Layer 7 - User-facing services and protocols
What You'll Learn#
- Understand HTTP and web communication
- Learn how DNS resolves names
- Know email protocols (SMTP, POP3, IMAP)
- Master file transfer (FTP) and remote access
1. Application Layer Protocols#
| Protocol | Port | Purpose |
|---|
| HTTP/HTTPS | 80/443 | Web browsing |
| DNS | 53 | Name resolution |
| FTP | 20/21 | File transfer |
| SMTP | 25 | Send email |
| POP3 | 110 | Receive email |
| IMAP | 143 | Receive email (sync) |
| SSH | 22 | Secure remote access |
| Telnet | 23 | Remote access (insecure) |
| DHCP | 67/68 | IP address assignment |
2. HTTP (HyperText Transfer Protocol)#
HTTP Request/Response#
Request:
GET /index.html HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0
Accept: text/html
Response:
HTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 1234
<html>...</html>
HTTP Methods#
| Method | Purpose | Safe | Idempotent |
|---|
| GET | Retrieve resource | Yes | Yes |
| POST | Submit data | No | No |
| PUT | Update/Create | No | Yes |
| DELETE | Remove resource | No | Yes |
| HEAD | Get headers only | Yes | Yes |
HTTP Status Codes#
1xx - Informational
2xx - Success (200 OK, 201 Created)
3xx - Redirection (301 Moved, 302 Found)
4xx - Client Error (400 Bad Request, 404 Not Found)
5xx - Server Error (500 Internal Error, 503 Unavailable)
HTTP vs HTTPS#
| HTTP | HTTPS |
|---|
| Port 80 | Port 443 |
| Unencrypted | TLS/SSL encrypted |
| Fast | Slightly slower |
| Insecure | Secure |
3. DNS (Domain Name System)#
Translates domain names to IP addresses
www.google.com → 142.250.190.14
DNS Hierarchy#
Root DNS (.)
|
┌───────────────┼───────────────┐
| | |
.com .org .edu
|
google.com
|
www.google.com
DNS Resolution Process#
1. User types www.google.com
2. Check local DNS cache
3. Query Recursive DNS resolver
4. Resolver queries Root server → .com TLD → google.com authoritative
5. Get IP address
6. Cache the result
7. Return to browser
DNS Record Types#
| Type | Purpose | Example |
|---|
| A | IPv4 address | example.com → 93.184.216.34 |
| AAAA | IPv6 address | example.com → 2606:2800:... |
| CNAME | Alias | www.example.com → example.com |
| MX | Mail server | example.com → mail.example.com |
| NS | Name server | example.com → ns1.example.com |
| TXT | Text record | verification, SPF |
4. Email Protocols#
SMTP (Simple Mail Transfer Protocol)#
Used for SENDING email (Port 25)
Client Server
|
|<
|
|<
|
|<
|
|<
|
|
|
|<
|
POP3 vs IMAP#
| POP3 | IMAP |
|---|
| Port 110 | Port 143 |
| Downloads and deletes | Keeps on server |
| Single device | Multiple devices sync |
| Offline access | Requires connection |
5. FTP (File Transfer Protocol)#
Two Connections#
Control Connection: Port 21 (commands)
Data Connection: Port 20 (file transfer)
Active Mode:
- Server connects TO client for data
- Client may have firewall issues
Passive Mode:
- Client connects TO server for data
- Better for firewalls
Common FTP Commands#
| Command | Purpose |
|---|
| USER | Username |
| PASS | Password |
| LIST | Directory listing |
| RETR | Download file |
| STOR | Upload file |
| QUIT | Close connection |
6. DHCP (Dynamic Host Configuration Protocol)#
Automatically assigns IP addresses
DORA Process:
1. Discover: Client broadcasts "I need an IP"
2. Offer: Server offers an IP address
3. Request: Client requests offered IP
4. Acknowledge: Server confirms assignment
Client gets:
- IP address
- Subnet mask
- Default gateway
- DNS server
7. Network Security Basics#
Firewalls#
Types:
- Packet Filter: Check source/dest IP, port
- Stateful: Track connection state
- Application: Deep packet inspection
Rule Example:
ALLOW TCP from any to 192.168.1.100:80
DENY all from any to any
Common Attacks#
| Attack | Description | Layer |
|---|
| DoS/DDoS | Overwhelm with traffic | All |
| Man-in-Middle | Intercept communication | 2-7 |
| DNS Spoofing | Fake DNS responses | 7 |
| Phishing | Fake websites | 7 |
Key Takeaways#
| Protocol | Port | Key Point |
|---|
| HTTP/HTTPS | 80/443 | Web, GET/POST methods |
| DNS | 53 | Domain → IP resolution |
| SMTP | 25 | Send email |
| POP3/IMAP | 110/143 | Receive email |
| FTP | 20/21 | File transfer (2 connections) |
| DHCP | 67/68 | Auto IP assignment (DORA) |