SSH, FTP, SMTP, IMAP, ICMP & Forward Proxies

In one line

Beyond HTTP, a handful of protocols appear constantly in operations: SSH for remote access and tunnels, FTP/SFTP for file transfer, SMTP/IMAP/POP3 for email, ICMP for diagnostics, and forward proxies for controlled outbound traffic.

0/5 · 0%

Think of it like this

If HTTP is the shop counter, these are the building's other doors: the staff entrance (SSH), the loading dock (FTP/SFTP), the post room (SMTP/IMAP), and the building's intercom for 'are you there?' checks (ICMP).

Key ideas

01
SSH (TCP 22): encrypted remote shell, file copy (scp, rsync -e ssh), and TUNNELS (ssh -L 5432:db.internal:5432 bastion forwards a local port through a bastion to a private database). Use keys, disable passwords, and prefer SSM Session Manager or similar in the cloud (Linux course, SSH; AWS course).
02
FTP (TCP 21 + separate data connections, plain text): legacy, still used by some partners. It's awkward through firewalls and NAT because of its separate data channel (active vs passive mode). Prefer SFTP (file transfer over SSH, port 22) or FTPS (FTP over TLS); AWS Transfer Family offers managed SFTP in front of S3.
03
EMAIL: SMTP sends mail between servers (port 25) and from apps to a relay (587 with STARTTLS authentication). IMAP (143/993) lets clients read mail that stays on the server, synchronised across devices; POP3 (110/995) downloads and usually deletes. Apps should send through a provider (Amazon SES, SendGrid) on 587, not port 25: cloud providers block or throttle outbound 25. Deliverability depends on DNS records: MX, SPF, DKIM, and DMARC (Phase 3).
04
ICMP (network layer, no ports): ping (echo request/reply), traceroute (time-exceeded messages), and 'fragmentation needed' messages used by Path MTU Discovery. Blocking ALL ICMP breaks PMTUD and causes mysterious hangs on large transfers; allow at least 'destination unreachable/fragmentation needed' (Phase 4).
05
FORWARD vs REVERSE proxy: a REVERSE proxy sits in front of SERVERS and represents them to clients (Nginx, ALB; Phase 5). A FORWARD proxy sits in front of CLIENTS and represents them to the internet (Squid, corporate proxies, egress proxies in locked-down VPCs): it controls and logs outbound traffic, allow-lists domains, and caches. Apps use it via HTTP_PROXY/HTTPS_PROXY/NO_PROXY environment variables; forgetting NO_PROXY for internal hosts is a classic 'why is everything slow/failing' cause.
06
Packet capture: tcpdump on servers (Phase 2 and Topic 6.1) and WIRESHARK on your workstation, which opens .pcap files captured with tcpdump and decodes every protocol in this phase with filters like http.response.code >= 500 or tcp.analysis.retransmission. The standard workflow: tcpdump -w capture.pcap on the server, copy it down, analyse in Wireshark.

Code & diagrams

ports worth memorisingtext

22   SSH / SFTP          25   SMTP (server-to-server)   587  SMTP submission (apps)
21   FTP control         53   DNS                       80   HTTP
110  POP3  / 995 (TLS)   143  IMAP / 993 (TLS)          443  HTTPS (TCP), HTTP/3 (UDP)
3306 MySQL               5432 PostgreSQL                6379 Redis     9092 Kafka

capture on the server, analyse in Wiresharkbash

sudo tcpdump -i any -w /tmp/checkout.pcap 'host 10.20.20.15 and port 8080' -c 5000
scp server:/tmp/checkout.pcap .     # then open it in Wireshark
# Wireshark display filters:
#   http.response.code >= 500
#   tcp.analysis.retransmission
#   tcp.flags.reset == 1

Explain it without notes

Why do apps send email on port 587 through a provider instead of directly on port 25?

What's the difference between a forward proxy and a reverse proxy?

Practice

In a VPC with an egress proxy, the app can reach external APIs but calls to an internal service suddenly take 30 s and fail. What's the likely cause?

Trade-offs

↔
Forward/egress proxies give strong control and audit of outbound traffic but add a dependency and latency; VPC endpoints and allow-listed NAT are alternatives for AWS services.

Done when you can

I know the default ports for SSH, SMTP, IMAP, HTTPS, and common databases
I can capture traffic with tcpdump and read it in Wireshark
I know when a forward proxy is involved and how NO_PROXY works