Unicast, broadcast, multicast and anycast

Why this matters

The previous lesson was the port table. This one finishes objective 1.4 with the transport protocols underneath those ports, the tunnelling and encryption protocols that carry traffic between sites, and the four ways a packet can be addressed.

The addressing part is small and gets asked reliably. The IPsec part is larger than it looks, because AH, ESP and IKE all appear as distinct answer options and they do genuinely different jobs.

The lesson

Three more ports to finish the table

Three registered ports complete objective 1.4's list, and all three matter because all three are commonly exposed when they should not be.

SQL Server — 1433 (TCP). Microsoft SQL Server's default listener. A database port should never be reachable from the internet; if a scenario shows 1433 open externally, that is the finding.

RDP — 3389 (TCP). Remote Desktop Protocol, for graphical remote access to Windows. Historically one of the most attacked ports in existence. The correct pattern is RDP reachable only over a VPN or through a gateway, never directly.

SIP — 5060/5061 (TCP/UDP). Session Initiation Protocol, which sets up and tears down voice and video calls. It does not carry the audio itself — RTP does that on separate dynamic ports, which is why VoIP is awkward through firewalls. 5060 is plain, 5061 is SIP over TLS.

IP types: what rides inside a packet

The IP header has a protocol field naming what is in the payload. These are protocol numbers, not port numbers, and a firewall rule may reference them.

ICMP is the network's own diagnostic and error channel. It carries no user data. Echo Request and Echo Reply are what ping uses; Time Exceeded is what makes traceroute work; Destination Unreachable reports that a router could not deliver something.

Blocking ICMP entirely is a common but crude choice: it does reduce reconnaissance, and it also breaks path MTU discovery, which produces the maddening symptom of small packets working while large ones vanish. That failure mode is a domain 5 favourite.

TCP is connection-oriented and reliable. It establishes a session with the three-way handshake — SYN, SYN-ACK, ACK — numbers every byte with a sequence number, acknowledges what it receives, retransmits what is not acknowledged, and controls its own rate to avoid overwhelming the path. It closes with FIN exchanges. Use it when every byte must arrive and arrive in order: web, email, file transfer, databases.

UDP is connectionless and unreliable by design. No handshake, no acknowledgement, no ordering, no retransmission — just a datagram with a source port, destination port, length and checksum. That makes it small and fast, which is what you want when late data is worthless anyway: voice, video, DNS queries, DHCP, NTP.

The trade is worth being able to state in one line. TCP guarantees delivery at the cost of delay; UDP guarantees nothing and is therefore prompt.

GRE (Generic Routing Encapsulation) is a tunnelling protocol: it wraps one protocol's packets inside IP so they can cross a network that would not otherwise carry them. It can tunnel multicast and non-IP protocols, which plain IPsec cannot — but GRE provides no encryption at all. That is the exam point. GRE gives you a tunnel; it does not give you privacy, which is why GRE and IPsec are frequently combined.

IPsec, and its three parts

IPsec secures traffic at layer 3, which means it protects everything above it without any application knowing. That is its defining property: a VPN built on TLS secures one application's session, while IPsec secures the whole network path.

It has two modes:

• Transport mode encrypts the payload but leaves the original IP header. Used host to host, where the endpoints are the communicating parties.
• Tunnel mode encrypts the entire original packet and wraps it in a new IP header. Used site to site, because the original addresses are hidden and the new header addresses the two gateways. This is what a site-to-site VPN uses.

And three components, each a plausible exam answer:

AH (Authentication Header). Provides integrity and authentication — confirms the packet came from who it claims and was not altered — but provides no encryption. Anyone capturing it can read the contents. AH also breaks through NAT, because it covers parts of the IP header that NAT rewrites. Rarely used alone in practice.

ESP (Encapsulating Security Payload). Provides encryption, plus integrity and authentication of the payload. This is what actually gives you confidentiality, and it is what almost every real IPsec deployment uses. If a question asks which IPsec component encrypts, the answer is ESP.

IKE (Internet Key Exchange). Negotiates the security association and exchanges keys before any protected traffic flows. It handles authentication of the peers — pre-shared key or certificate — agrees the ciphers, and rekeys periodically. IKE runs on UDP 500 (and 4500 when NAT traversal is needed).

The division to hold: IKE sets it up, ESP protects it, AH only proves it is authentic.

The four traffic types

How many recipients a single transmission is intended for.

Unicast — one to one. One sender, one specific recipient. The overwhelming majority of traffic. A web request, an SSH session, a file copy.

Broadcast — one to all. Delivered to every device in the broadcast domain. The IPv4 broadcast address is all ones in the host portion — 255.255.255.255 for a limited broadcast, or something like 192.168.1.255 for a directed one. At layer 2 the destination MAC is FF:FF:FF:FF:FF:FF.

ARP and DHCP both rely on broadcast, because in both cases the sender does not yet know who it needs. The cost is that every device must process every broadcast, which is why a large flat network performs badly and why routers do not forward broadcasts.

IPv6 has no broadcast at all. It uses multicast instead, which is a clean exam question on its own.

Multicast — one to many, but only those who asked. Sent once and delivered to the group of devices that have subscribed. IPv4 multicast uses the 224.0.0.0/4 range. The efficiency is real: streaming one video to two hundred subscribers as multicast is one stream on the wire instead of two hundred. Switches use IGMP snooping to learn which ports have interested listeners, so multicast is not simply flooded everywhere.

Used for video distribution, some stock market feeds, and routing protocol updates — OSPF uses 224.0.0.5.

Anycast — one to the nearest of many. The same address is advertised from multiple locations, and routing delivers each request to whichever instance is closest in network terms. The sender does not know or care which one answered.

This is how the DNS root servers and large public resolvers work: 8.8.8.8 answers from many places worldwide. It gives low latency and natural resilience — if one site fails, routing simply stops advertising it and requests go elsewhere.

One to one, one to all, one to a group, one to the nearest. That single line answers most questions on this sub-topic.