Skill Name: Server Service Principle
Categorize Tag: Basics Principle
Skill Content: In Internet Protocol, a network server is a device(host) providing TCP/UDP service.
Skill Description: Although the network status of a host is different, a server should listen on major services and only in a few situations will the server will connect to outside automatically. For example, system updating, AV-patterns updating, and applications' updating. Thus, unless those 3 situations, the network traffic should not find a direct session from server to an outside host.
Therefore, a server host is under the following situations to connect outside:
- (A) A server service that needs forward/backward connection such as DNS server service.
- (B) A service that needs external updating communication.
- (C) A misconfiguration that causes an outside network session such as SMB share folder, and WPAD incorrect config setting.
- (D) An abnormal behavior that needs connecting to unknown hosts such as Trojan, RAT, Network Worm and Beacon.
NSPA suggested display filter of Wireshark:
tcp.flags.syn==1 and tcp.flags.ack==0 and ip.src==Server_IP
tcp.flags.syn==1 and tcp.flags.ack==0 and (ip.src in {Server_IP1 Server_IP2 Server_net/16})
Online Course: https://youtu.be/Vy3p3V0Q2A4
Analytical Example: https://www.hugediamond.net/shop
------------------------------------------------------------------------
Extent Information:
Español: En Protocolo de Internet, un servidor de red es un dispositivo (host) que proporciona el servicio TCP / UDP.
Franch: Dans Internet Protocol, un serveur réseau est un périphérique (hôte) fournissant un service TCP/UDP.
German: Im Internet Protocol ist ein Netzwerkserver ein Gerät (Host), das einen TCP/UDP-Dienst bereitstellt.
Chinese: 在 Internet 協議中，網絡服務器是提供 TCP/UDP 服務的設備（主機）。
Japanese: インターネットプロトコルでは、ネットワークサーバーはTCP / UDPサービスを提供するデバイス（ホスト）です。
Vietnamese: Trong Giao thức Internet, máy chủ mạng là một thiết bị (máy chủ) cung cấp dịch vụ TCP / UDP.
Thai(Siamese): ใน Internet Protocol เซิร์ฟเวอร์เครือข่ายเป็นอุปกรณ์ (โฮสต์) ที่ให้บริการ TCP/UDP
Indonesian: Dalam Protokol Internet, server jaringan adalah perangkat (host) yang menyediakan layanan TCP/UDP.
Malay: Dalam Protokol Internet, pelayan rangkaian adalah peranti (host) yang menyediakan perkhidmatan TCP / UDP.
Myanmar: Internet Protocol တွင် network server သည် TCP/UDP ၀ န်ဆောင်မှုကိုပံ့ပိုးပေးသော device (host) တစ်ခုဖြစ်သည်။
