Application
- Data unit
- Data
- Addressing
- Name / URL
- Devices
- Servers, apps, proxies
- Examples
- HTTP, HTTPS, DNS, DHCP, SMTP, LDAP, SMB, RDP
- What to check when it breaks
- Is the service itself answering? nslookup, curl, app login
Quick tables — OSI, ports and protocols
A quick glance instead of reading: opens as a slide-out panel.
OSI / ISO model
7 layers: data unit, devices, addressing and what to check
Presentation
- Data unit
- Data
- Addressing
- —
- Devices
- Crypto libraries, TLS
- Examples
- TLS/SSL, JPEG, ASCII, JSON
- What to check when it breaks
- Expired cert? Name mismatch? Supported ciphers?
Session
- Data unit
- Data
- Addressing
- Session ID
- Devices
- OS, auth services
- Examples
- NetBIOS, RPC, Kerberos ticket session
- What to check when it breaks
- Session drops? Timeout? Expired Kerberos ticket?
Transport
- Data unit
- Segment
- Addressing
- Port
- Devices
- Firewall, load balancer
- Examples
- TCP, UDP
- What to check when it breaks
- Is the port open? Test-NetConnection, telnet host port
Network
- Data unit
- Packet
- Addressing
- IP address
- Devices
- Router, L3 switch
- Examples
- IPv4, IPv6, ICMP, OSPF, NAT
- What to check when it breaks
- ping the gateway, tracert, check routing table
Data Link
- Data unit
- Frame
- Addressing
- MAC address
- Devices
- Switch, NIC
- Examples
- Ethernet, ARP, VLAN 802.1Q, STP, PPP
- What to check when it breaks
- arp -a, correct VLAN on the port? show mac address-table
Physical
- Data unit
- Bits
- Addressing
- —
- Devices
- Cable, hub, SFP, antenna
- Examples
- Ethernet cable, Fiber, Wi-Fi radio
- What to check when it breaks
- Link light on? Cable plugged? show interface status
Ports and protocols table
Name, port, layer, what it does and who needs it
| Protocol | Port | OSI | What it does | Role |
|---|---|---|---|---|
| CAPWAP (WLC + AP) | 5246, 5247 / UDP | L7 | A wireless controller (WLC) manages all access points centrally; CAPWAP is the tunnel between AP and WLC. | Helpdesk, NOC |
| DHCP | 67, 68 / UDP | L7 | Automatically hands out IP addresses on the network (the DORA process: Discover, Offer, Request, Ack). | Helpdesk, NOC |
| DNS | 53 / UDP,TCP | L7 | Name service: turns a name (dc01.corp.local) into an IP address. Without healthy DNS, Active Directory simply does not work. | Helpdesk, NOC, SOC |
| FTP / SFTP | 21 / 22 | L7 | File transfer. FTP sends username and password in clear text — always prefer SFTP over SSH. | Helpdesk, SOC |
| Global Catalog | 3268 / 3269 (TLS) | L7 | A partial replica of every object in the forest — enables fast cross-domain lookups. | Helpdesk, SOC |
| HTTP / HTTPS | 80 / 443 / TCP | L7 | The browser protocol. HTTPS adds TLS encryption so nobody in the middle can read the content. | Helpdesk, NOC, SOC |
| IMAP / POP3 | 143/993, 110/995 | L7 | Receiving mail: IMAP keeps messages on the server and syncs devices, POP3 downloads and deletes. | Helpdesk |
| LDAP / LDAPS | 389 / 636 (TLS) | L7 | The query language of the corporate directory: how you ask AD who users are and which groups they belong to. LDAPS is the same thing over TLS. | Helpdesk, SOC |
| LLMNR / NBT-NS | 5355 / 137 | L7 | Legacy name-resolution protocols used when DNS fails. An attacker answers instead of the real server and steals hashes — disable them. | SOC |
| NTP | 123 / UDP | L7 | Clock synchronisation. In AD, a gap of more than 5 minutes between a client and a DC breaks Kerberos entirely. | NOC, SOC |
| RADIUS | 1812, 1813 / UDP | L7 | A central authentication server for network access (Wi-Fi, VPN, 802.1X). In Microsoft land it's NPS, validating against AD. | Helpdesk, SOC |
| RDP | 3389 / TCP | L7 | Remote Desktop: graphical control of another machine. A favourite attacker target — never expose it to the internet. | Helpdesk, SOC |
| SAML / OAuth 2.0 / OIDC | מעל HTTPS | L7 | Modern cloud identity protocols: sign in once (SSO) and reach many apps without further passwords. | SOC |
| SMB / CIFS | 445 / TCP | L7 | Windows file and printer sharing protocol. Group Policies also reach machines through the SYSVOL share over SMB. | Helpdesk, SOC |
| SMTP | 25 / 587 / TCP | L7 | The protocol for sending email between servers and from client to server. | Helpdesk, SOC |
| SNMP | 161, 162 / UDP | L7 | Network device monitoring: poll a switch or router for status, or receive an alert (Trap) from it. | NOC |
| SSH | 22 / TCP | L7 | Encrypted command-line access to servers and network gear (Linux, switches, routers). | NOC, SOC |
| Syslog | 514 / UDP | L7 | A standard for shipping logs from devices to a central server / SIEM. | NOC, SOC |
| Telnet | 23 / TCP | L7 | An ancient, unencrypted ancestor of SSH. Everything, including the password, travels in clear text — disable it. | NOC, SOC |
| WinRM / PowerShell Remoting | 5985 / 5986 (HTTPS) | L7 | Command-line remote management: run PowerShell commands on another machine without a GUI. | Helpdesk, SOC |
| TLS / SSL | נלווה לפרוטוקולים אחרים | L6 | The encryption layer that wraps other protocols (HTTPS, LDAPS, SMTPS) and proves the server's identity with a certificate. | Helpdesk, SOC |
| Kerberos | 88 / UDP,TCP | L5 | Ticket-based authentication: sign in once, get a ticket (TGT), then reach services without resending your password. | Helpdesk, SOC |
| MSRPC / DCERPC | 135 + פורטים דינמיים | L5 | Windows' remote procedure call machinery. DC-to-DC replication, admin tools and DCSync all ride on it. | SOC |
| NTLM | עובד מעל SMB/445 | L5 | Microsoft's legacy authentication protocol. Kept for compatibility but vulnerable to Pass-the-Hash — prefer Kerberos. | SOC |
| TCP | שכבה 4 | L4 | Reliable connection: a 3-way handshake, then confirmation that every packet arrived in order. Slower but safe. | Helpdesk, NOC, SOC |
| UDP | שכבה 4 | L4 | Fast, fire-and-forget delivery with no acknowledgements. Quick, but packets can be lost. | Helpdesk, NOC, SOC |
| ACL | — | L3 | A filtering rule list: who is allowed or denied, by address, protocol and port. Read top-down with an implicit deny at the end. | NOC, SOC |
| DHCP Relay (ip helper-address) | 67 / UDP | L3 | Turns a broadcast DHCP request into a unicast toward a server in another VLAN. Without it remote clients get no address. | Helpdesk, NOC |
| HSRP / VRRP | — | L3 | Two routers share one virtual gateway address: one Active, one Standby. If the active one dies, the other takes over. | NOC |
| ICMP | שכבה 3 | L3 | The network's service-message protocol — ping and traceroute are built on it. | Helpdesk, NOC |
| NAT / PAT | — | L3 | NAT translates a private address to a public one. PAT (NAT Overload) sends the whole network out through one address, using port numbers. | NOC |
| OSPF | AD 110 | L3 | Dynamic routing protocol: routers exchange information and build the routing table themselves using Cost. Each has a Router-ID and an Area. | NOC |
| Static NAT | — | L3 | A fixed 1:1 mapping between an inside and a public address — required for servers reachable from outside. | NOC |
| Static Route | AD 1 | L3 | A manually configured route: "for network X, go via neighbour Y". Simple and stable but never updates itself. 0.0.0.0/0 is the default route. | NOC |
| SVI / Inter-VLAN Routing | — | L3 | A VLAN's virtual interface on an L3 switch (interface vlan 10) acting as its gateway. Without it VLANs cannot talk. | NOC |
| Traceroute / Ping | ICMP | L3 | The first diagnostic tools: ping checks whether the target answers, traceroute shows the path and where it stops. | Helpdesk, NOC |
| 802.1X | שכבה 2 / NAC | L2 | A guard at the network jack: a device must authenticate before it gets any network access at all. | Helpdesk, SOC |
| ARP | שכבה 2 | L2 | Finds the MAC address that belongs to an IP address on the same local network. | Helpdesk, NOC, SOC |
| EtherChannel (LACP / PAgP) | — | L2 | Bundling several physical cables into one logical link: more bandwidth plus automatic redundancy. LACP is the standard, PAgP is Cisco's. | NOC |
| Port Security | — | L2 | Limits which and how many MAC addresses are allowed on a switch port. In restrict mode a violation is dropped and logged. | SOC, NOC |
| STP | שכבה 2 | L2 | Prevents switching loops by temporarily blocking redundant links. | NOC |
| VLAN (802.1Q) | שכבה 2 | L2 | Logically splits one physical switch into several isolated networks. | Helpdesk, NOC |