Network Intrusion Analysis · Topic 5 of 7

Protocol Fields: DNS, Mail, HTTP and ARP

Interpret DNS, SMTP, POP3, IMAP, HTTP, HTTPS, HTTP/2 and ARP fields and messages, and learn the signs of misuse that an analyst looks for in each.

5 min

In a nutshell

DNS uses port 53, and long or random names suggest tunnelling or malware.
SMTP uses port 25, POP3 uses 110 and IMAP uses 143, with 995 and 993 for the TLS versions.
POP3 and IMAP without TLS expose passwords in clear text.

What it is

Application protocols carry the actual requests that users and malware make, so their fields show what the traffic was for.

This page covers DNS, the three common email protocols, the web protocols and ARP. For each, learn the port, the key fields and the signs of misuse.

ARP sits at the link layer and is included because it is abused on local networks.

How it works

Each protocol has typical ports, fields and abuse patterns.

DNS

DNS turns names into addresses, normally on UDP or TCP port 53. A message has a header with an ID, flags and counts, then the question and the answers.

Record type	Holds
A	An IPv4 address for a name
AAAA	An IPv6 address
MX	The mail server for a domain
NS	The name servers for a domain
CNAME	An alias to another name
TXT	Free text, used for many purposes

Signs of misuse include very long or random looking names, a large number of queries to one domain, and many TXT lookups. These suggest DNS tunnelling or a domain generation algorithm used by malware. Lookups for newly seen domains can also indicate command and control.

SMTP, POP3 and IMAP

Protocol	Purpose	Port
SMTP	Sends and relays mail between servers	25
SMTP submission	A client sends mail to its server	587
POP3	A client downloads mail	110, and 995 with TLS
IMAP	A client reads mail kept on the server	143, and 993 with TLS

SMTP uses text commands such as EHLO, MAIL FROM, RCPT TO and DATA. The sender, recipient and message headers are visible in a capture if the session is not encrypted. POP3 and IMAP carry the user name and password in clear text when they are not protected with TLS.

An analyst looks at the sender and the return path, the subject, attachments and the path of mail servers in the headers. A mismatch between the displayed sender and the real sender suggests phishing. A host that sends large amounts of mail on port 25 and is not a mail server may be infected.

HTTP, HTTPS and HTTP/2

HTTP is the web protocol, on port 80. HTTPS is HTTP inside TLS, on port 443.

An HTTP request has a method, a path, headers and sometimes a body. A response has a status code, headers and a body.

Item	Examples and meaning
Methods	GET reads a resource, POST sends data
Status codes	200 success, 301 and 302 redirects, 401 and 403 access problems, 404 not found, 500 server error
Headers	Host, User-Agent, Content-Type, Cookie, Referer

GET /index.php?id=5 HTTP/1.1
Host: shop.example.test
User-Agent: curl/8.0

Odd values point to trouble. A tool name in the User-Agent, many 404 responses from one client, or a POST to an unexpected path can show scanning or attack. Long encoded strings in a path or parameter can show an injection attempt.

HTTP/2 carries the same ideas in a binary form. It sends many requests at once over a single connection, called multiplexing, and compresses headers. Browsers use it over TLS, so the content is not readable in a capture without keys.

With HTTPS, a capture shows addresses, ports, sizes and the TLS handshake, but not the request. The handshake can still show the server name and the certificate in some versions.

ARP

ARP maps an IPv4 address to a MAC address on the local network. A host broadcasts a request asking who has an address, and the owner replies directly.

The key fields are the opcode, with 1 for a request and 2 for a reply, and the sender and target MAC and IP addresses.

ARP has no authentication, so any host can send a reply. ARP spoofing sends false replies so that traffic goes to the attacker. Signs include replies nobody asked for, and two different MAC addresses claiming the same IP address.

Switch# show ip arp

What to remember for the exam

Seven facts cover most questions on this topic.

DNS uses port 53, and long or random names suggest tunnelling or malware.
SMTP uses port 25, POP3 uses 110 and IMAP uses 143, with 995 and 993 for the TLS versions.
POP3 and IMAP without TLS expose passwords in clear text.
HTTP uses port 80 and HTTPS uses port 443.
HTTP methods and status codes show what was asked and answered.
HTTP/2 is binary and multiplexed, and browsers use it over TLS.
ARP replies are unauthenticated, so duplicate or unrequested replies suggest spoofing.

Exam tip

A flood of DNS queries with long random subdomains is a classic sign of DNS tunnelling.

Common mistakes

These four errors appear often.

Assuming HTTPS content is visible in a capture. Only metadata is visible without keys.

Confusing the mail protocols. SMTP sends, while POP3 and IMAP retrieve.

Trusting the displayed sender of an email. The real sender and path are in the headers.

Treating all unusual DNS as attack. Content delivery networks and some services use long names.

Watch out

ARP spoofing works only on the local network, so it points to a host inside the same segment.

Check yourself

Work through these three questions.

Which sign in DNS traffic suggests tunnelling?
Very long or random names, and many queries to one domain, especially with TXT lookups.
What is the difference between SMTP and IMAP?
SMTP sends and relays mail. IMAP lets a client read mail that stays on the server.
Why is ARP easy to abuse?
ARP has no authentication, so any host can send a reply that points traffic to the attacker.

Topic 5 of 7 in Network Intrusion Analysis

Test yourself on Network Intrusion Analysis

The full Cisco CCNA 200-201 CBROPS question bank has 754 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.