Tumbler Note

SSH configuration

2012-06-21T02:10:00.003-07:00

Specify the Host name.
```
Router(config)#hostname <host name>
```

Define a default domain name.

Router(config)#ip domain-name <Domain Name>

Generate RSA key pairs.
```
Router(config)#crypto key generate rsa
```
Configure SSH-RSA keys for user and server authentication.
```
Router(config)#ip ssh pubkey-chain
```

Configure the SSH username.

Router(conf-ssh-pubkey)#username <user name>

Specify the RSA public key of the remote peer.
```
Router(conf-ssh-pubkey-user)#key-string
```

Specify the SSH key type and version. (optional)

Router(conf-ssh-pubkey-data)#key-hash ssh-rsa <key ID>

Exit the current mode and return to privileged EXEC mode.
```
Router(conf-ssh-pubkey-data)#end
```

some troubleshooting skill related to CPU usage

2012-06-19T20:18:00.001-07:00

process cpu threshold type total rising 80 interval 5

event syslog pattern "%SYS-1-CPURISINGTHRESHOLD"

action 1 cli command "enable"

action 1 cli command "<enable password>"

action 3 cli command "show clock | append flash:risecpu_info"

action 4 cli command "show proc cpu sorted | append flash:risecpu_info"

action 5 cli command "show proc cpu history | append flash:risecpu_info"

action 6 cli command "show interface | append flash:risecpu_info"

action 7 cli command "show int switching | append flash:risecpu_info"

action 8 cli command "show ip traffic | append flash:risecpu_info"

action 9 cli command "show ip cef switching stat feature | append flash:risecpu_info"

action 10 cli command "show debug | append flash:risecpu_info"

action 11 cli command "show align | append flash:risecpu_info"

IP Prefix Notes

2011-05-07T08:42:00.000-07:00

How a Prefix List Match Works
The matching is similar to that of the access-list—more specifically:
· An empty prefix list permits all prefixes.
· An implicit deny is assumed if a given prefix does not match any entries of a prefix list.
· When multiple entries of a prefix list match a given prefix, the one with the smallest sequence is considered as the “real” match. In short, the first match wins!

BGP notes

2011-05-04T00:02:00.000-07:00

The BGP Path-Selection Process
1. Ignore paths marked as "not synchronized" in the output of show ip bgp
x.x.x.x. If BGP synchronization is enabled - which is the current default in IOS
Software - there must be a match for the prefix in the IP routing table for an
internal (that is, iBGP) path to be considered a valid path. Most ISPs will want
to disable synchronization using the no synchronization BGP subcommand.
2. Ignore paths for which the NEXT_HOP is inaccessible. This is why it is
important to have an IGP route to the NEXT_HOP associated with the path.
3. Ignore paths from an eBGP neighbor if the local AS appears in the AS path.
Such paths are denied upon ingress into the router and are not even installed
in the BGP RIB. The same applies to any path denied by routing policy
implemented through access, prefix, AS path, or community lists, unless
inbound soft reconfiguration is configured for the neighbor.
4. If bgp bestpath enforce-first-as is enabled and the UPDATE does not
contain the AS of the neighbor as the first AS number in the AS_SEQUENCE,
send a NOTIFICATION and close the session.
5. Ignore paths marked as "(received-only)" in the output of show ip bgp
x.x.x.x. This path has been rejected by policy but has been stored by the
router because soft-reconfiguration inbound has been configured for the
neighbor sending the path.
6. Ignore paths with a next -hop metric marked as inaccessible.

The BGP Best-Path Algorithm for IOS Software
1. Prefer the path with the largest weight. Note that weight is a Cisco specific
parameter, local to the router on which it is configured.
2. Prefer the path with the largest LOCAL_PREF.
3. Prefer the path that was locally originated through a network or aggregate
BGP subcommand or through redistribution from an IGP.
4. Prefer locally sourced network/redistributed paths over locally generated
aggregates.
5. Prefer the path with the shortest AS path.
A. This step is skipped if bgp bestpath as-path ignore is configured.
B. An AS_SET counts as one AS, no matter how many autonomous systems are in the set. The AS_CONFED_SEQUENCE is not included in the AS path length.
6. Prefer the path with the lowest origin type: IGP is lower than EGP, and EGP is
lower than INCOMPLETE.
7. Prefer the path with the lowest MED.
A. This comparison is done only if the first (that is, neighboring) AS is the
same in the two paths; any confederation sub-autonomous systems are ignored. In other words, MEDs are compared only if the first AS in the AS_SEQUENCE is the same; any preceding AS_CONFED_SEQUENCE is ignored.
B. If bgp always-compare-med is enabled, MEDs are compared for all paths. This knob needs to be enabled over the entire AS. Otherwise, routing loops could occur.
C. If bgp bestpath med confed is enabled, MEDs are compared for all paths that consist only of AS_CONFED_SEQUENCE (that is, paths originated within the local confederation).
D. Paths received with no MED are assigned a MED of 0, unless bgp bestpath missing-is-worst is enabled, in which case they effectively are considered to have (although not actually assigned) a MED of 4,294,967,295. Any route received from a neighbor with a MED of 4,294,967,295 will have the MED changed to 4,294,967,294 before insertion into the BGP table.
E. BGP Deterministic MED also can influence this step.
8. Prefer the eBGP over iBGP paths. Note that paths containing AS_CONFED_SEQUENCE are local to the confederation and, therefore, are treated as internal paths. There is no distinction between confederation external and confederation internal.
9. Prefer the path with the lowest IGP metric to the BGP next hop.
10. If maximum-paths N is enabled and there are multiple external/confederation-external paths from the same neighboring AS/sub-AS, then insert up to N most recently received paths in the IP routing table. This allows eBGP multipath load sharing. The maximum value of N is currently 6; the default value, with the knob disabled, is 1. The oldest received path is marked as the best path in the output of show ip bgp x.x.x.x, and the equivalent of next-hop-self is performed before forwarding this best path on to internal peers.
11. Prefer the path that was received first (that is, the oldest one).
A. This step minimizes route flapping because a newer path will not displace an older one, even if it otherwise would be selected on account of the additional decision criteria below. It makes more sense to apply the additional decision steps only below to iBGP paths, to ensure a consistent best-path decision within the network and thereby avoid loops.
B. This step is skipped if bgp bestpath compare-routerid is enabled.
C. This step is skipped if the ROUTER_ID is the same because the routers were received from the same router.
D. This step is skipped if there is no current best path. An example of losing the current best path occurs when the neighbor offering the path goes down.
12. Prefer the route coming from the BGP router with the lowest router ID. The
router ID is the highest IP address on the router, with preference given to loopback interfaces if one or more are configured. It also can be set manually
through bgp router-id x.x.x.x. Note that if a path contains route reflector attributes, the originator ID is substituted for the router ID in the path-selection process.
13. If the originator/router ID is the same, prefer the path with the minimum
cluster ID length. This will be present in BGP route-reflector environments
only, and it allows clients to peer with route reflectors/clients in other
clusters. In this scenario, the client must be aware of the route reflector-specific BGP attributes.
14. Prefer the path coming from the lowest neighbor address. This is the IP
address used in the BGP neighbor configuration, and it corresponds to the
address that the remote peer uses in the TCP connection with the local router.

Several limitations existed with BGP peer groups in older IOS Software versions:
· If used for clients of a route reflector, all the clients should be fully meshed.
· If used as an eBGP peer group, transit cannot be provided among the peer group members.
· All the eBGP peer-group members should be from the same subnet to avoid nonconnected next-hop announcements.

A list of peer groups commonly by ISPs follows:
· Normal iBGP peer group-For normal iBGP peers.
· iBGP client peer group- For reflection peers on a route reflector.
· eBGP full routes- For peers to receive full Internet routes.
· eBGP customer routes-For peers to receive routes from direct customers of the ISP only. Some members can be configured with default-origination to receive the default route as well as the customer routes.
· eBGP default routes-For peers to receive the default route and possibly a few other routes.

Two or more iBGP paths are considered candidates for multipath if the following
criteria are met:
· All attributes (weight, localpref, AS-PATH [entire attribute, not just length],
Origin, MED, and IGP distance are the same.
· The next hops are different.

Currently the prefix-list ORF is implemented for IPv4 unicast only. Some points to
note about the implementation are listed here:
· By default, the prefix-list ORF capability is not advertised to any neighbors.
· The capability cannot be advertised to a neighbor that is a peer group member.
· The prefix-list ORF is pushed over to the peer router immediately after the session is established if the local router has received the ORF capability and has configured an inbound prefix-list filter for the neighbor.

Spanning Tree Protocol

2011-04-17T11:27:00.000-07:00

When a switch receives multiple Hellos with equal calculated cost, it uses the following tiebreakers:
1. Pick the lowest value of the forwarding switch's bridge ID.
2. Use the lowest port priority of the neighboring switch. The neighboring switch added its own port priority to the Hello before forwarding it.
3. Use the lowest internal port number (of the forwarding switch) as listed inside the received Hellos.

spanning-tree mode {mst | pvst | rapid-pvst}
[no] spanning-tree vlan vlan-id
spanning-tree vlan vlan-id {forwardtime seconds | hello-time seconds | max-age seconds | priority priority | {root {primary | secondary} [diameter net-diameter [hello-time seconds]]}}
spanning-tree vlan x cost y
spanning-tree vlan x port-priority y

channel-group channel-group-number mode {auto [non-silent] | desirable [non-silent] | on | active | passive}
channel-protocol {lacp | pagp}
interface port-channel port-channel-number

spanning-tree portfast
spanning-tree bpduguard {enable | disable}
spanning-tree uplinkfast
spanning-tree backbonefast
spanning-tree mst instance-id priority priority
spanning-tree mst configuration

show spanning-tree { root | brief | summary }
show spanning-tree { uplinkfast | backbonefast }
show interface
show interface trunk
show etherchannel [summary]
show interface switchport
show vtp status
show controllers

VLAN

2011-04-12T05:00:00.000-07:00

Using VLAN Database Mode to Create VLANs
Switch3# show vlan brief
Switch3# vlan database
Switch3# vlan database
Switch3(vlan)# vlan 21
Switch3(vlan)# show current
Switch3(vlan)# show proposed
Switch3(vlan)# apply
Switch3(vlan)# vlan 22 name ccie-vlan-22
Switch3(vlan)# show current 22
VLAN 22 does not exist in current database
Switch3(vlan)# show proposed 22
Switch3(vlan)# ^Z

Using Configuration Mode to Put Interfaces into VLANs
Switch3# config t
Enter configuration commands, one per line. End with CNTL/Z.
Switch3(config)# int fa 0/8
Switch3(config-if)# switchport access vlan 31
% Access VLAN does not exist. Creating vlan 31
Switch3(config-if)# exit
Switch3(config)# vlan 32
Switch3(config-vlan)# name ccie-vlan-32
Switch3(config-if)# ^Z

Switch3(config)# vtp domain CCIE-domain

Switch1# sh vtp status
Switch1# show vlan brief

VLAN Trunking
switchport | no switchport
switchport mode
switchport trunk
switchport access
show interface trunk
show interface type number trunk
show interface type number switchport

Trunking Configuration Options
switchport mode trunk
switchport nonegotiate
switchport mode dynamic desirable
switchport mode dynamic auto
switchport mode access
switchport trunk encapsulation

interface fastethernet 0/0.1
ip address 10.1.21.1 255.255.255.0
encapsulation isl 21
!
interface fastethernet 0/0.2
ip address 10.1.22.1 255.255.255.0
encapsulation isl 22

interface fastethernet 0/0
ip address 10.1.21.1 255.255.255.0
!
interface fastethernet 0/0.2
ip address 10.1.22.1 255.255.255.0
encapsulation dot1q 22

EdgeRouter# conf t
EdgeRouter(config)# interface fa0/1
EdgeRouter(config-if)# ip address 192.168.100.1 255.255.255.0
EdgeRouter(config-if)# ip nat inside
EdgeRouter(config)# interface fa0/1
EdgeRouter(config-if)# pppoe-client dial-pool-number 1
EdgeRouter(config-if)# exit
EdgeRouter(config)# interface dialer1
EdgeRouter(config-if)# mtu 1492
EdgeRouter(config-if)# encapsulation ppp
EdgeRouter(config-if)# ip address negotiated
EdgeRouter(config-if)# ppp authentication chap
EdgeRouter(config-if)# ip nat outside
EdgeRouter(config-if)# dialer pool 1
EdgeRouter(config-if)# dialer-group 1
EdgeRouter(config-if)# exit
EdgeRouter(config)# dialer-list 1 protocol ip permit
EdgeRouter(config)# ip nat inside source list 1 interface dialier1 overload
EdgeRouter(config)# access-list 1 permit 192.168.100.0 0.0.0.255
EdgeRouter(config)# ip route 0.0.0.0 0.0.0.0 dialer1

show pppoe session
debug pppoe [data | errors | events | packets]

show mac address-table [aging-time | count | dynamic | static] [address hw-addr] [interface interface-id] [vlan vlan-id]
show interfaces [interface-id | vlan vlan-id] switchport | trunk]
show vlan [brief | id vlan-id |name vlan-name | summary]
show vlan [vlan]
show vtp status
switchport mode {access | dot1q-tunnel | dynamic {auto | desirable} | trunk}
switchport nonegotiate
switchport trunk {allowed vlan vlan-list} | {encapsulation {dot1q | isl | negotiate}} | {native vlan vlan-id} | {pruning vlan vlan-list}
switchport access vlan vlan-id

VLAN Database
vtp {domain domain-name | password password | pruning | v2-mode | {server | client | transparent}}
vlan vlan-id [backupcrf {enable | disable}] [mtu mtu-size] [name vlan-name] [parent parent-vlan-id] [state {suspend | active}]
show {current | proposed | difference}
apply | abort | reset

VLAN Configuration Mode
vtp {domain domain-name | file filename | interface name | mode {client | server | transparent} | password password | pruning | version number}
vlan vlan-id

Step 1 Change the VTP mode to Transparent, which will reset the configuration
revision number to 0.
Step 2 Delete the vlan.dat file from the switch’s flash.
Step 3 Reboot the switch.
Step 4 Configure the appropriate VTP parameters.
Step 5 Configure trunking.
Step 6 Connect the switch to the network.

SPAN & RSPAN notes

2011-03-24T06:41:00.000-07:00

Basic SPAN Configuration Example
MDF-ROC1# configure terminal
MDF-ROC1(config)# monitor session 1 source interface fa0/12
MDF-ROC1(config)# monitor session 1 destination interface fa0/24

Complex SPAN Configuration Example
MDF-ROC3# config term
MDF-ROC3(config)# monitor session 11 source interface fa0/18 rx
MDF-ROC3(config)# monitor session 11 source interface fa0/9 tx
MDF-ROC3(config)# monitor session 11 source interface fa0/19
MDF-ROC3(config)# monitor session 11 filter vlan 1 - 3 , 229
MDF-ROC3(config)# monitor session 11 destination interface fa0/24 encapsulation replicate

RSPAN Configuration Example
IDF-SYR1# config term
IDF-SYR1(config)# vlan 199
IDF-SYR1(config-vlan)# remote span
IDF-SYR1(config-vlan)# exit
IDF-SYR1(config)# monitor session 3 source vlan 66 – 68 rx
IDF-SYR1(config)# monitor session 3 destination remote vlan 199
!Now moving to IDF-SYR2:
IDF-SYR2# config term
IDF-SYR2(config)# vlan 199
IDF-SYR2(config-vlan)# remote span
IDF-SYR2(config-vlan)# exit
IDF-SYR2(config)# monitor session 23 source vlan 9 rx
IDF-SYR2(config)# monitor session 23 source vlan 11 rx
IDF-SYR2(config)# monitor session 23 destination remote vlan 199
!Now moving to MDF-SYR9
MDF-SYR9# config term
MDF-SYR9(config)# vlan 199
MDF-SYR9(config-vlan)# remote span
MDF-SYR9(config-vlan)# exit
MDF-SYR9(config)# monitor session 63 source remote vlan 199
MDF-SYR9(config)# monitor session 63 destination interface fa0/24
MDF-SYR9(config)# end

remote span
monitor session 1-66 source [vlan vlan-id | interface interface-id] [rx | tx | both]
monitor session 1-66 destination [remote vlan vlan-id] | interface interface-id]
monitor session 1-66 filter vlan [vlan | vlan-range]

show monitor session session-id

Implement Spanning Tree Protocol (STP)

2011-03-09T23:46:00.000-08:00

Each configuration BPDU contains this information:

•The unique bridge ID of the switch that the sending switch identifies as the root switch

•The spanning-tree path cost to the root

•The bridge ID of the sending switch

•Message age

•The identifier of the sending interface

•Values for the hello, forward delay, and max-age protocol timers

Each Layer 2 interface on a switch using spanning tree exists in one of these states:

•Blocking—The interface does not participate in frame forwarding.

•Listening—The first transitional state after the blocking state when the spanning tree decides that the interface should participate in frame forwarding.

•Learning—The interface prepares to participate in frame forwarding.

•Forwarding—The interface forwards frames.

•Disabled—The interface is not participating in spanning tree because of a shutdown port, no link on the port, or no spanning-tree instance running on the port.

An interface moves through these states:

•From initialization to blocking

•From blocking to listening or to disabled

•From listening to learning or to disabled

•From learning to forwarding or to disabled

•From forwarding to disabled

Reference Websites (updating)

2011-03-06T07:59:00.000-08:00

http://www.backtrack-linux.org/
- a penetration testing distribution website

adding static DNS entry to Window XP or changing the DNS server

2011-02-24T04:16:00.000-08:00

Today I find I cannot access some sites.
By checking with the nslookup, found it is blocked by my DNS provider.
There are two ways to work around:
1) change the primary DNS server to the one not blocked or still working under Local Area Connection.
2) change the hosts file under C:\WINDOWS\system32\drivers\etc
add the ip address you find with your site name
xxx.xxx.xxx.xxx site_name

route-map case

2011-02-16T23:55:00.000-08:00

There is a someone wants to configure such scenario.
if the router see some port then use a gateway, the solution is using route-map and apply it to the interface.

conf t
route-map port80
match ip address matchport80
set ip next-hop xxx.xxx.xxx.xxx <----------- the gateway ip you set for next-hop for the http traffic

ip access-list extended matchport80
permit tcp any any eq www

interface FastEthernet0/0
ip policy route-map port80

Cisco IP advance feature - sweep range of sizes

2011-02-01T00:34:00.000-08:00

To check the destination ip mtu, please use the following method.
router#ping
Protocol [ip]:
Target IP address: 10.30.30.1
Repeat count [5]: 1
Datagram size [100]: 1
% A decimal number between 36 and 18024.
Datagram size [100]: 100
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface:
Type of service [0]:
Set DF bit in IP header? [no]: y
Validate reply data? [no]:
Data pattern [0xABCD]:
Loose, Strict, Record, Timestamp, Verbose[none]:
Sweep range of sizes [n]: y
Sweep min size [36]: 1470
Sweep max size [18024]: 1500
Sweep interval [1]:
Type escape sequence to abort.
Sending 31, [1470..1500]-byte ICMP Echos to 10.30.30.1, timeout is 2 seconds:
!!!!!..........................
Success rate is 16 percent (5/31), round-trip min/avg/max = 52/67/88 ms

Basic Network IP design Jan 28 2011

2011-01-27T23:58:00.000-08:00

Only one WAN IP
WAN IP put under WAN interface
Private IP put under LAN gw

one WAN IP and a public LAN IP subnet
WAN IP put under WAN interface
put the first usable public LAN IP under LAN gw
can put the private IP under the same interface as secondary IP range if needed.

Publish Post

Configuration of one to one nat mapping and pool nat

2010-12-28T17:28:00.000-08:00

ip nat inside source list 1 interface Serial0/0/0 overload
ip nat inside source static 172.18.0.109 204.8.1xx.xxx extendable
ip nat inside source static 172.18.0.108 204.8.1xx.xxx extendable
ip nat inside source static 172.18.0.107 204.8.1xx.xxx extendable
ip nat inside source static 172.18.0.106 204.8.1xx.xxx extendable
ip nat inside source static 172.18.0.105 204.8.1xx.xxx extendable
!
access-list 1 deny 172.18.0.108
access-list 1 deny 172.18.0.109
access-list 1 deny 172.18.0.106
access-list 1 deny 172.18.0.107
access-list 1 deny 172.18.0.105
access-list 1 permit 172.0.0.0 0.255.255.255

OUI PUBLIC LISTING: PUBLIC OUI AND 'COMPANY_ID' ASSIGNMENTS

2010-12-21T14:44:00.000-08:00

http://standards.ieee.org/develop/regauth/oui/oui.txt

Official List of TCP and UDP port numbers

2010-12-15T03:39:00.000-08:00

0 UDP Reserved
1 TCP UDP TCP Port Service Multiplexer (TCPMUX)
2 TCP UDP Management Utility
3 TCP UDP Compression Process

5 TCP UDP Remote Job Entry

7 TCP UDP Echo Protocol

9 TCP UDP Discard Protocol

11 TCP UDP Active Users (systat service[2])

13 TCP UDP Daytime Protocol (RFC 867)
17 TCP UDP Quote of the Day
18 TCP UDP Message Send Protocol
19 TCP UDP Character Generator Protocol (CHARGEN)
20 TCP   FTP – data transfer
21 TCP   FTP – control (command)
22 TCP UDP Secure Shell (SSH)—used for secure logins, file transfers (scp, sftp) and port forwarding
23 TCP   Telnet protocol—unencrypted text communications
24 TCP UDP Priv-mail : any private mail system.
25 TCP   Simple Mail Transfer Protocol (SMTP)—used for e-mail routing between mail servers
35 TCP UDP Any private printer server protocol
37 TCP UDP TIME protocol
39 TCP UDP Resource Location Protocol[3] (RLP)—used for determining the location of higher level services from hosts on a network
41 TCP UDP Graphics
42 TCP UDP nameserver, ARPA Host Name Server Protocol
43 TCP   WHOIS protocol
47 TCP UDP NI FTP
49 TCP UDP TACACS Login Host protocol
50 TCP UDP Remote Mail Checking Protocol
51 TCP UDP IMP Logical Address Maintenance
52 TCP UDP XNS (Xerox Network Systems) Time Protocol
53 TCP UDP Domain Name System (DNS)
54 TCP UDP XNS (Xerox Network Systems) Clearinghouse
56 TCP UDP XNS (Xerox Network Systems) Authentication
58 TCP UDP XNS (Xerox Network Systems) Mail
67 UDP Bootstrap Protocol (BOOTP) Server; also used by Dynamic Host Configuration Protocol (DHCP)
68 UDP Bootstrap Protocol (BOOTP) Client; also used by Dynamic Host Configuration Protocol (DHCP)
69 UDP Trivial File Transfer Protocol (TFTP)
70 TCP   Gopher protocol
79 TCP   Finger protocol
80 TCP UDP Hypertext Transfer Protocol (HTTP)
83 TCP   MIT ML Device
88 TCP UDP Kerberos—authentication system
90 TCP UDP dnsix (DoD Network Security for Information Exchange) Securit Attribute Token Map
101 TCP   NIC host name
102 TCP   ISO-TSAP (Transport Service Access Point) Class 0 protocol[5]
104 TCP UDP ACR/NEMA Digital Imaging and Communications in Medicine
105 TCP UDP CCSO Nameserver Protocol (Qi/Ph)
107 TCP   Remote TELNET Service[6] protocol
108 TCP UDP SNA Gateway Access Server [7]
109 TCP   Post Office Protocol v2 (POP2)
110 TCP   Post Office Protocol v3 (POP3)
111 TCP UDP ONC RPC (SunRPC)
113 TCP   ident—user identification system, used by IRC servers to identify users
113 TCP UDP Authentication Service (auth)
115 TCP   Simple File Transfer Protocol (SFTP)
117 TCP   UUCP Path Service
118 TCP UDP SQL (Structured Query Language) Services
119 TCP   Network News Transfer Protocol (NNTP) — retrieval of newsgroup messages
123 UDP Network Time Protocol (NTP)—used for time synchronization
135 TCP UDP DCE endpoint resolution
137 TCP UDP NetBIOS NetBIOS Name Service
138 TCP UDP NetBIOS NetBIOS Datagram Service
139 TCP UDP NetBIOS NetBIOS Session Service
143 TCP UDP Internet Message Access Protocol (IMAP) — management of email messages
152 TCP UDP Background File Transfer Program (BFTP)[9]
153 TCP UDP SGMP, Simple Gateway Monitoring Protocol
156 TCP UDP SQL Service
161 UDP Simple Network Management Protocol (SNMP)
162 TCP UDP Simple Network Management Protocol Trap (SNMPTRAP)[10]
170 TCP   Print-srv, Network PostScript
177 TCP UDP X Display Manager Control Protocol (XDMCP)
179 TCP   BGP (Border Gateway Protocol)
194 TCP UDP Internet Relay Chat (IRC)
199 TCP UDP SMUX, SNMP Unix Multiplexer
201 TCP UDP AppleTalk Routing Maintenance
209 TCP UDP The Quick Mail Transfer Protocol
210 TCP UDP ANSI Z39.50
213 TCP UDP Internetwork Packet Exchange (IPX)
218 TCP UDP Message posting protocol (MPP)
220 TCP UDP Internet Message Access Protocol (IMAP), version 3
259 TCP UDP ESRO, Efficient Short Remote Operations
264 TCP UDP BGMP, Border Gateway Multicast Protocol
308 TCP   Novastor Online Backup
311 TCP   Mac OS X Server Admin (officially AppleShare IP Web administration)
318 TCP UDP PKIX TSP, Time Stamp Protocol
319 UDP Precision time protocol event messages
320 UDP Precision time protocol general messages
350 TCP UDP MATIP-Type A, Mapping of Airline Traffic over Internet Protocol
351 TCP UDP MATIP-Type B, Mapping of Airline Traffic over Internet Protocol
366 TCP UDP ODMR, On-Demand Mail Relay
369 TCP UDP Rpc2portmap
371 TCP UDP ClearCase albd
383 TCP UDP HP data alarm manager
384 TCP UDP A Remote Network Server System
387 TCP UDP AURP, AppleTalk Update-based Routing Protocol
389 TCP UDP Lightweight Directory Access Protocol (LDAP)
401 TCP UDP UPS Uninterruptible Power Supply
427 TCP UDP Service Location Protocol (SLP)
443 TCP   HTTPS (Hypertext Transfer Protocol over SSL/TLS)
444 TCP UDP SNPP, Simple Network Paging Protocol (RFC 1568)
445 TCP   Microsoft-DS Active Directory, Windows shares
445 TCP   Microsoft-DS SMB file sharing
464 TCP UDP Kerberos Change/Set password
475 TCP   tcpnethaspsrv (Aladdin Knowledge Systems Hasp services, TCP/IP version)
497 TCP   Dantz Retrospect
500 UDP Internet Security Association and Key Management Protocol (ISAKMP)
504 TCP UDP Citadel – multiservice protocol for dedicated clients for the Citadel groupware system
512 TCP   Rexec, Remote Process Execution
512 UDP comsat, together with biff
513 TCP   rlogin
513 UDP Who
514 TCP   Shell—used to execute non-interactive commands on a remote system (Remote Shell, rsh, remsh)
514 UDP Syslog—used for system logging
515 TCP   Line Printer Daemon—print service
517 UDP Talk
518 UDP NTalk
520 TCP   efs, extended file name server
520 UDP Routing Information Protocol (RIP)
524 TCP UDP NetWare Core Protocol (NCP) is used for a variety things such as access to primary NetWare server resources, Time Synchronization, etc.
525 UDP Timed, Timeserver
530 TCP UDP RPC
532 TCP   netnews
533 UDP netwall, For Emergency Broadcasts
540 TCP   UUCP (Unix-to-Unix Copy Protocol)
542 TCP UDP commerce (Commerce Applications)
543 TCP   klogin, Kerberos login
544 TCP   kshell, Kerberos Remote shell
546 TCP UDP DHCPv6 client
547 TCP UDP DHCPv6 server
548 TCP   Apple Filing Protocol (AFP) over TCP
550 UDP new-rwho, new-who
554 TCP UDP Real Time Streaming Protocol (RTSP)
556 TCP   Remotefs, RFS, rfs_server
560 UDP rmonitor, Remote Monitor
561 UDP monitor
563 TCP UDP NNTP protocol over TLS/SSL (NNTPS)
587 TCP   e-mail message submission[11] (SMTP)
591 TCP   FileMaker 6.0 (and later) Web Sharing (HTTP Alternate, also see port 80)
593 TCP UDP HTTP RPC Ep Map, Remote procedure call over Hypertext Transfer Protocol, often used by Distributed Component Object Model services and Microsoft Exchange Server
604 TCP   TUNNEL profile[12], a protocol for BEEP peers to form an application layer tunnel
623   UDP ASF Remote Management and Control Protocol (ASF-RMCP)
631 TCP UDP Internet Printing Protocol (IPP)
635 TCP UDP RLZ DBase
636 TCP UDP Lightweight Directory Access Protocol over TLS/SSL (LDAPS)
639 TCP UDP MSDP, Multicast Source Discovery Protocol
641 TCP UDP SupportSoft Nexus Remote Command (control/listening): A proxy gateway connecting remote control traffic
646 TCP UDP LDP, Label Distribution Protocol, a routing protocol used in MPLS networks
647 TCP   DHCP Failover protocol[13]
648 TCP   RRP (Registry Registrar Protocol)[14]
651 TCP UDP IEEE-MMS
653 TCP UDP SupportSoft Nexus Remote Command (data): A proxy gateway connecting remote control traffic
654 TCP   Media Management System (MMS) Media Management Protocol (MMP)[15]
657 TCP UDP IBM RMC (Remote monitoring and Control) protocol, used by System p5 AIX Integrated Virtualization Manager (IVM)[16] and Hardware Management Console to connect managed logical partitions (LPAR) to enable dynamic partition reconfiguration
660 TCP   Mac OS X Server administration
666   UDP Doom, first online first-person shooter
674 TCP   ACAP (Application Configuration Access Protocol)
691 TCP   MS Exchange Routing
692 TCP   Hyperwave-ISP
694 TCP UDP Linux-HA High availability Heartbeat
695 TCP   IEEE-MMS-SSL (IEEE Media Management System over SSL)[17]
698   UDP OLSR (Optimized Link State Routing)
699 TCP   Access Network
700 TCP   EPP (Extensible Provisioning Protocol), a protocol for communication between domain name registries and registrars (RFC 5734)
701 TCP   LMP (Link Management Protocol (Internet))[18], a protocol that runs between a pair of nodes and is used to manage traffic engineering (TE) links
702 TCP   IRIS[19][20] (Internet Registry Information Service) over BEEP (Blocks Extensible Exchange Protocol)[21] (RFC 3983)
706 TCP   Secure Internet Live Conferencing (SILC)
711 TCP   Cisco Tag Distribution Protocol[22][23][24]—being replaced by the MPLS Label Distribution Protocol[25]
712 TCP   Topology Broadcast based on Reverse-Path Forwarding routing protocol (TBRPF) (RFC 3684)
749 TCP UDP Kerberos (protocol) administration
750 TCP   rfile
750   UDP loadav
750   UDP kerberos-iv, Kerberos version IV
751 TCP UDP pump
752 TCP   qrh
752   UDP qrh
753 TCP   Reverse Routing Header (rrh)[26]
753   UDP Reverse Routing Header (rrh)
754 TCP   tell send
754   UDP tell send
760 TCP UDP ns
847 TCP   DHCP Failover protocol
860 TCP   iSCSI (RFC 3720)
873 TCP   rsync file synchronisation protocol USA only
902 TCP   ideafarm-door 902/tcp self documenting Door: send 0x00 for info
902   UDP ideafarm-door
989 TCP UDP FTPS Protocol (data): FTP over TLS/SSL
990 TCP UDP FTPS Protocol (control): FTP over TLS/SSL
991 TCP UDP NAS (Netnews Administration System)
992 TCP UDP TELNET protocol over TLS/SSL
993 TCP   Internet Message Access Protocol over SSL (IMAPS)
995 TCP   Post Office Protocol 3 over TLS/SSL (POP3S)
1058 TCP UDP nim, IBM AIX Network Installation Manager (NIM)
1059 TCP UDP nimreg, IBM AIX Network Installation Manager (NIM)
1080 TCP   SOCKS proxy
1085 TCP UDP WebObjects
1098 TCP UDP rmiactivation, RMI Activation
1099 TCP UDP rmiregistry, RMI Registry
1140 TCP UDP AutoNOC protocol
1169 TCP UDP Tripwire
1176 TCP   Perceptive Automation Indigo Home automation server
1182 TCP UDP AcceleNet Intelligent Transfer Protocol
1194 TCP UDP OpenVPN
1198 TCP UDP The cajo project Free dynamic transparent distributed computing in Java
1200 TCP   scol, protocol used by SCOL 3D virtual worlds server to answer world name resolution client request[28]
1200   UDP scol, protocol used by SCOL 3D virtual worlds server to answer world name resolution client request
1214 TCP   Kazaa
1220 TCP   QuickTime Streaming Server administration
1223 TCP UDP TGP, TrulyGlobal Protocol, also known as "The Gur Protocol" (named for Gur Kimchi of TrulyGlobal)
1241 TCP UDP Nessus Security Scanner
1270 TCP UDP Microsoft System Center Operations Manager (SCOM) (formerly Microsoft Operations Manager (MOM)) agent
1293 TCP UDP IPSec (Internet Protocol Security)
1311 TCP   Dell OpenManage HTTPS
1319 TCP   AMX ICSP
1319 UDP   AMX ICSP
1337   UDP Men and Mice DNS
1337 TCP   Men and Mice DNS
1352 TCP   IBM Lotus Notes/Domino Remote Procedure Call (RPC) protocol
1387 TCP UDP cadsi-lm, LMS International (formerly Computer Aided Design Software, Inc. (CADSI)) LM
1414 TCP   IBM WebSphere MQ (formerly known as MQSeries)
1417 TCP UDP Timbuktu Service 1 Port
1418 TCP UDP Timbuktu Service 2 Port
1419 TCP UDP Timbuktu Service 3 Port
1420 TCP UDP Timbuktu Service 4 Port
1431 TCP   Reverse Gossip Transport Protocol (RGTP), used to access a General-purpose Reverse-Ordered Gossip Gathering System (GROGGS) bulletin board, such as that implemented on the Cambridge University's Phoenix system
1433 TCP   MSSQL (Microsoft SQL Server database management system) Server
1434 TCP UDP MSSQL (Microsoft SQL Server database management system) Monitor
1470 TCP   Solarwinds Kiwi Log Server
1494 TCP   Citrix XenApp Independent Computing Architecture (ICA) thin client protocol
1512 TCP UDP Microsoft Windows Internet Name Service (WINS)
1513 TCP UDP Garena Garena Gaming Client
1521 TCP   nCube License Manager
1524 TCP UDP ingreslock, ingres
1533 TCP   IBM Sametime IM—Virtual Places Chat Microsoft SQL Server
1547 TCP UDP Laplink
1581   UDP MIL STD 2045-47001 VMF
1677 TCP UDP Novell GroupWise clients in client/server access mode
1701   UDP Layer 2 Forwarding Protocol (L2F) & Layer 2 Tunneling Protocol (L2TP)
1719   UDP H.323 Registration and alternate communication
1720 TCP   H.323 Call signalling
1723 TCP UDP Microsoft Point-to-Point Tunneling Protocol (PPTP)
1755 TCP UDP Microsoft Media Services (MMS, ms-streaming)
1761   UDP cft-0
1761 TCP   cft-0
1762–1768 TCP UDP cft-1 to cft-7
1801 TCP UDP Microsoft Message Queuing
1812 TCP UDP radius, RADIUS authentication protocol
1813 TCP UDP radacct, RADIUS accounting protocol
1863 TCP   MSNP (Microsoft Notification Protocol), used by the .NET Messenger Service and a number of Instant Messaging clients
1900   UDP Microsoft SSDP Enables discovery of UPnP devices
1935 TCP   Adobe Systems Macromedia Flash Real Time Messaging Protocol (RTMP) "plain" protocol
1947 TCP   hasplm, Aladdin HASP Licenz Manager
1970 TCP UDP Netop Business Solutions Netop Remote Control
1971 TCP UDP Netop Business Solutions Netop School
1972 TCP UDP InterSystems Caché
1975–1977   UDP Cisco TCO (Documentation)
1984 TCP   Big Brother System and Network Monitor
1985   UDP Cisco HSRP
1994 TCP UDP Cisco STUN-SDLC (Serial Tunneling—Synchronous Data Link Control) protocol
1998 TCP UDP Cisco X.25 over TCP (XOT) service
2000 TCP UDP Cisco SCCP (Skinny)
2031 TCP UDP mobrien-chat(http://chat.mobrien.com:2031/)
2049   UDP Network File System
2049   UDP shilp
2053   UDP lot105-ds-upd Lot105 DSuper Updates
2053 TCP   lot105-ds-upd Lot105 DSuper Updates
2073 TCP UDP DataReel Database
2074 TCP UDP Vertel VMF SA (i.e. App.. SpeakFreely)
2082 TCP   Infowave Mobility Server
2083 TCP   Secure Radius Service (radsec)
2086 TCP   GNUnet
2102 TCP UDP zephyr-srv Project Athena Zephyr Notification Service server
2103 TCP UDP zephyr-clt Project Athena Zephyr Notification Service serv-hm connection
2104 TCP UDP zephyr-hm Project Athena Zephyr Notification Service hostmanager
2105 TCP UDP IBM MiniPay
2156   UDP Talari Reliable Protocol
2161 TCP   APC Agent
2181 TCP UDP EForward-document transport system
2210 TCP UDP NOAAPORT Broadcast Network
2211 TCP UDP EMWIN
2212 TCP UDP LeeCO POS Server Service
2219 TCP UDP NetIQ NCAP Protocol
2220 TCP UDP NetIQ End2End
2261 TCP UDP CoMotion Master
2262 TCP UDP CoMotion Backup
2369 TCP   Default for BMC Software Control-M/Server—Configuration Agent, though often changed during installation
2370 TCP   Default for BMC Software Control-M/Server—to allow the Control-M/Enterprise Manager to connect to the Control-M/Server, though often changed during installation
2404 TCP   IEC 60870-5 -104, used to send electric power telecontrol messages between two systems via directly connected data circuits
2420   UDP Westell Remote Access
2427   UDP Cisco MGCP
2447 TCP UDP ovwdb—OpenView Network Node Manager (NNM) daemon
2483 TCP UDP Oracle database listening for unsecure client connections to the listener, replaces port 1521
2484 TCP UDP Oracle database listening for SSL client connections to the listener
2500 TCP   THEòSMESSENGER listening for TheòsMessenger client connections
2501 TCP   TheosNet-Admin listening for TheòsMessenger client connections
2612 TCP UDP QPasa from MQSoftware
2700–2800 TCP   KnowShowGo P2P
2713 TCP UDP Raven Trinity Broker Service
2714 TCP UDP Raven Trinity Data Mover
2735 TCP UDP NetIQ Monitor Console
2809 TCP   corbaloc:iiop URL, per the CORBA 3.0.3 specification
2809   UDP corbaloc:iiop URL, per the CORBA 3.0.3 specification.
2868 TCP UDP Norman Proprietary Event Protocol NPEP
2947 TCP   gpsd GPS daemon
2948 TCP UDP WAP-push Multimedia Messaging Service (MMS)
2949 TCP UDP WAP-pushsecure Multimedia Messaging Service (MMS)
3050 TCP UDP gds_db (Interbase/Firebird)
3051 TCP UDP Galaxy Server (Gateway Ticketing Systems)
3074 TCP UDP Xbox LIVE and/or Games for Windows - LIVE
3225 TCP UDP FCIP (Fiber Channel over Internet Protocol)
3233 TCP UDP WhiskerControl research control protocol
3235 TCP UDP Galaxy Network Service (Gateway Ticketing Systems)
3260 TCP   iSCSI target
3268 TCP UDP msft-gc, Microsoft Global Catalog (LDAP service which contains data from Active Directory forests)
3269 TCP UDP msft-gc-ssl, Microsoft Global Catalog over SSL (similar to port 3268, LDAP over SSL)
3283 TCP   Apple Remote Desktop reporting (officially Net Assistant, referring to an earlier product)
3305 TCP UDP odette-ftp, Odette File Transfer Protocol (OFTP)
3306 TCP UDP MySQL database system
3386 TCP UDP GTP' 3GPP GSM/UMTS CDR logging protocol
3389 TCP UDP Microsoft Terminal Server (RDP) officially registered as Windows Based Terminal (WBT) - Link
3396 TCP UDP Novell NDPS Printer Agent
3412 TCP UDP xmlBlaster
3455 TCP UDP [RSVP] Reservation Protocol
3423 TCP   Xware xTrm Communication Protocol
3424 TCP   Xware xTrm Communication Protocol over SSL
3478 TCP UDP STUN, a protocol for NAT traversal
3483   UDP Slim Devices discovery protocol
3483 TCP   Slim Devices SlimProto protocol
3516 TCP UDP Smartcard Port
3527   UDP Microsoft Message Queuing
3532 TCP UDP Raven Remote Management Control
3533 TCP UDP Raven Remote Management Data
3544   UDP Teredo tunneling
3605   UDP ComCam IO Port
3606 TCP UDP Splitlock Server
3632 TCP   distributed compiler
3689 TCP   Digital Audio Access Protocol (DAAP)—used by Apple’s iTunes and AirPort Express
3690 TCP UDP Subversion version control system
3702 TCP UDP Web Services Dynamic Discovery (WS-Discovery), used by various components of Windows Vista
3880 TCP UDP IGRS
3868 TCP SCTP Diameter base protocol (RFC 3588)
3900 TCP   udt_os, IBM UniData UDT OS[30]
3945 TCP UDP EMCADS service, a Giritech product used by G/On
3999 TCP UDP Norman distributed scanning service
4018 TCP UDP protocol information and warnings
4069   UDP Minger Email Address Verification Protocol[31]
4089 TCP UDP OpenCORE Remote Control Service
4093 TCP UDP PxPlus Client server interface ProvideX
4096 TCP UDP Ascom Timeplex BRE (Bridge Relay Element)
4111 TCP   Xgrid
4116 TCP UDP Smartcard-TLS
4321 TCP   Referral Whois (RWhois) Protocol[32]
4500   UDP IPSec NAT Traversal (RFC 3947)
4569   UDP Inter-Asterisk eXchange (IAX2)
4662 TCP UDP OrbitNet Message Service
4728 TCP   Computer Associates Desktop and Server Management (DMP)/Port Multiplexer [33]
4840 TCP UDP OPC UA TCP Protocol for OPC Unified Architecture from OPC Foundation
4843 TCP UDP OPC UA TCP Protocol over TLS/SSL for OPC Unified Architecture from OPC Foundation
4847 TCP UDP Web Fresh Communication, Quadrion Software & Odorless Entertainment
4894 TCP UDP LysKOM Protocol A
4899 TCP UDP Radmin remote administration tool (program sometimes used by a Trojan horse)
4949 TCP   Munin Resource Monitoring Tool
4950 TCP UDP Cylon Controls UC32 Communications Port
5000 TCP   commplex-main
5001 TCP   commplex-link
5003 TCP UDP FileMaker
5004 TCP UDP,DCCP RTP (Real-time Transport Protocol) media data (RFC 3551, RFC 4571)
5005 TCP UDP,DCCP RTP (Real-time Transport Protocol) control protocol (RFC 3551, RFC 4571)
5051 TCP   ita-agent Symantec Intruder Alert[34]
5060 TCP UDP Session Initiation Protocol (SIP)
5061 TCP   Session Initiation Protocol (SIP) over TLS
5084 TCP UDP EPCglobal Low Level Reader Protocol (LLRP)
5085 TCP UDP EPCglobal Low Level Reader Protocol (LLRP) over TLS
5093   UDP SafeNet, Inc Sentinel LM, Sentinel RMS, License Manager, Client-to-Server
5099 TCP UDP SafeNet, Inc Sentinel LM, Sentinel RMS, License Manager, Server-to-Server
5151 TCP   ESRI SDE Instance
5151   UDP ESRI SDE Remote Start
5154 TCP UDP BZFlag
5190 TCP   ICQ and AOL Instant Messenger
5222 TCP   Extensible Messaging and Presence Protocol (XMPP) client connection (RFC 3920)
5246   UDP Control And Provisioning of Wireless Access Points (CAPWAP) CAPWAP control (RFC 5415)
5247   UDP Control And Provisioning of Wireless Access Points (CAPWAP) CAPWAP data (RFC 5415)5269 TCP   Extensible Messaging and Presence Protocol (XMPP) server connection (RFC 3920)5298 TCP UDP Extensible Messaging and Presence Protocol (XMPP) JEP-0174: Link-Local Messaging / XEP-0174: Serverless Messaging5351 TCP UDP NAT Port Mapping Protocol—client-requested configuration for inbound connections through network address translators5353 UDP Multicast DNS (mDNS)
5355 TCP UDP LLMNR—Link-Local Multicast Name Resolution, allows hosts to perform name resolution for hosts on the same local link (only provided by Windows Vista and Server 2008)
5402 TCP UDP mftp, Stratacache OmniCast content delivery system MFTP file sharing protocol
5405 TCP UDP NetSupport Manager
5421 TCP UDP NetSupport Manager
5432 TCP UDP PostgreSQL database system
5556 TCP UDP Freeciv
5631 TCP pcANYWHEREdata, Symantec pcAnywhere (version 7.52 and later[37])[38] data
5632 UDP pcANYWHEREstat, Symantec pcAnywhere (version 7.52 and later) status
5814 TCP UDP Hewlett-Packard Support Automation (HP OpenView Self-Healing Services)
5900 TCP UDP Virtual Network Computing (VNC) remote desktop protocol (used by Apple Remote Desktop and others)
5984 TCP UDP CouchDB database server
5999 TCP CVSup [40] file update tool
6000 TCP X11—used between an X client and server over the network
6001 UDP X11—used between an X client and server over the network
6005 TCP Default for BMC Software Control-M/Server—Socket used for communication between Control-M processes—though often changed during installation
6086 TCP PDTP—FTP like file server in a P2P network
6110 TCP UDP softcm, HP Softbench CM
6111 TCP UDP spc, HP Softbench Sub-Process Control
6112 TCP UDP "dtspcd"—a network daemon that accepts requests from clients to execute commands and launch applications remotely
6129 TCP DameWare Remote Control
6343 UDP SFlow, sFlow traffic monitoring
6346 TCP UDP gnutella-svc, gnutella (FrostWire, Limewire, Shareaza, etc.)
6347 TCP UDP gnutella-rtr, Gnutella alternate
6350 TCP UDP App Discovery and Access Protocol
6432 TCP PgBouncer - A connection pooler for PostgreSQL
6444 TCP UDP Sun Grid Engine—Qmaster Service
6445 TCP UDP Sun Grid Engine—Execution Service
6619 TCP UDP odette-ftps, Odette File Transfer Protocol (OFTP) over TLS/SSL
6665–6669 TCP Internet Relay Chat (IRC)
6888 TCP UDP MUSE
6969 TCP UDP acmsoda
7400 TCP UDP RTPS (Real Time Publish Subscribe) DDS Discovery
7401 TCP UDP RTPS (Real Time Publish Subscribe) DDS User-Traffic
7402 TCP UDP RTPS (Real Time Publish Subscribe) DDS Meta-Traffic
7547 TCP UDP CPE WAN Management Protocol Technical Report 069
7787-7788 TCP GFI EventsManager 7 & 8
7937-9936 TCP UDP EMC2 (Legato) Networker or Sun Solcitice Backup
8000 TCP UDP iRDMI (Intel Remote Desktop Management Interface)[45]—sometimes erroneously used instead of port 8080
8008 TCP HTTP Alternate
8080 TCP HTTP alternate (http_alt)—commonly used for Web proxy and caching server, or for running a Web server as a non-root user
8118 TCP Privoxy—advertisement-filtering Web proxy
8123 TCP Polipo Web proxy
8243 TCP UDP HTTPS listener for Apache Synapse [48]
8280 TCP UDP HTTP listener for Apache Synapse [48]
8400 TCP UDP cvp, Commvault Unified Data Management
8442 TCP UDP CyBro A-bus, Cybrotech Ltd.
8880 UDP cddbp-alt, CD DataBase (CDDB) protocol (CDDBP) alternate
8880 TCP cddbp-alt, CD DataBase (CDDB) protocol (CDDBP) alternate
8888 TCP UDP NewsEDGE server
9001 TCP UDP ETL Service Manager[49]
9009 TCP UDP Pichat Server—Peer to peer chat software
9080 UDP glrpc, Groove Collaboration software GLRPC
9080 TCP glrpc, Groove Collaboration software GLRPC
9100 TCP PDL Data Stream
9101 TCP UDP Bacula Director
9102 TCP UDP Bacula File Daemon
9103 TCP UDP Bacula Storage Daemon
9105 TCP UDP Xadmin Control Daemon
9119 TCP UDP MXit Instant Messenger
9306 TCP Sphinx Native API
9312 TCP Sphinx SphinxQL
9418 TCP UDP git, Git pack transfer service
9535 TCP UDP mngsuite, LANDesk Management Suite Remote Control
9536 TCP UDP laes-bf, IP Fabrics Surveillance buffering function
9600 UDP Omron FINS, OMRON FINS PLC communication
9800 TCP UDP WebDAV Source
9898 TCP UDP MonkeyCom
9996 TCP UDP The Palace "The Palace" Virtual Reality Chat software. – 5
10008 TCP UDP Octopus Multiplexer, primary port for the CROMP protocol, which provides a platform-independent means for communication of objects across a network
10010 TCP Open Object Rexx (ooRexx) rxapi daemon
10050 TCP UDP Zabbix-Agent
10051 TCP UDP Zabbix-Trapper
10113 TCP UDP NetIQ Endpoint
10114 TCP UDP NetIQ Qcheck
10115 TCP UDP NetIQ Endpoint
10116 TCP UDP NetIQ VoIP Assessor
11371 OpenPGP HTTP key server
12222 UDP Light Weight Access Point Protocol (LWAPP) LWAPP data (RFC 5412)
12223 UDP Light Weight Access Point Protocol (LWAPP) LWAPP control (RFC 5412)
13076 TCP Default for BMC Software Control-M/Enterprise Manager Corba communication, though often changed during installation
13720 TCP UDP Symantec NetBackup—bprd (formerly VERITAS)
13721 TCP UDP Symantec NetBackup—bpdbm (formerly VERITAS)
13724 TCP UDP Symantec Network Utility—vnetd (formerly VERITAS)
13782 TCP UDP Symantec NetBackup—bpcd (formerly VERITAS)
13783 TCP UDP Symantec VOPIED protocol (formerly VERITAS)
13785 TCP UDP Symantec NetBackup Database—nbdb (formerly VERITAS)
13786 TCP UDP Symantec nomdb (formerly VERITAS)
15000 TCP hydap, Hypack Hydrographic Software Packages Data Acquisition
15000 UDP hydap, Hypack Hydrographic Software Packages Data Acquisition
15345 TCP UDP XPilot Contact
17500 TCP Dropbox LanSync Protocol (db-lsp); used to synchronize file catalogs between Dropbox clients on your local network.
17500 UDP Dropbox LanSync Discovery (db-lsp-disc); used to synchronize file catalogs between Dropbox clients on your local network; is transmitted to broadcast addresses.
18104 TCP RAD PDF Service
19283 TCP UDP K2 - KeyAuditor & KeyServer, Sassafras Software Inc. Software Asset Management tools
19315 TCP UDP KeyShadow for K2 - KeyAuditor & KeyServer, Sassafras Software Inc. Software Asset Management tools
19999 DNP - Secure (Distributed Network Protocol - Secure), a secure version of the protocol used in SCADA systems between communicating RTU's and IED's
20000 DNP (Distributed Network Protocol), a protocol used in SCADA systems between communicating RTU's and IED's
22347 TCP UDP WibuKey, WIBU-SYSTEMS AG Software protection system
22350 TCP UDP CodeMeter, WIBU-SYSTEMS AG Software protection system
24465 TCP UDP Tonido Directory Server for Tonido which is a Personal Web App and P2P platform
24554 TCP UDP BINKP, Fidonet mail transfers over TCP/IP
26000 TCP UDP id Software's Quake server
31457 TCP TetriNET
33434 TCP UDP traceroute
40000 TCP UDP SafetyNET p Real-time Industrial Ethernet protocol
43047 TCP TheòsMessenger second port for service TheòsMessenger
43048 TCP TheòsMessenger third port for service TheòsMessenger
47808 TCP UDP BACnet Building Automation and Control Networks (4780810 = BAC016)

CCIE R&S Lab Equipment and IOS Version

2010-12-15T00:37:00.000-08:00

1841 series routers - IOS 12.4(T) – Advanced Enterprise Services
3825 series routers - IOS 12.4(T) – Advanced Enterprise Services
Catalyst 3560 Series switches running IOS version 12.2 - Advanced IP Services

common network related dos command

2010-12-13T06:52:00.000-08:00

ipconfig [/all] [/renew]
arp -a
ftp
nslookup
ping
tracert
telnet
netstat
netstat -ano | findstr " 80"
tasklist | findstar " pid"

some common cisco command

2010-12-08T21:41:00.001-08:00

ip name-server xxx.xxx.xxx.xxx
sntp server hk.pool.ntp.org
clear interface virtual-access [number]
logging buffer 51200 debug
clock set 10:50:00 Oct 26 2006
clock timezone HKT 8
service timestamps debug datetime msec localtime
service timestamps log datetime msec localtime

show process cpu
show process cpu sorted

sh ip cac flow – show current traffic of specified interface**
sh ip accounting – show accumulated traffic of specified interface**
clear ip flow stats
clear counter [interface]

show process memory
show process memory sorted
show memory allocating-process totals
show memory summary
show memory statistics
show memory dead
show memory free
show memory bigger

show buffers
show buffer old

router#config t
router(config)#int vlan1
router(config-if)#ip route-cache flow
OR
router(config-if)#ip accounting (may cause memory low/exhaust, remember to deactivate!)
router(config-if)#^Z
router#sh ip cac flow

Router#reload in 5

ip nat translation tcp-timeout 300
ip nat translation udp-timeout 200
ip nat translation max-entries list 2 100
access-list 2 permit 10.1.68.173

zyxel command

2010-12-08T21:40:00.001-08:00

ip nat reset [interface]
ip dhcp enif0 stat
ip dhcp enif0 server rele 1
ip arp flush
ip route st

sys filter netbios disp
sys reboot
sys log disp

324
ip nat iface wanif0

common DNS record type

2010-12-07T17:30:00.000-08:00

A: address record
CNAME: Canonical name record
MX: mail exchange record
NS: name server record
PTR: pointer record RFC 1035
TXT (SPF): Sender Policy Framework RFC 4408

DNS tools: nslookup and dig

2010-12-07T06:27:00.000-08:00

nslookup

list the query type: set q=any (if want to display all)
change the DNS server: server dns_server_ip
list the zone record: ls -d [domain_name]
check ptr: set type=ptr, then type the ip address you want...

dig - DNS lookup utility

SYNOPSIS

dig [ @server ] [ -b address ] [ -c class ] [ -f filename ] [ -k filename ] [ -p port# ] [ -t type ] [ -x addr ] [ -y name:key ] [ name ] [ type ] [ class ] [ queryopt... ]
dig [ -h ]
dig [ global-queryopt... ] [ query... ]

case: telnet web port Dec 7 2010

2010-12-06T23:14:00.000-08:00

Customer report he should not have the certificate on his nas server. but when doing the port checking, found the ssl module is running
P334> ip telnet 192.168.0.55 5000
Resolving 192.168.0.55... Connected to 192.168.0.55
Escape character is '^]'.
exit

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="http://(null)/webman/index.cgi">here</a>.</p>
<hr>
<address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/1.0.0a Server at * Port 5000</address>
</body></html>
Telnet session with remote host terminated.

SMTP protocol telnet simulation

2010-12-06T19:28:00.000-08:00

telnet smtp.foo.com 25
S: 220 foo.com Simple Mail Transfer Service Ready
C: EHLO bar.com
S: 250-foo.com greets bar.com
S: 250-8BITMIME
S: 250-SIZE
S: 250-DSN
S: 250 HELP
C: MAIL FROM:<Smith@bar.com>
S: 250 OK
C: RCPT TO:<Jones@foo.com>
S: 250 OK
C: RCPT TO:<Green@foo.com>
S: 550 No such user here
C: RCPT TO:<Brown@foo.com>

S: 250 OK
C: DATA
S: 354 Start mail input; end with <CRLF>.<CRLF>
C: Blah blah blah...
C: ...etc. etc. etc.
C: .
S: 250 OK
C: QUIT
S: 221 foo.com Service closing transmission channel

POP3 protocol telnet simulation

2010-12-06T19:26:00.001-08:00

> telnet pop.xxx.com 110
Trying xxx.xxx.xxx.xxx
Connected to pop.xxx.com.
Escape character is '^]'.
+OK POP3 Ready ospop1 0002002c
user honying@abc.com.hk
+OK USER honying@abc.com.hk set, mate
pass kokogoda
+OK Logged in.
quit
+OK Logging out.

S:    +OK POP3 server ready <1896.697170952@dbc.mtview.ca.us>
C:    APOP mrose c4c9334bac560ecc979e58001b3e22fb
S:    +OK mrose's maildrop has 2 messages (320 octets)
C:    STAT
S:    +OK 2 320
C:    LIST
S:    +OK 2 messages (320 octets)
S:    1 120
S:    2 200
S:    .
C:    RETR 1
S:    +OK 120 octets
S:    <the POP3 server sends message 1>
S:    .
C:    DELE 1
S:    +OK message 1 deleted
C:    RETR 2
S:    +OK 200 octets
S:    <the POP3 server sends message 2>
C:    QUIT
S:    +OK dewey POP3 server signing off (maildrop empty)