XMind

CCIE SEC Application Protocols

1. HTTP

   1. Hypertext Transfer Protocol

   2. TCP 80

2. SMTP

   1. Simple Mail Transfer Protocol

   2. TCP 25

3. FTP

   1. File Transfer Protocol

   2. TCP 21

   3. Active & Passive Modes

      1. Active DATA TCP 20

      2. Passive DATA TCP 21

4. DNS

   1. Domain Name System

   2. UDP 53 DNS Requests / Lookups

   3. TCP 53 DNS Zone Transfers

5. TFTP

   1. Trivial File Transfer Protocol

   2. UDP 69

6. NTP

   1. Network Time Protocol

   2. ntp.org documentation

   3. Wikipedia Entry

   4. Cisco Entry

      1. Best Practices / GOOD Document

   5. UDP 123

   6. hierarchical

      1. Stratum 0

         1. These are devices such as atomic (caesium, rubidium) clocks, GPS clocks or other radio clocks. Stratum-0 devices are traditionally not attached to the network; instead they are locally connected to computers (e.g., via an RS-232 connection using a Pulse per second signal).

      2. Stratum 1

         1. These are computers attached to Stratum 0 devices. Normally they act as servers for timing requests from Stratum 2 servers via NTP.

         2. These computers are also referred to as time servers.

      3. Stratum 2

         1. These are computers that send NTP requests to Stratum 1 servers.

         2. Normally a Stratum 2 computer will reference a number of Stratum 1 servers and use the NTP algorithm to gather the best data sample, dropping any Stratum 1 servers that seem obviously wrong

         3. Stratum 2 computers will peer with other Stratum 2 computers to provide more stable and robust time for all devices in the peer group

      4. Stratum 3

         1. These computers employ exactly the same NTP functions of peering and data sampling as Stratum 2

   7. Read From Servers

   8. Read / Write with Peers

   9. Note: PIX and ASA cannot be configured as an NTP server, but they can be configured as an NTP client.

7. Syslog

   1. Cisco Entry

      Syslog is a method to collect messages from devices to a server running a syslog daemon. Logging to a central syslog server helps in aggregation of logs and alerts. Cisco devices can send their log messages to a Unix-style SYSLOG service. A SYSLOG service simply accepts messages, and stores them in files or prints them according to a simple configuration file. This form of logging is the best available for Cisco devices because it can provide protected long-term storage for logs. This is useful both in routine troubleshooting and in incident handling.

   2. Wikipedia

   3. UDP 514

8. LDAP

   1. Lightweight Directory Access Protocol

   2. TCP 389

   3. Wikipedia