# Core Protocols & Services

To detect anomalies, you must know what normal looks like. Attackers constantly abuse these foundational protocols.

## DNS (Domain Name System)
*   **Port:** UDP 53 (and sometimes TCP 53)
*   **Function:** The phonebook of the internet. It translates human-readable domain names (`infoseclabs.com`) into machine IP addresses (`104.21.5.12`).
*   **Security Context:** Attackers use DNS for Command & Control (C2) beacons, data exfiltration (DNS Tunneling), and redirecting traffic via DNS Spoofing.

## DHCP (Dynamic Host Configuration Protocol)
*   **Port:** UDP 67 (Server) and UDP 68 (Client)
*   **Function:** Automatically assigns IP addresses, Subnet Masks, and Default Gateways to devices when they join a network.
*   **Security Context:** Rogue DHCP servers can assign malicious DNS settings to victim computers, executing Man-In-The-Middle attacks almost invisibly.

## ARP (Address Resolution Protocol)
*   **Layer:** Layer 2 (Data Link) / Layer 3 (Network) boundary.
*   **Function:** Maps an IP address to a physical MAC address on a local network. If computer A (IP 10.0.0.5) wants to talk to the Router (IP 10.0.0.1) on the same Wi-Fi, it shouts "Who has 10.0.0.1?" via ARP. The router replies with its physical MAC address so the switch knows where to send the frame.
*   **Security Context:** **ARP Spoofing**. An attacker can lie and reply to the ARP request saying *they* are the router. The victim then sends all their traffic to the hacker instead of the real router.

## ICMP (Internet Control Message Protocol)
*   **Layer:** Layer 3 (Network)
*   **Function:** Used for network diagnostics and error reporting. It is not used for transferring data between systems. The `ping` command and `traceroute` commands use ICMP Echo Requests and Echo Replies.
*   **Security Context:** Attackers use ICMP for "Ping Sweeps" to map out live hosts on a network. It can also be abused for ICMP tunneling to bypass firewalls or launch Smurf DDoS attacks.

## HTTP/HTTPS (Hypertext Transfer Protocol)
*   **Port:** TCP 80 (HTTP) and TCP 443 (HTTPS)
*   **Function:** Foundation of the World Wide Web. Facilitates downloading web pages, submitting forms (POST), and API communication. HTTPS adds a layer of encryption (TLS/SSL) to secure the data in transit.
*   **Security Context:** The vast majority of malware C2 traffic hides inside HTTPS, blending in with regular employee web browsing to evade detection by firewalls.