Identify seven services from their traffic alone

short · 35 min · Objective 1.4

Task

Run a handful of well-known services, capture them, and identify each by port number without being told which is which. Memorising the port table is unavoidable for this exam; recognising the ports in real output is what makes them stick.

Steps

  1. On Host B, make sure sshd is running (sudo systemctl status ssh) and start a web server: python3 -m http.server 80 as root.
  2. On Host A, start a capture that records the ports: sudo tcpdump -i eth0 -n -c 40 -w /tmp/ports.pcap.
  3. Generate traffic to several services in turn: ssh 192.168.20.10 exit, curl http://192.168.20.10/, dig @192.168.20.10 example.com, ping -c 2 192.168.20.10.
  4. Stop the capture and list the destination ports you collected.
  5. Before looking anything up, name the service behind each port from memory. Then check yourself with grep <port>/tcp /etc/services.

Verify

tcpdump -r /tmp/ports.pcap -n | awk '{print $5}' | cut -d. -f5 | sort -u | head
python3 -c "
p = {20:'FTP data',21:'FTP control',22:'SSH/SCP/SFTP',23:'Telnet',25:'SMTP',53:'DNS',67:'DHCP server',68:'DHCP client',69:'TFTP',80:'HTTP',110:'POP3',123:'NTP',143:'IMAP',161:'SNMP',162:'SNMP trap',389:'LDAP',443:'HTTPS',445:'SMB',636:'LDAPS',993:'IMAPS',995:'POP3S',1433:'SQL Server',3306:'MySQL',3389:'RDP',5060:'SIP',5061:'SIP TLS'}
for k in sorted(p): print(k, p[k])
"

Every port that appeared in your capture must be one you can name before the table prints. The table is the answer key, not the study method.

Notes

The pairs are where marks are lost. 20 and 21 are FTP data and control; 67 and 68 are the DHCP server and client; 161 and 162 are SNMP polling and traps; 5060 and 5061 are SIP plain and TLS. Learn them as pairs and you halve the work.

Also note which of these are UDP: DNS (mostly), DHCP, TFTP, SNMP, NTP and SIP signalling. The transport is examinable alongside the number, and your capture shows it in the same line.