Services that make an IP network usable: DHCP hands out addresses, NAT shares public ones, plus time, naming and directory services. DNS has its own note: DNS. Addressing is in Ipv4 and Ipv6 and Subnetting.
DHCP (Dynamic Host Configuration Protocol)
Automatically gives clients an IP address, mask, default gateway, DNS servers and other options. UDP: server 67, client 68 (Port Numbers).
DORA process
Client Server
│── DISCOVER (broadcast) ────────────►│ "Anyone got an address?"
│◄──────────── OFFER ─────────────────│ "Here is 192.168.1.50"
│── REQUEST (broadcast) ─────────────►│ "I will take it"
│◄──────────── ACK ───────────────────│ "Confirmed, lease 8h"
- Lease time: client tries to renew at 50% (T1, unicast to the server) and rebinds at 87.5% (T2, broadcast)
- APIPA
169.254.0.0/16self-assigned when no DHCP server answers (a sign DHCP failed) - Scope: address pool + options. Exclusions keep ranges out; reservations tie an IP to a MAC (servers, printers)
- DHCP relay (IP helper): forwards client broadcasts across a router to a central server (
ip helper-address) - Options: 3 router, 6 DNS, 15 domain, 42 NTP, 66/67 TFTP boot
- DHCPv6: stateful; IPv6 also uses SLAAC (router advertisements, stateless) for addresses
Security: rogue DHCP server and DHCP starvation attacks, mitigated by DHCP snooping (Switching and VLANs).
NAT (Network Address Translation)
Rewrites IP addresses (and ports) as packets cross a router so many private hosts share public address(es).
Private ranges (RFC 1918)
10.0.0.0/8172.16.0.0/12(172.16.0.0 to 172.31.255.255)192.168.0.0/16
Types
| Type | Mapping | Use |
|---|---|---|
| Static NAT | 1 private ↔ 1 public | Publish a server |
| Dynamic NAT | Private → pool of publics | Rare |
| PAT / NAT overload | Many private → 1 public, distinguished by port | Home and office internet access |
| Port forwarding (DNAT) | Public ip:port → internal ip:port |
Expose a service |
| NAT64 / NAT66 | IPv6 transition |
192.168.1.10:51000 ──► [NAT 203.0.113.5:40001] ──► 93.184.216.34:443
192.168.1.11:51000 ──► [NAT 203.0.113.5:40002] ──► 93.184.216.34:443
Terms: inside local / inside global, outside local / outside global. NAT breaks some end-to-end protocols (IPsec AH, some VoIP) and hides internal addressing, but is not a security control. Cloud equivalent: 5. AWS Networking NAT Gateway.
Other Core Services
| Service | Port | Purpose |
|---|---|---|
| DNS | 53 UDP/TCP | Names ↔ IPs (DNS) |
| NTP | 123 UDP | Time sync, important for logs and Kerberos / TLS |
| Syslog | 514 UDP (6514 TLS) | Central logging |
| SNMP | 161 / 162 UDP | Monitoring (Network Management Protocols) |
| LDAP / LDAPS | 389 / 636 | Directory (Directory Access Protocols) |
| Kerberos | 88 | Authentication |
| RADIUS | 1812 / 1813 | AAA for Wi-Fi / VPN / 802.1X |
| TACACS+ | 49 TCP | AAA for device administration |
| TFTP | 69 UDP | Simple file transfer (device configs) |
| SMB / NFS | 445 / 2049 | File sharing (File Protocols) |
| SMTP / IMAP / POP3 | 25 / 143 / 110 | Mail (Mail Protocols) |
DNS record types (quick)
A IPv4, AAAA IPv6, CNAME alias, MX mail, TXT text (SPF, DKIM), NS name server, PTR reverse, SRV service, SOA zone authority. Zones and resolvers: DNS.
Quality of life
- Hosts file: static local name overrides (
/etc/hosts) - mDNS / LLMNR / NetBIOS: local name resolution without DNS
- IPAM: tracks address space
Remote Access and VPNs
| Type | Description |
|---|---|
| Site-to-site VPN | Router/firewall ↔ router/firewall, always on |
| Client-to-site (remote access) | A user's device to the corporate network |
| Clientless VPN | Browser-based (SSL portal) |
| Split tunnel | Only corporate traffic via VPN |
| Full tunnel | All traffic via VPN |
Protocols: IPsec (IKE phase 1/2, ESP protocol 50, AH 51, UDP 500 and 4500, transport vs tunnel mode), SSL/TLS VPN, WireGuard, OpenVPN, L2TP/IPsec, GRE.
Remote administration
- SSH (22) preferred over Telnet (23, cleartext)
- RDP (3389), VNC (5900), out-of-band management (console server, iLO / iDRAC)
- Jump host / bastion, MFA on all remote access