Common Application Protocols

Updated

September 4, 2026

Common Application Protocols

Application protocols give meaning to payloads. Operators still need a working vocabulary: DNS, DHCP, HTTP, SSH, and TLS appear in almost every network design.

Learning goals

  • Place common apps on TCP/UDP and well-known ports
  • Describe DNS resolution flow at a high level
  • Describe DHCP DORA and where relays fit
  • Separate HTTP from TLS and from TCP failures
  • Know what SSH needs from the network

Map (operator cheat sheet)

Protocol Transport Port(s) Role
DNS UDP/TCP 53 Name → address (and more)
DHCP UDP 67/68 IPv4 host config
DHCPv6 UDP 546/547 IPv6 host config
HTTP TCP 80 Web (cleartext)
HTTPS TCP 443 HTTP over TLS
SSH TCP 22 Secure shell / SFTP
NTP UDP 123 Time
BGP TCP 179 Routing (control plane app)
SNMP UDP 161/162 Legacy management

DNS

Roles

Role Function
Stub resolver On the host; asks a recursive resolver
Recursive resolver Walks the tree for the answer
Authoritative server Holds zone data

Query types (common)

Type Meaning
A IPv4 address
AAAA IPv6 address
CNAME Alias
MX / TXT / SRV Mail, text, services 
# Linux lab host examples
getent hosts example.com
# if dig/nslookup installed:
# dig +short A example.com
# dig +short AAAA example.com

Failure patterns

Symptom Check
Names fail, IPs work DNS config, UDP/53 filters, resolver reachability
Slow apps Timeouts to dead resolvers
Wrong address Cache, split DNS, hosts file

DHCP (IPv4)

DORA: Discover → Offer → Request → Ack

  • Client uses broadcasts initially (needs L2 reachability to server or relay)
  • Server assigns IP, mask, gateway, DNS, lease time
Client --L2 domain-- DHCP server
Client --L2-- Relay --L3-- DHCP server

Edge designs with helpers/relays: later Edge & services part.

HTTP and HTTPS

HTTP:  App ──TCP:80── Server
HTTPS: App ──TCP:443── TLS ── HTTP ── Server
Failure Layer to inspect
TCP SYN timeout Path, ACL, listen socket
TCP up, TLS error Certificates, SNI, protocol mismatch
TLS up, HTTP 5xx Application 
curl -v http://192.0.2.10/
curl -vk https://192.0.2.10/

SSH

  • TCP/22 (by default)
  • Needs bidirectional path and allowed security policy
  • Used heavily for lab and production management
ssh user@192.0.2.10
ss -tlnp | grep 22

TLS in one paragraph

TLS provides encryption and authentication above TCP (classically). Network engineers care when: MTU/PMTUD breaks large records, middleboxes interfere, or certificates expire. Crypto suite deep-dives are optional here.

NTP and time

Broken time breaks auth (Kerberos, cert validation) and log correlation. Lab VMs often need chrony/ntp or host sync.

Lab sketch

  1. DNS: break /etc/resolv.conf; compare ping by name vs by IP
  2. HTTP: capture TCP/80 three-way + first GET
  3. SSH: confirm LISTEN on 22; ACL drop and observe client timeout

Checkpoint

User says “the network is down” but ping by IP works and curl by name fails. List the top three protocol checks in order.

Next