store, retrieve and manage data in a structured format for enterprise applications such as financial systems, customer relationship management (CRM) systems.



## User Datagram Protocol

On the other hand, UDP is a connectionless protocol, which means it does not establish a virtual connection before transmitting data. Instead, it sends the data packets to the destination without checking to see if they were received.


For example, when we stream or watch a video on a platform like YouTube, the video data is transmitted to our device using UDP. This is because the video can tolerate some data loss, and the transmission speed is more important than the reliability. If a few packets of video data are lost along the way, it will not significantly impact the overall quality of the video. This makes UDP faster than TCP but less reliable because there is no guarantee that the packets will reach their destination.



Protocol

Acronym

Port

Description



Domain Name System

DNS

53

It is a protocol to resolve domain names to IP addresses.



Trivial File Transfer Protocol

TFTP

69

It is used to transfer files between systems.



Network Time Protocol

NTP

123

It synchronizes computer clocks in a network.



Simple Network Management Protocol

SNMP

161

It monitors and manages network devices remotely.



Routing Information Protocol

RIP

520

It is used to exchange routing information between routers.



Internet Key Exchange

IKE

500

Internet Key Exchange



Bootstrap Protocol

BOOTP

68

It is used to bootstrap hosts in a network.



Dynamic Host Configuration Protocol

DHCP

67

It is used to assign IP addresses to devices in a network dynamically.



Telnet

TELNET

23

It is a text-based remote access communication protocol.



MySQL

MySQL

3306

It is an open-source database management system.



Terminal Server

TS

3389

It is a remote access protocol used for Microsoft Windows Terminal Services by default.



NetBIOS Name

netbios-ns

137

It is used in Windows operating systems to resolve NetBIOS names to IP addresses on a LAN.



Microsoft SQL Server

ms-sql-m

1434

Used for the Microsoft SQL Server Browser service.



Universal Plug and Play

UPnP

1900

It is a protocol for devices to discover each other on the network and communicate.



PostgreSQL

PGSQL

5432

It is an object-relational database management system.



Virtual Network Computing

VNC

5900

It is a graphical desktop sharing system.



X Window System

X11

6000-6063

It is a computer software system and network protocol that provides GUI on Unix-like systems.



Syslog

SYSLOG

514

It is a standard protocol to collect and store log messages on a computer system.



Internet Relay Chat

IRC

194

It is a real-time Internet text messaging (chat) or synchronous communication protocol.



OpenPGP

OpenPGP

11371

It is a protocol for encrypting and signing data and communications.



Internet Protocol Security

IPsec

500

IPsec is also a protocol that provides secure, encrypted communication. It is commonly used in VPNs to create a secure tunnel between two devices.



Internet Key Exchange

IKE

11371

It is a protocol for encrypting and signing data and communications.



X Display Manager Control Protocol

XDMCP

177

XDMCP is a network protocol that allows a user to remotely log in to a computer running the X11.



## ICMP

Internet Control Message Protocol (ICMP) is a protocol used by devices to communicate with each other on the Internet for various purposes, including error reporting and status information. It sends requests and messages between devices, which can be used to report errors or provide status information.


ICMP Requests


A request is a message sent by one device to another to request information or perform a specific action. An example of a request in ICMP is the ping request, which tests the connectivity between two devices. When one device sends a ping request to another, the second device responds with a ping reply message.


ICMP Messages


A message in ICMP can be either a request or a reply. In addition to ping requests and responses, ICMP supports other types of messages, such as error messages, destination unreachable, and time exceeded messages. These messages are used to communicate various types of information and errors between devices on the network.


For example, if a device tries to send a packet to another device and the packet cannot be delivered, the device can use ICMP to send an error message back to the sender. ICMP has two different versions:


    

  • 

    ICMPv4: For IPv4 only
    • 

  • 

    ICMPv6: For IPv6 only
    • 



ICMPv4 is the original version of ICMP, developed for use with IPv4. It is still widely used and is the most common version of ICMP. On the other hand, ICMPv6 was developed for IPv6. It includes additional functionality and is designed to address some of the limitations of ICMPv4.



Request Type

Description



Echo Request

This message tests whether a device is reachable on the network. When a device sends an echo request, it expects to receive an echo reply message. For example, the tools tracert (Windows) or traceroute (Linux) always send ICMP echo requests.



Timestamp Request

This message determines the time on a remote device.



Address Mask Request

This message is used to request the subnet mask of a device.



Message Type

Description



Echo reply

This message is sent in response to an echo request message.



Destination unreachable

This message is sent when a device cannot deliver a packet to its destination.



Redirect

A router sends this message to inform a device that it should send its packets to a different router.



 time exceeded

This message is sent when a packet has taken too long to reach its destination.



Parameter problem

This message is sent when there is a problem with a packet's header.



Source quench

This message is sent when a device receives packets too quickly and cannot keep up. It is used to slow down the flow of packets.



Another crucial part of ICMP for us is the Time-To-Live (TTL) field in the ICMP packet header that limits the packet's lifetime as it travels through the network. It prevents packets from circulating indefinitely on the network in the event of routing loops. Each time a packet passes through a router, the router decrements the TTL value by 1. When the TTL value reaches 0, the router discards the packet and sends an ICMP Time Exceeded message back to the sender.


We can also use TTL to determine the number of hops a packet has taken and the approximate distance to the destination. For example, if a packet has a TTL of 10 and takes 5 hops to reach its destination, it can be inferred that the destination is approximately 5 hops away. For example, if we see a ping with the TTL value of 122, it could mean that we are dealing with a Windows system (TTL 128 by default) that is 6 hops away.


However, it is also possible to guess the operating system based on the default TTL value used by the device. Each operating system typically has a default TTL value when sending packets. This value is set in the packet's header and is decremented by 1 each time the packet passes through a router. Therefore, examining a device's default TTL value makes it possible to infer which operating system the device is using. For example: Windows systems (2000/XP/2003/Vista/10) typically have a default TTL value of 128, while macOS and Linux systems typically have a default TTL value of 64 and Solaris' default TTL value of 255. However, it is important to note that the user can change these values, so they should be independent of a definitive way to determine a device's operating system.



## VoIP

Voice over Internet Protocol (VoIP) is a method of transmitting voice and multimedia communications. For example, it allows us to make phone calls using a broadband internet connection instead of a traditional phone line, like Skype, Whatsapp, Google Hangouts, Slack, Zoom, and others.


The most common VoIP ports are TCP/5060 and TCP/5061, which are used for the Session Initiation Protocol (SIP). However, the port TCP/1720 may also be used by some VoIP systems for the H.323 protocol, a set of standards for multimedia communication over packet-based networks. Still, SIP is more widely used than H.323 in VoIP systems.


Nevertheless, SIP is a signaling protocol for initiating, maintaining, modifying, and terminating real-time sessions involving video, voice, messaging, and other communications applications and services between two or more endpoints on the Internet. Therefore, it uses requests and methods between the endpoints. The most common SIP requests and methods are:



Method

Description



INVITE

Initiates a session or invites another endpoint to participate.



ACK

Confirms the receipt of an INVITE request.



BYE

Terminate a session.



CANCEL

Cancels a pending INVITE request.



REGISTER

Registers a SIP user agent (UA) with a SIP server.



OPTIONS

Requests information about the capabilities of a SIP server or user agent, such as the types of media it supports.



Information Disclosure


However, SIP allows us to enumerate existing users for potential attacks. This can be done for various purposes, such as determining a user's availability, finding out information about the user's capabilities or services, or performing brute-force attacks on user accounts later on.


One of the possible ways to enumerate users is the SIP OPTIONS request. It is a method used to request information about the capabilities of a SIP server or user agents, such as the types of media it supports, the codecs it can decode, and other details. The OPTIONS request can probe a SIP server or user agent for information or test its connectivity and availability.


During our analysis, it is possible to discover a SEPxxxx.cnf file, where xxxx is a unique identifier, is a configuration file used by Cisco Unified Communications Manager, formerly known as Cisco CallManager, to define the settings and parameters for a Cisco Unified IP Phone. The file specifies the phone model, firmware version, network settings, and other details.