1. HTTP/HTTPS (Hypertext Transfer Protocol / Secure)
The bedrock of web communication, HTTP defines how messages are formatted and transmitted between web servers and browsers. Operating over TCP port 80, it follows a client-server request-response model. HTTPS (port 443) adds a layer of encryption via TLS/SSL, ensuring data integrity and confidentiality. For the IT professional, understanding HTTP methods (GET, POST, PUT, DELETE), status codes (200, 404, 500), and headers is non-negotiable for debugging web applications, configuring load balancers, and securing APIs. Tools like curl and browser developer consoles rely on this protocol for diagnostics.
2. TCP (Transmission Control Protocol)
As a core protocol of the Internet Protocol Suite, TCP provides reliable, ordered, and error-checked delivery of a stream of bytes between applications. It establishes a connection via a three-way handshake (SYN, SYN-ACK, ACK) before data transfer. Key concepts include sequence numbers, acknowledgment numbers, window scaling, and congestion control algorithms (e.g., Reno, Cubic, BBR). IT professionals must master TCP for tuning network performance, troubleshooting packet loss or retransmission issues using tcpdump or Wireshark, and understanding how applications like file transfers or databases ensure data reliability.
3. IP (Internet Protocol)
IP is the principal communication protocol for relaying datagrams across network boundaries. IPv4 (32-bit address, e.g., 192.168.1.1) remains dominant, while IPv6 (128-bit address) addresses address exhaustion. Key duties include packet fragmentation, routing, and addressing. Subnetting, CIDR notation, and the role of routing protocols (e.g., OSPF, BGP) in updating IP routing tables are critical knowledge. An IT pro must handle IP address planning, troubleshoot routing loops via traceroute, and understand the implications of NAT (Network Address Translation) on end-to-end connectivity.
4. DNS (Domain Name System)
DNS translates human-readable domain names (e.g., example.com) into IP addresses. Operating primarily over UDP port 53 (with TCP for zone transfers and responses larger than 512 bytes), it uses a hierarchical structure: root servers, TLD servers, and authoritative nameservers. Record types include A (IPv4), AAAA (IPv6), CNAME (alias), MX (mail exchange), and TXT (text, often for SPF/DKIM). IT professionals must master DNS resolution flow (recursive vs. iterative), caching mechanisms, TTL values, and troubleshooting tools like nslookup, dig, and nslookup. Misconfigured DNS is a primary cause of application downtime.
5. DHCP (Dynamic Host Configuration Protocol)
Automating IP address allocation, DHCP eliminates manual configuration. A four-step process (DORA: Discover, Offer, Request, Acknowledge) operates over UDP ports 67 (server) and 68 (client). DHCP servers assign IPs from predefined scopes, along with subnet masks, default gateways, DNS servers, and lease durations. IT professionals must configure DHCP scopes, reservations for static devices (e.g., printers), and handle conflicts. Understanding DHCP relay agents is vital for distributing addresses across different VLANs, and logs are essential for diagnosing IP exhaustion or rogue DHCP servers.
6. SSH (Secure Shell)
SSH provides encrypted remote login and command execution over an unsecured network, replacing Telnet (which sends data in plaintext). Typically using TCP port 22, it employs public-key cryptography for authentication and symmetric encryption for session data. Key features include port forwarding (tunneling), SCP (secure copy), and SFTP (SSH File Transfer Protocol). For an IT pro, SSH is the primary method for managing Linux/Unix servers, network equipment, and cloud instances. Understanding key pair generation (ssh-keygen), configuration files (sshd_config), and security hardening (e.g., disabling root login) is essential.
7. SNMP (Simple Network Management Protocol)
Designed for monitoring and managing network devices (routers, switches, servers, printers), SNMP uses a manager-agent model. The manager polls agents for performance data (e.g., CPU load, interface bandwidth) via OIDs (Object Identifiers) organized in MIBs (Management Information Bases). Version 2c uses community strings for authentication; Version 3 offers encryption and authentication. IT professionals must configure SNMP agents, set up trap notifications (asynchronous alerts), and integrate with monitoring tools like Nagios, Zabbix, or PRTG. Understanding snmpwalk and snmpget is critical for collecting granular metrics.
8. BGP (Border Gateway Protocol)
The Internet’s single most critical routing protocol, BGP is a path-vector protocol that connects autonomous systems (ASes). It makes routing decisions based on policies, paths, and attributes (AS_PATH, NEXT_HOP, LOCAL_PREF, MED). BGP operates over TCP port 179. IT professionals in ISPs, large enterprises, or cloud providers must understand BGP for multi-homing (connecting to two ISPs), load balancing, and failover. Key concepts include BGP peering, route advertisement, prefix filtering, and the dangers of route hijacking or flapping. Analyzing BGP tables via show ip bgp is a daily task for network engineers.
9. TLS/SSL (Transport Layer Security / Secure Sockets Layer)
While not a single protocol in isolation, TLS is the cryptographic foundation for secure communications over networks. It operates between the transport layer (TCP) and the application layer, providing encryption, authentication, and integrity. The handshake involves cipher suite negotiation (e.g., TLS_AES_128_GCM_SHA256), certificate exchange (X.509), and key generation using Diffie-Hellman or RSA. IT professionals must manage certificate lifecycles—issuance, renewal, revocation (via CRLs or OCSP)—and configure TLS on web servers (Apache, Nginx), mail servers, and load balancers. Understanding deprecated versions (SSLv3, TLS 1.0/1.1) and perfect forward secrecy is vital for security audits.
10. ARP (Address Resolution Protocol)
ARP operates at the link layer to map IPv4 addresses to physical MAC addresses within a local network segment. When a host needs to send a packet to another host on the same LAN, it broadcasts an ARP request (“Who has IP X?”) and receives a unicast reply with the target MAC. The results are cached (ARP table) to reduce broadcasts. For IT professionals, ARP is essential for troubleshooting Layer 2 connectivity issues (e.g., duplicate IP addresses causing ARP conflicts), detecting ARP spoofing attacks (part of network security), and understanding the role of proxy ARP in subnet routing. Commands like arp -a (Windows) or ip neigh (Linux) reveal the cache. Note: IPv6 uses NDP (Neighbor Discovery Protocol) instead of ARP.