ARP
Address Resolution Protocol associates an IP address with a MAC address on a local network. Hosts are addressed by IP, while network interfaces also have MAC addresses. ARP provides the association between them.
When a host wants to send a packet to another host on its LAN, for example 10.5.5.1, it first broadcasts an ARP request: what MAC address belongs to this IP address? The host configured with that address replies with its MAC address.
NAT
Network Address Translation lets computers on a private internal network communicate with the public internet through a network device, often a firewall. NAT translates internal or private IP addresses into public, globally routable addresses.
In short, it hides internal addresses and helps with routing. Internal hosts receive addresses from the private network and can reach each other locally. Those hosts are represented on the public network through the globally routable addresses provided by NAT.
DHCP
Dynamic Host Configuration Protocol assigns IP addresses and other configuration options to devices dynamically. This makes it easier to add computers, tablets and phones to a network.
Because the DHCP server handles this work, administrators do not have to configure each device manually. That is useful in larger networks with changing clients, including schools and companies.
The server can also provide a subnet mask, server name, domain name and gateway information.
DNS
The Domain Name System means people do not have to remember IP addresses. It is a decentralised naming system for computers, services and other resources connected to the internet or a private network.
I think of it like saving a number in a phone's contacts: a domain name such as www.gaissecurity.com corresponds to a numerical IP address, and reverse lookups provide the other direction. DNS consists of many cooperating servers. When a server cannot resolve a name or address, it communicates with other servers to find an answer.
IP and MAC
An Internet Protocol address identifies a device or domain connected to a network. An address can look like 192.168.1.1. DNS resolvers translate readable domain names into IP addresses, so users do not have to memorise them. An IP packet includes source and destination addresses, much like a letter includes a recipient and return address.
A Media Access Control address is a 48-bit hardware identifier associated with a network interface. It is also called a physical address. It is commonly written as twelve hexadecimal digits separated into pairs by colons.
MAC addresses are used by the Media Access Control sublayer of the data link layer to distinguish devices. Although assigned as hardware identifiers, a user can change the address presented by a device through software.
ICMP
The main purpose of ICMP is error reporting. When data cannot reach its intended destination, ICMP can carry information about the problem back to the sender. For example, a router may discard a packet that is too large and send an ICMP message to its source.
ICMP is also used for network diagnostics. Familiar terminal tools such as traceroute and ping use it.
Unlike TCP or UDP communication, ICMP does not establish a transport connection before sending a message. A device does not need to open a connection to send an ICMP packet, and ICMP does not target a particular TCP or UDP port.
SNMP
Checking every device individually becomes difficult when an organisation has hundreds or thousands of devices. Simple Network Management Protocol helps with this work.
SNMP is an application-layer protocol that uses UDP ports 161 and 162. It is used to monitor networks, detect network faults and, in some cases, configure devices remotely.
FTP
File Transfer Protocol transfers files between local and remote systems. Like HTTP, it runs over TCP. FTP uses separate TCP connections for control commands and data transfer.
SSH
Secure Shell is used to access network devices and servers remotely. Developed by SSH Communications Security, it supports logging in to another computer, executing commands on a remote machine and moving files between machines.
Telnet
Telnet is a remote terminal protocol associated with Unix systems and uses port 23. It was designed for network access, particularly on local networks.
It is not a secure communication protocol. It sends data, including passwords, in plain text, which makes that information vulnerable to interception.
VPN
A virtual private network lets a user connect to a private network through the internet. It creates an encrypted tunnel through which network communication can be carried.
The two main types in these notes are:
Remote access VPN
A user connects to a private network and accesses its services and resources remotely. The connection between the user and the private network goes over the internet through a protected tunnel.
Site-to-site VPN
Also called router-to-router VPN, this is common in organisations with offices in different locations. It connects the network at one location to the network at another.
Intranet-based VPN
Connecting offices of the same company through a site-to-site VPN is called an intranet-based VPN.
Extranet-based VPN
When companies use a site-to-site VPN to connect their networks to another company's offices, it is called an extranet-based VPN.