How computers talk using rules (protocols), doors (ports), and how we keep watch over it all.
// What is a protocol?
// The big idea
A protocol is a set of rules that lets computers communicate
Think of a protocol like a spoken language. If two people share the same language they can talk. If two computers support the same protocol they can share data — regardless of the manufacturer or type of device. An Apple iPhone can email an Android phone because they both follow the same email protocol rules.
Protocols operate in the background, so you don't normally need to think about them. But understanding the most common ones helps you troubleshoot problems, spot security threats, and manage a network.
// Common protocols — click to expand
HTTP is the protocol that lets you visit websites using a web browser. It defines how data is formatted and transmitted, and what actions web servers and browsers should take in response to commands. It uses TCP for transport, which means delivery is guaranteed.
HTTP operates in the Application, Presentation, and Session Layers of the OSI model (Layers 7, 6, and 5), or in the single Application Layer of the TCP/IP model.
// Think of it like...The language your browser speaks to ask a website "please give me your homepage." Every time you see "http://" in a web address, that's this protocol at work.
FTP is the standard for transferring data files from one computer to another over a network. It divides files into segments, assigns each a reference number, and transmits them in sequence. The receiving computer reassembles them into an exact copy of the original.
FTP also performs automatic error detection and correction, which is why it requires TCP for transport.
// Think of it like...A postal courier who specializes in packages. They number every box, track each one, and confirm every box arrived before they're done.
SMTP is used to transfer email messages and attachments. It's built into email client and server software. SMTP operates in the Application, Presentation, and Session layers of the OSI model and relies on TCP for transport.
// Think of it like...The postal service for email. When you hit "Send," SMTP picks it up and delivers it to the right mail server.
DNS provides a friendly name in place of an IP address. It lets you use a name rather than numbers to refer to computers. When you type "www.af.mil" into a browser, a DNS server translates it into the actual IP address like 131.77.61.125.
// Think of it like...A phone book for the internet. You look up a name (like "google.com") and DNS gives you the number (IP address) to actually call.
DHCP automatically assigns IP addresses to devices on a network. Without DHCP, a network admin would have to manually type in an IP address for every single device. With DHCP, a new computer can join a network and get an address automatically.
Dynamic addressing means a device may get a different IP address every time it connects. The software tracks this so the admin doesn't have to.
// Think of it like...A hotel receptionist handing out room keys. When you check in, they give you a room number (IP address). When you leave, they give that room to someone else.
SNMP allows remote monitoring and management of network devices — routers, switches, servers, printers, and more. It collects data from SNMP "agents" installed on devices, reporting things like CPU usage, memory, and interface status.
A Management Information Base (MIB) defines all information a device exposes. Each piece of data has a unique Object Identifier (OID). An SNMP manager collects and organizes all this info so admins can watch the whole network from one place.
// Think of it like...Security cameras across a building. Each camera (SNMP agent) watches its area and sends footage to a central security desk (SNMP manager) where one person can monitor everything at once.
ARP converts (resolves) an IP address into a MAC address. When a computer wants to send data to another device on the same local network, it knows the IP address but needs the MAC address to actually deliver it. ARP finds that MAC address.
It works as a request and reply: "Who has IP address X? Tell me your MAC address." ARP stays within a single network and is never routed across the internet.
// Think of it like...Knowing someone's apartment number (IP address) but needing to buzz the right unit intercom (MAC address) to actually reach them.
RIP uses UDP broadcast packets to share routing information between routers. Routers send updates every 30 seconds. If a router doesn't receive an update from another router after 180 seconds, it marks those routes as unusable. After 240 seconds with no update, it removes those routes entirely.
// Think of it like...Road signs that routers use to tell each other "this is the best way to get there." If a sign goes missing for too long, everyone assumes that road is closed.
// Two ways to deliver data
TCP — Transmission Control Protocol
Connection-oriented — both sides must agree before sending
Uses a 3-way handshake (ACK/NACK) to confirm connection
Numbers every segment and verifies all arrived
Re-sends anything that gets lost
Slower but extremely reliable
Header size: 20 bytes (160 bits)
Point-to-point (unicast) only
UDP — User Datagram Protocol
Connectionless — just sends without checking first
No handshake — fire and forget
No guaranteed delivery or ordering
Lost packets stay lost
Faster — less overhead
Header size: only 8 bytes
Supports multicast and broadcast
// When to use TCP
Use TCP when every bit of data must arrive
Telnet, SMTP (email), FTP (file transfer), and HTTP (web browsing) all use TCP because you can't afford to lose pieces of a web page, an email, or a file download.
TelnetSMTPFTPHTTP
// When to use UDP
Use UDP when speed matters more than perfection
Video calls, streaming, online gaming, and VoIP all use UDP. A dropped frame in a video call is barely noticeable. But lag caused by waiting to re-send packets would ruin the experience. DNS and DHCP also use UDP because their messages are tiny.
VoIPVideo streamingOnline gamingDNSDHCPSNMPRIP
// TCP header fields (20 bytes)
The TCP header is bigger because TCP keeps track of everything. Key fields include:
Sequence NumberNumbers each segment so the receiver can put them back in order
ACK NumberTells the sender which segment to send next
Source PortWhich door (port) the data is coming from on the sender
Destination PortWhich door (port) to deliver to on the receiver
ChecksumA value that confirms the data wasn't corrupted in transit
WindowControls how much data can be sent before needing an acknowledgement
// What is a port?
// The big idea
A port is like a numbered door on your computer
Just like a house can have multiple doors (front door, back door, garage), a computer has 65,535 ports. Each port is just a number. Some port numbers are permanently reserved for specific services (like HTTP always uses port 80). Others are used temporarily as needed.
Ports can be open (data can flow through) or closed (blocked). Network firewalls control which ports are open for security. An organization called IANA (Internet Assigned Numbers Authority) manages the official port assignments.
// Three ranges of ports
Well-Known Ports
0 – 1,023
Reserved for the most common services and protocols. Used by system processes. These are the ones you need to memorize.
Registered Ports
1,024 – 49,151
Assigned by IANA for specific application services, but also available for general use by programs and users.
Dynamic / Ephemeral
49,152 – 65,535
Cannot be registered. Used for temporary connections. Assigned as needed, then released when the session ends. May be different each time.
// Port numbers to know
Port(s)
Protocol
Transport
What it does
20 & 21
FTP
TCP
File transfers between computers
23
Telnet
TCP
Remote terminal access (unsecured)
25
SMTP
TCP
Sending email
53
DNS
UDP
Converts domain names to IP addresses
67
DHCP
UDP
Automatically assigns IP addresses
80
HTTP
TCP
Regular (unencrypted) web browsing
161
SNMP
UDP
Network device monitoring & management
443
HTTPS
TCP
Encrypted web browsing
520
RIP
UDP
Routers sharing route information
// Why monitor a network?
// The big idea
The network is the lifeline of IT — if it fails, everything stops
Network Monitoring Systems (NMSs) keep watch over the network 24/7. They check that servers are up, connections are working, and hardware is healthy. They also look for suspicious activity — like a hacker scanning the network or someone making too many connection attempts.
Things an NMS tracks: Is a device up and responding? How fast is it processing requests? What routes are data packets taking? Is CPU, memory, or bandwidth running too high?
// The 5 functions of a Network Monitoring System
01
Discover
Find every device on the network — routers, switches, servers, printers, firewalls. You can't monitor what you don't know exists.
02
Map
Visualize how all the devices connect. A clean network map helps admins spot problems fast — a failed switch can take down every device connected to it.
03
Monitor
Continuously watch the "big 5" on every device: Ping availability, CPU, memory, disk, and interface utilization. Also monitors services like HTTP, FTP, and TCP/IP.
04
Alert
Send notifications (email, text, log) when thresholds are crossed. Example: alert when CPU stays above 80% for more than 10 minutes — before the router fails completely.
05
Report
Provide real-time and historical data through dashboards. Helps admins validate network designs, spot trends, and isolate performance problems quickly.
// Key monitoring tools
An IDS scans, audits, and monitors the security infrastructure for signs of attacks. It works by looking for signatures of known attacks or deviations from normal activity. When something suspicious is detected, it alerts system administrators.
Suspicious activity can include: network scanning, multiple connection attempts from an unknown entity, unusual or excessive activity, or unauthorized individuals gaining access to a system.
// Think of it like...A security guard watching all the entrance points to a building. They don't stop people themselves, but they notice when something looks wrong and call it in immediately.
SNMP agents are installed on nearly every modern network device. The NMS's SNMP manager queries these agents to collect data on CPU usage, memory, interface status, and more.
All the data objects are stored in a Management Information Base (MIB). Each object has a unique Object Identifier (OID). Admins can browse the MIB to find specific things to monitor. This means one admin can oversee hundreds or even thousands of devices from a single interface, without logging into each one manually.
// Think of it like...An air traffic controller. Instead of riding in every plane, they monitor all flights from one tower, and each plane (device) checks in automatically with its status.
Syslog is an automated messaging system that sends messages when an event affects a network device. It's part of the alerting function — when something noteworthy happens on a device, syslog logs it and can forward the message to administrators.