Chapter 2 — Networks and protocols
Lesson map
Lesson 02 published. Map, example, EX005.
flowchart TD
N0["Learning outcomes"]
N1["2.1 Approved listeners"]
N2["2.2 Protocol basics"]
N3["2.3 No freestyle scanning"]
N4["2.4 Name mismatches"]
N5["2.5 Egress paths"]
N6["2.6 Logging"]
N7["2.7 TCP versus application identity"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX005"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["2.1 Approved listeners"]
N2["2.2 Protocol basics"]
N3["2.3 No freestyle scanning"]
N4["2.4 Name mismatches"]
N5["2.5 Egress paths"]
N6["2.6 Logging"]
N7["2.7 TCP versus application identity"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX005"]
[Learning outcomes]
|
v
[2.1 Approved listeners]
|
v
[2.2 Protocol basics]
|
v
[2.3 No freestyle scanning]
|
v
[2.4 Name mismatches]
|
v
[2.5 Egress paths]
|
v
[2.6 Logging]
|
v
[2.7 TCP versus application identity]
|
v
[Worked example] --> [Exercise EX005]
Learning outcomes
You will (1) read common ports in an approved list; (2) flag unapproved listeners from a synthetic list; (3) explain why protocol choice matters for testing; (4) avoid scanning without authorization.
2.1 Approved listeners
NMT publishes an approved list for the staging web VLAN: 80/http, 443/https, 22/ssh-jump. Anything else is reported, not "interesting to poke".
"""Lab 2: classify synthetic listening ports against an approved service list (no scanning)."""
approved = {80: "http", 443: "https", 22: "ssh-jump"}
observed = [(80, "http"), (443, "https"), (22, "ssh"), (3389, "rdp"), (8080, "http-alt")]
for port, name in observed:
if port not in approved:
print(f"{port:5}/{name:8} NOT APPROVED - report")
elif name.split("-")[0] != approved[port].split("-")[0]:
print(f"{port:5}/{name:8} unexpected name (expected {approved[port]})")
else:
print(f"{port:5}/{name:8} ok")
Run with python3 lab_ports.py. Verified output:
80/http ok
443/https ok
22/ssh ok
3389/rdp NOT APPROVED - report
8080/http-alt NOT APPROVED - report
The verified lab_ports block is pasted into the ENG-512 notebook: 80, 443 and 22 ok; 3389/rdp and 8080/http-alt NOT APPROVED - report. Sam's approved listeners are only the ones on the signed list; anything else becomes a finding, not a bonus scan target. Those two lines become tickets the same day. Because the lab reads a fixed list, rerunning it prints the same five lines until the inventory itself changes.
2.2 Protocol basics
HTTP/HTTPS carry the website and API; SSH reaches jump hosts; RDP on a web VLAN is unexpected. Testers describe what they see without sending exploit traffic. Sam's method notes name the protocol basics for ENG-512: HTTPS for journey planner checks, SSH only to named jump hosts, and RDP as an unapproved listener to report. He does not invent exotic protocol checks outside the ROE, and protocol identity still needs the port map from lab_ports. Protocol curiosity beyond that list waits for a ROE change.
2.3 No freestyle scanning
Even listing ports on production needs authorization; the lab in this chapter only classifies a synthetic list offline. No freestyle scanning means Sam does not add ports because a tool suggested them. If 3389 or 8080 appear as NOT APPROVED, he reports them and stops; freestyle expansion of ENG-512 is how fare-adjacent hosts get touched by accident. Kickoff includes reading the no-freestyle-scanning line aloud. Ports suggested by tools go to a parking-lot issue, never into the live inventory mid-window. The issue is reviewed with the network owner after the window, and only a signed ROE change can promote a parked port to the approved list.
2.4 Name mismatches
Port 22 labelled only "ssh" still matches the approved ssh-jump family in the lab, but Sam notes the inventory name for cleanup. Name mismatches of another kind, a DNS label that points at a different IP than the ROE host list, are pause conditions. Sam asks the network owner before continuing; guessing that api-staging is safe because the name says staging has already caused scope errors at NMT. A DNS mismatch pause records the queried name, the answer, the ROE address and the owner's reply. Resuming without that written reply fails peer review.
2.5 Egress paths
Staff laptops that can reach staging and the Internet may bridge environments; the ROE states which source networks are allowed. Egress paths from staging jump hosts are listed so Sam knows which outbound destinations his checks may hit. If a staging jump host suddenly reaches a fare-vendor prefix or cloud, Sam stops the window and asks the network team to classify the path in writing. Chasing that path as a discovery mid-window is out of scope, however interesting it looks.
2.6 Logging
Network teams may mirror authorized test sources; Sam coordinates so his traffic is attributable. Logging of ENG-512 start, stop and pauses goes to the engagement channel, and every line carries the ticket id and the clock time so the SOC can filter testing noise. The SOC uses those lines when rider apps slow; silence leaves them guessing whether Sam's checks are involved. The wording of the 10:12 loop drill from Chapter 8 is reused when a live stop happens, so responders recognise the format at once.
2.7 TCP versus application identity
A port being open is not the same as a service being safe. Sam records both the port and the application banner or certificate name when inventory allows. TCP open on 443 does not prove the journey planner API is healthy; application identity still needs a method card. After ports classify clean, Sam runs the application method card on the journey planner and records both results, so findings are not port-only theatre. A green TCP port alone never becomes a clean bill of health.
2.8 Reporting unapproved listeners
Unapproved does not mean "exploit now". It means open a ticket, attach the synthetic observation, and wait for the owner to confirm whether the service should exist. 3389/rdp and 8080/http-alt therefore leave ENG-512 as findings with owners, not as quiet notes. Sam files them the same day, quoting the NOT APPROVED lines from lab_ports verbatim, so the network team can close or authorize them before the next Saturday instead of leaving them as chat folklore that examiners never see. Closure is disable or deliberate future authorization, not a quiet ignore.
Worked example (synthetic NMT)
Sam classifies the synthetic list: 80, 443 and 22 are ok; 3389/rdp and 8080/http-alt are NOT APPROVED. He opens a ticket for the two unapproved listeners on staging.
Synthetic case — Northline Municipal Transit (NMT). The transit agency, Sam Park and all figures are invented for teaching.
Errors and limits
Live transit systems and fare equipment are never tested without a separate, specialised authorization. This book uses synthetic data only and grants no authority to test real systems.
Exercises
- EX005 — Unapproved. Which two listeners does the lab mark NOT APPROVED? Rubric: 3 = 3389/rdp and 8080/http-alt; 2 = one; 1 = wrong; 0 = none.
- EX006 — Why RDP matters. Why is RDP on the web VLAN a concern? Rubric: 3 = unexpected remote desktop exposure; broad attack surface; 2 = partial; 1 = fine; 0 = none.
- EX007 — Authorization. May Sam port-scan production to build his own list? Rubric: 3 = no without written authorization; 2 = no; 1 = yes; 0 = none.
- EX008 — Inventory follow-up. What does Sam do after the lab about the ssh name? Rubric: 3 = note inventory name cleanup; keep using jump process; 2 = partial; 1 = ignore; 0 = none.
Synthesis
Approved lists turn raw ports into tickets; freestyle scanning stays forbidden.
Continue studying — chapter 02 of 18
← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →