1 1 00:00:00,510 --> 00:00:04,440 UDP ports or user datagram protocol ports. 2 2 00:00:04,440 --> 00:00:07,530 In this lesson, we are going to talk about all the UDP ports 3 3 00:00:07,530 --> 00:00:09,120 because we just spent the last lesson 4 4 00:00:09,120 --> 00:00:11,520 talking about all the TCP ports. 5 5 00:00:11,520 --> 00:00:12,780 As a cybersecurity analyst, 6 6 00:00:12,780 --> 00:00:14,820 you have to know UDP port numbers 7 7 00:00:14,820 --> 00:00:15,930 for the registered ports 8 8 00:00:15,930 --> 00:00:17,550 that are commonly scanned against, 9 9 00:00:17,550 --> 00:00:19,380 just like the TCP ones. 10 10 00:00:19,380 --> 00:00:20,213 Now, the only difference 11 11 00:00:20,213 --> 00:00:22,320 between the TCP ports and the UDP ports 12 12 00:00:22,320 --> 00:00:24,600 is what they're used for and UDP 13 13 00:00:24,600 --> 00:00:26,850 is more of a fire and forget protocol. 14 14 00:00:26,850 --> 00:00:28,710 There is no windowing that's going to occur. 15 15 00:00:28,710 --> 00:00:31,470 There is no send and acknowledgement that occurs. 16 16 00:00:31,470 --> 00:00:34,050 So when you deal with UDP, it's a fire and forget. 17 17 00:00:34,050 --> 00:00:35,610 So just keep that in mind. 18 18 00:00:35,610 --> 00:00:37,830 Now, the first one we're going to have is Port 53 19 19 00:00:37,830 --> 00:00:39,120 which is DNS. 20 20 00:00:39,120 --> 00:00:41,850 As I said, in the TCP lesson, Port 53 21 21 00:00:41,850 --> 00:00:44,640 operates over TCP and UDP. 22 22 00:00:44,640 --> 00:00:46,860 For TCP, it's used for zone transfers. 23 23 00:00:46,860 --> 00:00:49,560 For UDP, it's used for DNS queries. 24 24 00:00:49,560 --> 00:00:50,550 That's the only difference. 25 25 00:00:50,550 --> 00:00:52,140 What is DNS being used for? 26 26 00:00:52,140 --> 00:00:54,150 And based on that, it will pick one of the ports 27 27 00:00:54,150 --> 00:00:56,070 and one of the protocols. 28 28 00:00:56,070 --> 00:01:00,090 Next, we have Port 67, which is DHCPS. 29 29 00:01:00,090 --> 00:01:01,140 This is a server port 30 30 00:01:01,140 --> 00:01:04,920 for the Dynamic Host Configuration Protocol or DHCP. 31 31 00:01:04,920 --> 00:01:09,000 The next port we have is Port 68, and this is DHCPC. 32 32 00:01:09,000 --> 00:01:10,200 This is the client port 33 33 00:01:10,200 --> 00:01:13,620 for the Dynamic Host Configuration Protocol or DHCP. 34 34 00:01:13,620 --> 00:01:15,900 So if you're dealing with a server, Port 67, 35 35 00:01:15,900 --> 00:01:18,630 if you're dealing with a client, Port 68. 36 36 00:01:18,630 --> 00:01:20,820 And the next one we have is Port 69. 37 37 00:01:20,820 --> 00:01:25,440 This is the Trivial File Transfer Protocol or TFTP. 38 38 00:01:25,440 --> 00:01:27,690 This is used generally when you're dealing with routers 39 39 00:01:27,690 --> 00:01:30,090 and switches and trying to send an iOS update 40 40 00:01:30,090 --> 00:01:32,070 or things of that nature. 41 41 00:01:32,070 --> 00:01:37,070 Next, we have Port 123, NTP, the Network Time Protocol. 42 42 00:01:37,110 --> 00:01:39,900 This allows our devices to share time on the network 43 43 00:01:39,900 --> 00:01:42,870 and make sure we're all using a centralized time source. 44 44 00:01:42,870 --> 00:01:44,520 As we talked about back in Syslog, 45 45 00:01:44,520 --> 00:01:47,160 this is very helpful in coordinating your logs. 46 46 00:01:47,160 --> 00:01:49,840 Next we have Port 135, the MSRPC 47 47 00:01:51,180 --> 00:01:52,860 Now, as we talked about with TCP 48 48 00:01:52,860 --> 00:01:55,620 this advertises what RPC services are available 49 49 00:01:55,620 --> 00:01:57,060 in a Windows environment. 50 50 00:01:57,060 --> 00:02:01,530 It operates both as TCP and UDP, doing the same function. 51 51 00:02:01,530 --> 00:02:06,180 The next port is 137, NetBIOS Name Service. 52 52 00:02:06,180 --> 00:02:09,120 NetBIOS Name Service is going to support Windows file sharing 53 53 00:02:09,120 --> 00:02:11,127 with pre Windows 2000 version hosts. 54 54 00:02:11,127 --> 00:02:12,450 And so it is something that's there 55 55 00:02:12,450 --> 00:02:14,580 for backwards compatibility, 56 56 00:02:14,580 --> 00:02:16,110 very much like DNS, 57 57 00:02:16,110 --> 00:02:18,270 except we're not dealing with IP addresses 58 58 00:02:18,270 --> 00:02:20,160 and names across the internet. 59 59 00:02:20,160 --> 00:02:23,070 Instead, we're dealing with NetBIOS Name Service. 60 60 00:02:23,070 --> 00:02:25,080 So every Windows PC has a name. 61 61 00:02:25,080 --> 00:02:27,330 For instance, Jason's PC. 62 62 00:02:27,330 --> 00:02:29,700 NetBIOS allows me to have Jason's PC 63 63 00:02:29,700 --> 00:02:31,530 and use that or my IP address 64 64 00:02:31,530 --> 00:02:33,450 when talking across the network. 65 65 00:02:33,450 --> 00:02:36,600 Port 138 is NetBIOS DGM. 66 66 00:02:36,600 --> 00:02:38,910 This is the NetBIOS Datagram Service 67 67 00:02:38,910 --> 00:02:40,590 and supports Windows file sharing 68 68 00:02:40,590 --> 00:02:43,170 with pre Windows 2000 version hosts. 69 69 00:02:43,170 --> 00:02:44,850 So because we're dealing with datagrams, 70 70 00:02:44,850 --> 00:02:46,710 we're dealing with UDP here, right? 71 71 00:02:46,710 --> 00:02:48,960 And so this is how we can send large chunks of data 72 72 00:02:48,960 --> 00:02:52,500 across the network in a fire and forget format. 73 73 00:02:52,500 --> 00:02:56,670 Next, we have Port 139, which is NetBIOS SSN. 74 74 00:02:56,670 --> 00:02:59,340 This is NetBIOS Session Service Support 75 75 00:02:59,340 --> 00:03:00,510 for Windows file sharing 76 76 00:03:00,510 --> 00:03:03,060 with pre Windows 2000 version hosts again. 77 77 00:03:03,060 --> 00:03:05,910 Now again, Port 139 was something we had both 78 78 00:03:05,910 --> 00:03:09,936 on TCP and UDP using the same functionality. 79 79 00:03:09,936 --> 00:03:14,400 The next port we have is 161, which is SNMP. 80 80 00:03:14,400 --> 00:03:17,010 We talked about this one back in Syslog as well, 81 81 00:03:17,010 --> 00:03:19,170 because we're going to use this as an agent port 82 82 00:03:19,170 --> 00:03:21,060 for the Simple Network Management Protocol 83 83 00:03:21,060 --> 00:03:22,170 to be able to send data 84 84 00:03:22,170 --> 00:03:25,530 across our network about our different devices. 85 85 00:03:25,530 --> 00:03:28,053 When we start dealing with Port 162, 86 86 00:03:28,053 --> 00:03:29,370 we are dealing with SNMP again, 87 87 00:03:29,370 --> 00:03:31,230 but this is the management station port 88 88 00:03:31,230 --> 00:03:33,990 for receiving those SNMP trap messages. 89 89 00:03:33,990 --> 00:03:36,840 So as a client sending out the information over the agent, 90 90 00:03:36,840 --> 00:03:38,130 it's 161. 91 91 00:03:38,130 --> 00:03:39,270 As the management station 92 92 00:03:39,270 --> 00:03:40,800 who wants to receive those messages? 93 93 00:03:40,800 --> 00:03:41,913 It's 162. 94 94 00:03:42,870 --> 00:03:44,910 Our next port is 445, 95 95 00:03:44,910 --> 00:03:48,240 and this one was one that we had both on TCP and UDP. 96 96 00:03:48,240 --> 00:03:50,250 This is the Microsoft DS again, 97 97 00:03:50,250 --> 00:03:51,930 it supports Windows file sharing 98 98 00:03:51,930 --> 00:03:53,220 or server message block 99 99 00:03:53,220 --> 00:03:56,640 over TCPIP on current Windows Networks. 100 100 00:03:56,640 --> 00:04:01,640 Our next port is Port 500, or ISAKMP, I S A K M P. 101 101 00:04:02,100 --> 00:04:04,860 Now is ISAKMP is the Internet Security Association 102 102 00:04:04,860 --> 00:04:06,450 and Key Management Protocol 103 103 00:04:06,450 --> 00:04:08,730 and it's used to set up IPsec tunnels. 104 104 00:04:08,730 --> 00:04:11,010 So if you're using VPN using IPsec 105 105 00:04:11,010 --> 00:04:12,690 you are going to be using Port 500 106 106 00:04:12,690 --> 00:04:14,880 as part of that setup process. 107 107 00:04:14,880 --> 00:04:18,840 The next one we have is SYSLOG, Port 514. 108 108 00:04:18,840 --> 00:04:21,450 This is a server port for a sysLog daemon 109 109 00:04:21,450 --> 00:04:24,210 and a SysLog Daemon just means a SysLog server. 110 110 00:04:24,210 --> 00:04:26,100 So this allows us to have a Syslog server there 111 111 00:04:26,100 --> 00:04:28,560 waiting and collecting information. 112 112 00:04:28,560 --> 00:04:31,650 The next port that's important to know is Port 520. 113 113 00:04:31,650 --> 00:04:33,630 This is RIP, R I P. 114 114 00:04:33,630 --> 00:04:35,940 This is the Routing Information Protocol 115 115 00:04:35,940 --> 00:04:38,220 and it's an older routing protocol that is used 116 116 00:04:38,220 --> 00:04:40,620 across the networks and still heavily in use today 117 117 00:04:40,620 --> 00:04:42,780 with lots of different systems. 118 118 00:04:42,780 --> 00:04:47,640 Port 631 or IPP, this is the Internet Printing Protocol. 119 119 00:04:47,640 --> 00:04:49,710 If you have an internet connected printer, 120 120 00:04:49,710 --> 00:04:51,630 this will be using IPP. 121 121 00:04:51,630 --> 00:04:52,800 The Internet Printing Protocol 122 122 00:04:52,800 --> 00:04:55,470 is a specialized internet protocol for communication 123 123 00:04:55,470 --> 00:04:57,450 between your client devices, your computers, 124 124 00:04:57,450 --> 00:04:59,640 your smartphones, your tablets, and things like that, 125 125 00:04:59,640 --> 00:05:01,740 and the printers that you want to print to. 126 126 00:05:01,740 --> 00:05:04,980 This is heavily used inside Windows and Linux systems. 127 127 00:05:04,980 --> 00:05:07,680 The next port is 1434. 128 128 00:05:07,680 --> 00:05:10,710 Now 1434 is MS-SQL, 129 129 00:05:10,710 --> 00:05:13,320 just like we talked about the MySQL servers, 130 130 00:05:13,320 --> 00:05:16,020 Microsoft has their own version of a SQL server 131 131 00:05:16,020 --> 00:05:17,490 and the Microsoft SQL server 132 132 00:05:17,490 --> 00:05:21,780 will receive its queries and requests over Port 1434. 133 133 00:05:21,780 --> 00:05:24,510 Port 1900 is UPNP. 134 134 00:05:24,510 --> 00:05:27,150 UPNP is Universal Plug and Play. 135 135 00:05:27,150 --> 00:05:29,670 This is used for auto configuration of port forwarding 136 136 00:05:29,670 --> 00:05:32,700 by game consoles and other smart appliances. 137 137 00:05:32,700 --> 00:05:34,080 Now, this is something that was opened up 138 138 00:05:34,080 --> 00:05:35,940 in the last several years where devices 139 139 00:05:35,940 --> 00:05:37,680 could basically self configure 140 140 00:05:37,680 --> 00:05:39,360 and be able to just be plugged into a network 141 141 00:05:39,360 --> 00:05:41,370 and open up ports as needed. 142 142 00:05:41,370 --> 00:05:43,620 Because of this, this is an area of vulnerability 143 143 00:05:43,620 --> 00:05:45,000 and something you should be looking at, 144 144 00:05:45,000 --> 00:05:47,190 especially in a corporate network. 145 145 00:05:47,190 --> 00:05:49,680 And our last port is 4500. 146 146 00:05:49,680 --> 00:05:52,230 This is NAT-T-IKE. 147 147 00:05:52,230 --> 00:05:54,900 Now, this is your Network Address Translation 148 148 00:05:54,900 --> 00:05:56,790 to Internet Key Exchange. 149 149 00:05:56,790 --> 00:05:59,460 This is used to set up an IPsec traversal 150 150 00:05:59,460 --> 00:06:02,070 through a network address translation gateway. 151 151 00:06:02,070 --> 00:06:05,040 And essentially, if you're using an IPsec overnet, 152 152 00:06:05,040 --> 00:06:08,040 you're going to be using Port 4500 as well. 153 153 00:06:08,040 --> 00:06:09,690 Now, just a quick exam tip. 154 154 00:06:09,690 --> 00:06:12,810 As I said in the TCP lesson, the same thing applies. 155 155 00:06:12,810 --> 00:06:15,720 They're not going to ask you what is Port 4500, 156 156 00:06:15,720 --> 00:06:17,730 and you have to say, NAT-T-IKE. 157 157 00:06:17,730 --> 00:06:19,500 But instead, you should be familiar that 158 158 00:06:19,500 --> 00:06:22,680 when you see these ports, you know these are common ports. 159 159 00:06:22,680 --> 00:06:24,990 These are things that people are scanning from. 160 160 00:06:24,990 --> 00:06:27,360 These ports that we just covered in the last lesson, 161 161 00:06:27,360 --> 00:06:28,193 in this lesson, 162 162 00:06:28,193 --> 00:06:31,110 those 40 ports, 20 TCP, and 20 UDP, 163 163 00:06:31,110 --> 00:06:35,670 are the 20 most scanned ports by end map across the world, 164 164 00:06:35,670 --> 00:06:39,420 meaning attackers are looking for openings in these ports. 165 165 00:06:39,420 --> 00:06:41,790 It also means these are the most important ports 166 166 00:06:41,790 --> 00:06:43,590 for you as a defender to know, 167 167 00:06:43,590 --> 00:06:45,090 because you want to look across your systems 168 168 00:06:45,090 --> 00:06:46,920 and see if those are open. 169 169 00:06:46,920 --> 00:06:48,180 And if they are open, 170 170 00:06:48,180 --> 00:06:50,580 you want to figure out, do you need them to be open, 171 171 00:06:50,580 --> 00:06:52,500 and if not, you should close them. 172 172 00:06:52,500 --> 00:06:55,110 And if you do, how you can best defend them, 173 173 00:06:55,110 --> 00:06:56,070 because they are things 174 174 00:06:56,070 --> 00:06:57,690 that are on the radar of attackers 175 175 00:06:57,690 --> 00:06:59,340 looking to get into your network.