Network Protocols Index

What is a Network Protocol?

A network protocol is a set of rules that govern the communication between devices over a computer network. It specifies how data is transmitted over a network, how devices identify and authenticate each other, the format of the data, the order in which the data is sent, how errors are handled, and how data is recovered if it is lost or corrupted during transmission.

Network protocols define the methods by which devices communicate with each other, enabling them to send and receive data, establish connections, and manage network resources.

By using predefined protocols, devices from different manufacturers and running different software can communicate with each other seamlessly. This enables networks to function reliably and efficiently, and facilitates the exchange of information between devices across the globe.

At WireX Systems we analyze over a hundred different protocols and extract thousands of different attributes and commands from protocol payloads. Here is a sample list of protocols, describing how these protocols work, what are they used for, how they were used in an attack scenario and relevant correlation to the MITRE ATT&CK® Framework as well as sample attributes that WireX Systems is analyzing, extracting, compressing and indexing from the protocol payload.

DCOM

The Distributed Component Object Model (DCOM) protocol is a Microsoft technology that extends the Component Object Model (COM) to support communication between objects across a network.

WinReg

The Windows Registry (WinReg) protocol is a communication protocol used by the Windows operating system to access and manage the Windows Registry.

SAMR

The Server Message Block (SMB) protocol is a network file-sharing protocol that enables applications to read and write to files and to request services from server programs on a computer network.

PostgreSQL

The PostgreSQL protocol is the communication protocol used by PostgreSQL, an open-source relational database management system (RDBMS).

UPnP

Universal Plug and Play (UPnP) is a set of networking protocols designed to enable devices to discover each other and automatically establish communication and collaboration.

MYSQL

The MySQL protocol is a client-server protocol that facilitates communication between a MySQL client and a MySQL server. It is designed to enable the transmission of SQL queries and the reception of query results between the two parties.

HSRP

The Hot Standby Router Protocol (HSRP) is a Cisco-proprietary redundancy protocol for establishing fault-tolerant, default-gateway configurations on a network.

Syslog

Syslog is a standardized protocol used for transmitting log messages in computer systems, particularly from network devices to a central log server. It is widely used for event logging, error messages, diagnostics, and auditing purposes.

OSPF

OSPF (Open Shortest Path First) is a widely used link-state routing protocol in IP networks. It is an interior gateway protocol (IGP) and part of the Internet Protocol suite, designed to exchange routing information within an autonomous system (AS).

RIP

Routing Information Protocol (RIP) is a distance-vector routing protocol used to determine the best path for data to travel through a network.

SCADA

SCADA (Supervisory Control and Data Acquisition) is a type of industrial control system (ICS) used for monitoring, controlling, and managing industrial processes and critical infrastructure.

BGP

Border Gateway Protocol (BGP) is a standardized exterior gateway protocol designed to exchange routing and reachability information between autonomous systems on the Internet.

IMAP

Internet Message Access Protocol (IMAP) is an application layer protocol used for accessing and managing email messages stored on a mail server.

L2TP

Layer 2 Tunneling Protocol (L2TP) is a network protocol that enables the creation of virtual private networks (VPNs) by encapsulating data packets from one network to another.

Kerberos

Kerberos is a network authentication protocol that allows secure communication and authentication between clients and services within a distributed computing environment.

TACACS

TACACS (Terminal Access Controller Access-Control System) is a network protocol that provides centralized authentication, authorization, and accounting (AAA) services for network devices, such as routers, switches, and firewalls.

WHOIS

WHOIS is a network protocol used to query databases containing information about the registration and ownership of domain names, IP addresses, and autonomous systems.

ARP

Address Resolution Protocol (ARP) is a network protocol used to map an Internet Protocol (IP) address to a physical address, such as a Media Access Control (MAC) address, on a local network.

VNC

VNC, or Virtual Network Computing, is a remote desktop protocol that allows users to access and control a computer’s graphical desktop environment over a network connection.

RADIUS

RADIUS (Remote Authentication Dial-In User Service) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA) management for users who connect to and use a network service.

LDAP

LDAP, or the Lightweight Directory Access Protocol, is a network protocol used for accessing and managing directory services over an Internet Protocol (IP) network.

RPC

RPC ((Remote Procedure Call) sometimes called RPCP(Remote Procedure Call Protocol)) is a communication protocol used by computer systems to enable one system to request services or functions from another system over a network.

Netflow

NetFlow is a network protocol developed by Cisco Systems for collecting and analyzing IP network traffic data.

IRC

Internet Relay Chat (IRC) is an application layer protocol that facilitates text-based communication in real-time over the internet.

RDP

Remote Desktop Protocol (RDP) is a proprietary network protocol developed by Microsoft, enabling users to remotely connect and manage another computer or device over a network connection.