I85PREP
⌘ K
CNPA study materials
CNPA study resources

CNPA: Network Services and Application Protocols

CNPA · Work through your exam, one topic at a time.

All guide sections

Network Services and Application Protocols

This domain covers the protocols that make a network usable: name resolution, address assignment, address translation, time synchronisation and management, plus the well-known ports examiners love. Expect record-type, port-number and message-sequence items.

DNS

  • Hierarchy: root, top-level domain, authoritative. Resolvers perform recursive lookups; servers answer iteratively.
  • Records: A (IPv4), AAAA (IPv6), CNAME (alias), MX (mail), NS (delegation), PTR (reverse lookup), SOA (zone authority), TXT (verification, SPF/DKIM).
  • Port 53; UDP for normal queries, TCP for zone transfers and larger responses. TTL controls how long resolvers cache.

DHCP

  • DORA: Discover (client broadcast) → Offer → Request → Acknowledge.
  • Server UDP 67, client UDP 68. The lease carries address, mask, gateway, DNS servers and lease time.
  • Broadcasts do not cross routers: configure an ip helper-address on the client's gateway interface so the request is relayed with giaddr set and the server selects the right pool.

NAT, time and management

  • Static NAT is one-to-one; dynamic NAT draws from a pool; PAT/overload multiplexes using source ports. NAT hides internal addressing but is not a security control.
  • NTP uses UDP 123 and a hierarchical stratum model; stratum 1 syncs to a reference clock.
  • SNMP uses UDP 161 for polling and 162 for traps; syslog uses UDP 514; NetFlow provides flow accounting.

Ports to memorise

FTP 20/21, SSH 22, Telnet 23, SMTP 25 (submission 587), DNS 53, DHCP 67/68, TFTP 69/UDP, HTTP 80, POP3 110, NTP 123/UDP, IMAP 143, SNMP 161/162, LDAP 389, HTTPS 443, LDAPS 636, RDP 3389, SIP 5060/5061.

Worked example

A laptop at 10.2.2.50/24 with gateway 10.2.2.1 receives no address, while the DHCP server sits at 10.1.1.10. The Discover is sent to 255.255.255.255 and stops at the router. Adding ip helper-address 10.1.1.10 to interface 10.2.2.1 forwards the request as unicast with giaddr 10.2.2.1, so the server allocates from the 10.2.2.0/24 pool. Without the helper, the client self-assigns a 169.254.x.x address.

Traps

  • TFTP is UDP 69, not TCP.
  • FTP active mode uses server port 20 for data; passive mode uses a random high port.
  • Confusing POP3 and IMAP (retrieval/synchronisation) with SMTP (submission and relay).
  • Assuming SNMP traps arrive on port 161 rather than 162.