Protocols — Set 1

Correct Answer: D. FTP

• **FTP (File Transfer Protocol)** = A dedicated application-layer protocol designed exclusively for transferring files between a client and a server over a TCP/IP network. It uses Port 21 for control commands and Port 20 for actual data transfer, making it a dual-channel protocol. • **Key fact** — FTP supports two transfer modes: ASCII mode for text files and Binary mode for images, executables, and compressed files; choosing the wrong mode corrupts the file. • FTP can operate in Active mode (server initiates data connection back to client) or Passive mode (client opens both connections), with Passive mode preferred through firewalls. • 💡 Option A (HTTP) is wrong because HTTP is designed for web page retrieval, not dedicated file transfer; Option B (SNMP) is wrong because SNMP is used for network device management and monitoring; Option C (SMTP) is wrong because SMTP is used only for sending email messages between mail servers.

Correct Answer: D. HTTPS

• **HTTPS (HyperText Transfer Protocol Secure)** = The encrypted version of HTTP that uses SSL/TLS to create a secure tunnel between a browser and a web server, preventing eavesdropping and tampering. It is identified by a padlock icon in the browser's address bar and operates on Port 443. • **Key fact** — HTTPS relies on X.509 digital certificates issued by trusted Certificate Authorities (CAs) such as DigiCert or Let's Encrypt to verify the server's identity and establish the encrypted session. • Since 2018, Google Chrome marks all HTTP-only sites as 'Not Secure', making HTTPS adoption near-universal; HTTP/2 and HTTP/3 also require HTTPS to function. • 💡 Option A (TELNET) is wrong because TELNET is an unencrypted remote login protocol, not a web security protocol; Option B (UDP) is wrong because UDP is a transport-layer protocol with no encryption capability; Option C (ARP) is wrong because ARP resolves IP addresses to MAC addresses and has nothing to do with web security.

Correct Answer: D. IP

• **IP (Internet Protocol)** = The network-layer protocol in the TCP/IP model responsible for assigning logical addresses to devices and routing data packets from source to destination across interconnected networks. Without IP addressing, routers cannot forward packets between different networks. • **Key fact** — IPv4 uses 32-bit addresses (e.g., 192.168.1.1) supporting about 4.3 billion addresses, while IPv6 uses 128-bit addresses supporting 3.4 × 10³⁸ addresses, introduced to solve IPv4 exhaustion. • IP is a connectionless, best-effort protocol — it does not guarantee delivery or order; reliability is handled by upper-layer protocols like TCP. • 💡 Option A (TCP) is wrong because TCP operates at the Transport Layer and handles reliable data delivery, not logical addressing and routing; Option B (ICMP) is wrong because ICMP is used for sending error messages and diagnostics, not addressing; Option C (MAC) is wrong because MAC is a physical/data-link layer address, not a network-layer routing protocol.

Correct Answer: A. SMTP

• **SMTP (Simple Mail Transfer Protocol)** = The standard application-layer protocol used by mail clients and servers to send outgoing email messages. It operates on Port 25 (server-to-server), Port 587 (client-to-server submission with authentication), and Port 465 (SMTPS with SSL). • **Key fact** — SMTP uses a store-and-forward mechanism: it passes the email through a series of Mail Transfer Agents (MTAs) one hop at a time until the message reaches the recipient's mail server. • SMTP only handles sending; it cannot retrieve or store emails — that role belongs to POP3 (Port 110) and IMAP (Port 143), which are incoming mail retrieval protocols. • 💡 Option B (IMAP) is wrong because IMAP is used to retrieve and manage emails stored on the server, not to send them; Option C (DHCP) is wrong because DHCP automatically assigns IP addresses to network devices, not related to email; Option D (POP3) is wrong because POP3 is used to download emails from a server to a local device, not to send emails.

Correct Answer: D. DHCP

• **DHCP (Dynamic Host Configuration Protocol)** = A network management protocol that automatically assigns IP addresses, subnet masks, default gateways, and DNS server addresses to devices joining a network, eliminating the need for manual static configuration. It operates on UDP Ports 67 (server) and 68 (client). • **Key fact** — DHCP works via a four-step DORA process: Discover (client broadcasts), Offer (server proposes an IP), Request (client accepts), and Acknowledge (server confirms the lease). • The DHCP lease has a time limit (e.g., 24 hours); when the lease expires, the device must renew it or obtain a new IP, which is why the same device may get a different IP on reconnection. • 💡 Option A (DNS) is wrong because DNS translates domain names to IP addresses but does not assign IPs to devices; Option B (ICMP) is wrong because ICMP sends error and diagnostic messages between network devices; Option C (SSH) is wrong because SSH provides encrypted remote login access to computers, not IP address assignment.

Correct Answer: D. DNS

• **DNS (Domain Name System)** = A hierarchical distributed naming system that translates human-readable domain names (like www.google.com) into machine-readable IP addresses (like 142.250.195.68), allowing users to access websites without memorising numeric addresses. It operates on Port 53 using both UDP and TCP. • **Key fact** — DNS resolution follows a hierarchy: Root Servers → Top-Level Domain (TLD) servers (e.g., .com, .in) → Authoritative Name Servers → Local Resolver cache, with the entire lookup typically completing in under 100 milliseconds. • DNS was designed in 1983 by Paul Mockapetris; there are 13 sets of root name servers (labelled A through M) distributed globally, managed by organisations like ICANN. • 💡 Option A (TELNET) is wrong because TELNET provides remote terminal access, not name-to-IP translation; Option B (FTP) is wrong because FTP transfers files between client and server over a network; Option C (BGP) is wrong because BGP is a routing protocol used to exchange routing information between autonomous systems on the internet.

Correct Answer: D. TCP

• **TCP (Transmission Control Protocol)** = A connection-oriented Transport Layer protocol that guarantees reliable, ordered, and error-checked delivery of data between applications. Before transmitting data, TCP performs a Three-Way Handshake (SYN → SYN-ACK → ACK) to establish the connection. • **Key fact** — TCP uses sequence numbers and acknowledgement numbers to track every byte of data; if a packet is lost or corrupted, the receiver does not send an ACK, prompting the sender to automatically retransmit that specific segment. • TCP also implements flow control (via sliding window) and congestion control (via algorithms like Slow Start and AIMD) to prevent network overload, making it suitable for file transfer, email, and web browsing. • 💡 Option A (UDP) is wrong because UDP is a connectionless protocol with no guaranteed delivery or error correction; Option B (Ethernet) is wrong because Ethernet operates at the Data Link and Physical layers, not the Transport layer; Option C (IP) is wrong because IP is a Network Layer protocol responsible for addressing and routing, not reliable data delivery.

Correct Answer: A. SSH

• **SSH (Secure Shell)** = A cryptographic network protocol that enables secure remote login and command execution on another computer over an unsecured network, replacing the insecure Telnet protocol. SSH operates on Port 22 and uses public-key cryptography to authenticate the remote computer and the user. • **Key fact** — SSH was developed by Tatu Ylönen in 1995 after a password-sniffing attack at his university; SSH-2, released in 2006, is the current standard and includes stronger encryption algorithms like AES and key exchange via Diffie-Hellman. • Beyond remote login, SSH is also used for Secure File Transfer (SFTP), port forwarding, and tunnelling other protocols through its encrypted channel. • 💡 Option B (SNMP) is wrong because SNMP is used to monitor and manage network devices like routers and switches, not for remote terminal login; Option C (HTTP) is wrong because HTTP is the protocol for transferring web pages between browsers and servers; Option D (TELNET) is wrong because TELNET provides remote access but transmits all data including passwords in plain text with no encryption.

Correct Answer: D. ARP

• **ARP (Address Resolution Protocol)** = A network protocol that maps a known IP address (Layer 3) to its corresponding MAC address (Layer 2), which is essential for delivering data within a local area network. When a device needs to communicate, it broadcasts an ARP request asking 'Who has IP X? Tell me your MAC address.' • **Key fact** — ARP replies are cached in an ARP table (ARP cache) for a limited time (typically 20 minutes on Windows, 60 seconds on Linux), reducing the need for repeated broadcasts and speeding up local network communication. • ARP is vulnerable to 'ARP Spoofing' (ARP Poisoning) attacks, where a malicious device sends fake ARP replies to redirect traffic through itself — a common man-in-the-middle attack vector on LANs. • 💡 Option A (RARP) is wrong because RARP does the opposite — it finds an IP address from a known MAC address (used by old diskless workstations); Option B (DNS) is wrong because DNS resolves domain names to IP addresses, not IP addresses to MAC addresses; Option C (DHCP) is wrong because DHCP assigns IP addresses to devices dynamically, it does not resolve MAC addresses.

Correct Answer: D. ICMP

• **ICMP (Internet Control Message Protocol)** = A supporting protocol in the TCP/IP suite used by network devices to send error messages and operational information, such as when a requested service is unavailable or a host cannot be reached. It is defined in RFC 792 and operates at the Network Layer alongside IP. • **Key fact** — ICMP is the backbone of two essential network diagnostic tools: 'ping' (uses ICMP Echo Request and Echo Reply to test reachability) and 'traceroute/tracert' (uses ICMP Time Exceeded messages to map the route a packet takes across networks). • ICMP does not carry user application data and does not use port numbers; it is encapsulated directly within IP packets and is considered part of IP itself, not a separate application-layer protocol. • 💡 Option A (UDP) is wrong because UDP is a transport-layer protocol used for sending application data, not for network error reporting; Option B (SMTP) is wrong because SMTP is used for sending email messages between mail servers; Option C (POP3) is wrong because POP3 is used by email clients to retrieve messages from a server.