A settlement network runs a short list of protocols: IP to carry packets between networks, TCP or UDP above it to reach one particular program by port number, and application protocols on top for names, addresses, web pages, mail and shared files. Bring up name lookup and automatic addressing first, because everything else depends on them, and then add the web, file and mail services one at a time. Every service listens on a port, and knowing the port is how you test the service, allow it through a firewall and find it when it breaks.
Part of Networking
The set of protocols a settlement network actually uses, how they depend on each other, and the order in which to bring them up.
A Handful Of Protocols Cover Everything A Settlement Needs
Protocols already explains the stack: a link layer between neighbours, IP for best-effort delivery across networks, TCP for a reliable ordered byte stream, UDP for simple datagrams, and application protocols (HTTP, SMTP, DNS, SSH) above. Packet Structure covers the IP header. This article does not repeat them; it lists which ones to run in a settlement, which transport and port each uses, and what depends on what.
| Service | Transport | Port | Where the port comes from |
|---|---|---|---|
| Name lookup (DNS) | UDP for queries | 53 | Network Addressing |
| Web (HTTP) | TCP | 80 | Network Addressing |
| Web, encrypted (HTTPS) | TCP | 443 | Network Addressing |
| Remote login (SSH) | TCP | 22 | Network Addressing |
| Mail sending (SMTP) | TCP | 25 | Network Addressing |
| Mail retrieval, older (POP3) | TCP | 110 | Network Addressing |
| File transfer (FTP) | TCP | 21 control, 20 data | Network Addressing |
| Mail retrieval (IMAP) | TCP | 143 | general knowledge |
| Automatic addressing (DHCP) | UDP | 67 server, 68 client | general knowledge |
| Time (NTP) | UDP | 123 | general knowledge |
The last three rows are from general knowledge, not from the other articles; look up the port in the manual of the software you install.
What Depends On What
- Addresses (IP Addressing) before anything else
- Automatic addressing (DHCP) hands out the address and tells each machine where the name server is
- Names (DNS) so that people and mail servers use names, not numbers
- Time — Resource Sharing points out that certificates have expiry times and that log entries from several machines are useless if their clocks disagree, so one machine should keep the time for the rest
- The services people want — web (HTTP, Web Server), mail (Mail Server), files (File Sharing)
- The transports under them — TCP Protocol and UDP Protocol
What You Need
- A working network at the address level — ping between machines first
- One server machine to start with (Server Deployment)
Method: Bring The Protocols Up In Order
Step 1: Prove that IP works Ping the router and a machine on another subnet (OSI Model explains why you test from the bottom).
Step 2: Start the name and address servers Then check that a new machine gets an address and can look up a name.
Step 3: Add one service at a time After each, connect from another machine, as that is the test that matters.
Step 4: Record the listening ports
The carrier Internet Infrastructure recommends listing what is running with netstat -tlnp and shutting down anything unexpected.
Worked Example: A Server’s Open Doors
A server runs remote login, DNS, the web and mail sending, so four ports should be listening: 22, 53, 80 and 25. These are the four the carrier’s firewall list allows, plus ping. If the listing shows any port beyond them, such as a fifth that nobody installed, that is a service to explain or remove. The count is the whole check: ports listening should equal ports you meant to open.
Common Mistakes
- Starting with the web server — without names and addresses it works only by number
- Trusting a port number to prove the service — a program can listen on any port; check what is listening
- Leaving a service on because it might be needed — the carrier says an unused service is an unmonitored attack surface
What’s Next
- Learn next: TCP Protocol — the transport under most services
- Combine with: Network Security — deciding which ports to leave open