Protocols and key terms

What it isName service: turns a name (dc01.corp.local) into an IP address. Without healthy DNS, Active Directory simply does not work.

Real-life exampleA PC looks up the SRV record _ldap._tcp.dc._msdcs.corp.local to find a Domain Controller before logging in.

What it isAutomatically hands out IP addresses on the network (the DORA process: Discover, Offer, Request, Ack).

Real-life exampleA laptop joins the office network and within a second gets an IP, gateway and DNS server with zero manual setup.

What it isThe browser protocol. HTTPS adds TLS encryption so nobody in the middle can read the content.

Real-life exampleYou open the company portal and see the padlock in the address bar — the traffic is HTTPS-encrypted.

What it isThe encryption layer that wraps other protocols (HTTPS, LDAPS, SMTPS) and proves the server's identity with a certificate.

Real-life exampleA server presents a certificate issued by the corporate CA and the client confirms: this really is the right server.

What it isClock synchronisation. In AD, a gap of more than 5 minutes between a client and a DC breaks Kerberos entirely.

Real-life exampleA user can't log in after a holiday — the PC's clock drifted; syncing time fixes it.

What it isNetwork device monitoring: poll a switch or router for status, or receive an alert (Trap) from it.

Real-life exampleA monitoring system reports a switch port went down — that alert arrived as an SNMP Trap.

What it isA standard for shipping logs from devices to a central server / SIEM.

Real-life exampleAll switches send logs to one server, so you can see failed login attempts in a single place.

What it isThe protocol for sending email between servers and from client to server.

Real-life exampleA monitoring system emails an alert to the IT team — that was SMTP.

What it isReceiving mail: IMAP keeps messages on the server and syncs devices, POP3 downloads and deletes.

Real-life exampleThe same email shows on phone and PC — that's IMAP. It vanishes after download — that's POP3.

What it isFile transfer. FTP sends username and password in clear text — always prefer SFTP over SSH.

Real-life exampleYou upload a backup to a remote server via SFTP so nobody on the network sees the password.

What it isEncrypted command-line access to servers and network gear (Linux, switches, routers).

Real-life exampleAn admin connects to a switch with ssh admin@10.0.0.1 and configures a VLAN remotely.

What it isAn ancient, unencrypted ancestor of SSH. Everything, including the password, travels in clear text — disable it.

Real-life exampleAnyone sniffing the network sees the switch admin password in plain view — that's why SSH replaced it.

What it isFinds the MAC address that belongs to an IP address on the same local network.

Real-life exampleYour PC asks "who has 192.168.1.1?" and the router replies with its MAC. An attacker answering instead is ARP spoofing.

What it isThe network's service-message protocol — ping and traceroute are built on it.

Real-life exampleping dc01 shows whether the server is alive and how many milliseconds it takes to answer.

What it isReliable connection: a 3-way handshake, then confirmation that every packet arrived in order. Slower but safe.

Real-life exampleDownloading a file — you can't lose a single byte, so TCP is used.

What it isFast, fire-and-forget delivery with no acknowledgements. Quick, but packets can be lost.

Real-life exampleA video call: a glitchy frame beats a one-second delay — hence UDP.

What it isLogically splits one physical switch into several isolated networks.

Real-life exampleAccounting sits in VLAN 10 and guests in VLAN 20 — a guest can't reach the finance server.

What it isPrevents switching loops by temporarily blocking redundant links.

Real-life exampleTwo cables were accidentally patched between the same switches — STP blocks one and the network survives.

What it isA guard at the network jack: a device must authenticate before it gets any network access at all.

Real-life exampleA guest plugs a laptop into a wall port and gets nothing until they authenticate — or lands in a guest VLAN.

What it isA central authentication server for network access (Wi-Fi, VPN, 802.1X). In Microsoft land it's NPS, validating against AD.

Real-life exampleYou join corporate Wi-Fi with your domain account — NPS/RADIUS validates it against Active Directory.

What it isNAT translates a private address to a public one. PAT (NAT Overload) sends the whole network out through one address, using port numbers.

Real-life exampleThe whole office (172.31.0.0/16) reaches the internet via one public IP; the router tracks which port belongs to which host.

What it isA fixed 1:1 mapping between an inside and a public address — required for servers reachable from outside.

Real-life exampleInternal web server 172.19.0.10 is mapped to 209.165.200.5 so external users can reach it.

What it isDynamic routing protocol: routers exchange information and build the routing table themselves using Cost. Each has a Router-ID and an Area.

Real-life exampleAdd a new LAN3 network and every router learns it within seconds, with no manual entry.

What it isA manually configured route: "for network X, go via neighbour Y". Simple and stable but never updates itself. 0.0.0.0/0 is the default route.

Real-life exampleBetween two routers in LAN3 you add one static route instead of running a whole routing protocol.

What it isTwo routers share one virtual gateway address: one Active, one Standby. If the active one dies, the other takes over.

Real-life exampleUnplug Router3 and PC6 keeps browsing because Router4 became Active within seconds (failover).

What it isBundling several physical cables into one logical link: more bandwidth plus automatic redundancy. LACP is the standard, PAgP is Cisco's.

Real-life exampleThree cables between Switch5 and Switch7 become a single channel; losing one does not drop the link.

What it isA VLAN's virtual interface on an L3 switch (interface vlan 10) acting as its gateway. Without it VLANs cannot talk.

Real-life exampleVLAN10 (users) and VLAN20 (printers) each get an SVI, so a PC can finally print.

What it isTurns a broadcast DHCP request into a unicast toward a server in another VLAN. Without it remote clients get no address.

Real-life examplePCs in VLAN20 receive IPs from a DHCP server living in the LAN2 server farm.

What it isLimits which and how many MAC addresses are allowed on a switch port. In restrict mode a violation is dropped and logged.

Real-life exampleSomeone plugs a personal switch into an office jack — the port sees an extra MAC and blocks it instantly.

What it isA filtering rule list: who is allowed or denied, by address, protocol and port. Read top-down with an implicit deny at the end.

Real-life exampleAn ACL blocks VLAN10↔VLAN20 traffic but still allows HTTP and DNS toward the LAN2 servers.

What it isA wireless controller (WLC) manages all access points centrally; CAPWAP is the tunnel between AP and WLC.

Real-life exampleDefine one SSID on the WLC and every AP in the building broadcasts it, mapped to VLAN10.

What it isThe first diagnostic tools: ping checks whether the target answers, traceroute shows the path and where it stops.

Real-life exampleAn internal site fails: ping to the server works but traceroute stalls at a router — the problem is routing, not the server.

What it isThe query language of the corporate directory: how you ask AD who users are and which groups they belong to. LDAPS is the same thing over TLS.

Real-life exampleA business app asks AD: "is user dani in the HR group?" and gets a yes/no answer.

What it isTicket-based authentication: sign in once, get a ticket (TGT), then reach services without resending your password.

Real-life exampleYou log in in the morning, then open a file share later and are never prompted — the ticket did the work.

What it isMicrosoft's legacy authentication protocol. Kept for compatibility but vulnerable to Pass-the-Hash — prefer Kerberos.

Real-life exampleYou connect to a server by IP instead of by name — Kerberos can't be used, so the system falls back to NTLM.

What it isWindows file and printer sharing protocol. Group Policies also reach machines through the SYSVOL share over SMB.

Real-life exampleYou open \\fileserver\Shared in Explorer — that's SMB working under the hood.

What it isRemote Desktop: graphical control of another machine. A favourite attacker target — never expose it to the internet.

Real-life exampleAn admin connects from home to an office server and sees its screen as if sitting in front of it.

What it isCommand-line remote management: run PowerShell commands on another machine without a GUI.

Real-life exampleEnter-PSSession -ComputerName SRV01 and you're running commands on the server from your own PC.

What it isWindows' remote procedure call machinery. DC-to-DC replication, admin tools and DCSync all ride on it.

Real-life exampleWhen you open Active Directory Users and Computers, the console talks to the DC over RPC.

What it isA partial replica of every object in the forest — enables fast cross-domain lookups.

Real-life exampleOutlook finds a contact from another domain in the organisation instantly, thanks to the Global Catalog.

What it isLegacy name-resolution protocols used when DNS fails. An attacker answers instead of the real server and steals hashes — disable them.

Real-life exampleYou mistype a server name; the PC asks the whole network and an attacker running Responder replies "that's me" and harvests credentials.

What it isModern cloud identity protocols: sign in once (SSO) and reach many apps without further passwords.

Real-life exampleYou sign in to Microsoft 365 and then enter Zoom or Jira without typing a password again.