Instructor: UDP ports or user datagram protocol ports. 2 2
In this lesson, we are going to talk about all the UDP ports 3 3
because we just spent the last lesson 4 4
talking about all the TCP ports. 5 5
As a cybersecurity analyst, 6 6
you have to know UDP port numbers 7 7
for the registered ports 8 8
that are commonly scanned against, 9 9
just like the TCP ones. 10 10
Now, the only difference 11 11
between the TCP ports and the UDP ports 12 12
is what they're used for and UDP 13 13
is more of a fire and forget protocol. 14 14
There is no windowing that's going to occur. 15 15
There is no send and acknowledgement that occurs. 16 16
So when you deal with UDP, it's a fire and forget. 17 17
So just keep that in mind. 18 18
Now, the first one we're going to have is Port 53 19 19
which is DNS. 20 20
As I said, in the TCP lesson, Port 53 21 21
operates over TCP and UDP. 22 22
For TCP, it's used for zone transfers. 23 23
For UDP, it's used for DNS queries. 24 24
That's the only difference. 25 25
What is DNS being used for? 26 26
And based on that, it will pick one of the ports 27 27
and one of the protocols. 28 28
Next, we have Port 67, which is DHCPS. 29 29
This is a server port 30 30
for the Dynamic Host Configuration Protocol or DHCP. 31 31
The next port we have is Port 68, and this is DHCPC. 32 32
This is the client port 33 33
for the Dynamic Host Configuration Protocol or DHCP. 34 34
So if you're dealing with a server, Port 67, 35 35
if you're dealing with a client, Port 68. 36 36
And the next one we have is Port 69. 37 37
This is the Trivial File Transfer Protocol or TFTP. 38 38
This is used generally when you're dealing with routers 39 39
and switches and trying to send an iOS update 40 40
or things of that nature. 41 41
Next, we have Port 123, NTP, the Network Time Protocol. 42 42
This allows our devices to share time on the network 43 43
and make sure we're all using a centralized time source. 44 44
As we talked about back in Syslog, 45 45
this is very helpful in coordinating your logs. 46 46
Next we have Port 135, the MSRPC 47 47
Now, as we talked about with TCP 48 48
this advertises what RPC services are available 49 49
in a Windows environment. 50 50
It operates both as TCP and UDP, doing the same function. 51 51
The next port is 137, NetBIOS Name Service. 52 52
NetBIOS Name Service is going to support Windows file sharing 53 53
with pre Windows 2000 version hosts. 54 54
And so it is something that's there 55 55
for backwards compatibility, 56 56
very much like DNS, 57 57
except we're not dealing with IP addresses 58 58
and names across the internet. 59 59
Instead, we're dealing with NetBIOS Name Service. 60 60
So every Windows PC has a name. 61 61
For instance, Jason's PC. 62 62
NetBIOS allows me to have Jason's PC 63 63
and use that or my IP address 64 64
when talking across the network. 65 65
Port 138 is NetBIOS DGM. 66 66
This is the NetBIOS Datagram Service 67 67
and supports Windows file sharing 68 68
with pre Windows 2000 version hosts. 69 69
So because we're dealing with datagrams, 70 70
we're dealing with UDP here, right? 71 71
And so this is how we can send large chunks of data 72 72
across the network in a fire and forget format. 73 73
Next, we have Port 139, which is NetBIOS SSN. 74 74
This is NetBIOS Session Service Support 75 75
for Windows file sharing 76 76
with pre Windows 2000 version hosts again. 77 77
Now again, Port 139 was something we had both 78 78
on TCP and UDP using the same functionality. 79 79
The next port we have is 161, which is SNMP. 80 80
We talked about this one back in Syslog as well, 81 81
because we're going to use this as an agent port 82 82
for the Simple Network Management Protocol 83 83
to be able to send data 84 84
across our network about our different devices. 85 85
When we start dealing with Port 162, 86 86
we are dealing with SNMP again, 87 87
but this is the management station port 88 88
for receiving those SNMP trap messages. 89 89
So as a client sending out the information over the agent, 90 90
it's 161. 91 91
As the management station 92 92
who wants to receive those messages? 93 93
It's 162. 94 94
Our next port is 445, 95 95
and this one was one that we had both on TCP and UDP. 96 96
This is the Microsoft DS again, 97 97
it supports Windows file sharing 98 98
or server message block 99 99
over TCPIP on current Windows Networks. 100 100
Our next port is Port 500, or ISAKMP, I S A K M P. 101 101
Now is ISAKMP is the Internet Security Association 102 102
and Key Management Protocol 103 103
and it's used to set up IPsec tunnels. 104 104
So if you're using VPN using IPsec 105 105
you are going to be using Port 500 106 106
as part of that setup process. 107 107
The next one we have is SYSLOG, Port 514. 108 108
This is a server port for a sysLog daemon 109 109
and a SysLog Daemon just means a SysLog server. 110 110
So this allows us to have a Syslog server there 111 111
waiting and collecting information. 112 112
The next port that's important to know is Port 520. 113 113
This is RIP, R I P. 114 114
This is the Routing Information Protocol 115 115
and it's an older routing protocol that is used 116 116
across the networks and still heavily in use today 117 117
with lots of different systems. 118 118
Port 631 or IPP, this is the Internet Printing Protocol. 119 119
If you have an internet connected printer, 120 120
this will be using IPP. 121 121
The Internet Printing Protocol 122 122
is a specialized internet protocol for communication 123 123
between your client devices, your computers, 124 124
your smartphones, your tablets, and things like that, 125 125
and the printers that you want to print to. 126 126
This is heavily used inside Windows and Linux systems. 127 127
The next port is 1434. 128 128
Now 1434 is MS-SQL, 129 129
just like we talked about the MySQL servers, 130 130
Microsoft has their own version of a SQL server 131 131
and the Microsoft SQL server 132 132
will receive its queries and requests over Port 1434. 133 133
Port 1900 is UPNP. 134 134
UPNP is Universal Plug and Play. 135 135
This is used for auto configuration of port forwarding 136 136
by game consoles and other smart appliances. 137 137
Now, this is something that was opened up 138 138
in the last several years where devices 139 139
could basically self configure 140 140
and be able to just be plugged into a network 141 141
and open up ports as needed. 142 142
Because of this, this is an area of vulnerability 143 143
and something you should be looking at, 144 144
especially in a corporate network. 145 145
And our last port is 4500. 146 146
This is NAT-T-IKE. 147 147
Now, this is your Network Address Translation 148 148
to Internet Key Exchange. 149 149
This is used to set up an IPsec traversal 150 150
through a network address translation gateway. 151 151
And essentially, if you're using an IPsec overnet, 152 152
you're going to be using Port 4500 as well. 153 153
Now, just a quick exam tip. 154 154
As I said in the TCP lesson, the same thing applies. 155 155
They're not going to ask you what is Port 4500, 156 156
and you have to say, NAT-T-IKE. 157 157
But instead, you should be familiar that 158 158
when you see these ports, you know these are common ports. 159 159
These are things that people are scanning from. 160 160
These ports that we just covered in the last lesson, 161 161
in this lesson, 162 162
those 40 ports, 20 TCP, and 20 UDP, 163 163
are the 20 most scanned ports by end map across the world, 164 164
meaning attackers are looking for openings in these ports. 165 165
It also means these are the most important ports 166 166
for you as a defender to know, 167 167
because you want to look across your systems 168 168
and see if those are open. 169 169
And if they are open, 170 170
you want to figure out, do you need them to be open, 171 171
and if not, you should close them. 172 172
And if you do, how you can best defend them, 173 173
because they are things 174 174
that are on the radar of attackers 175 175
looking to get into your network.