Cybersecurity: SIEM, XDR, Wazuh, DNS, TLS and network tools

Q: What is the difference between SIEM and XDR?

A SIEM collects and keeps logs from everything in the company and correlates them into alerts, which makes it strong for investigations and compliance. XDR starts from endpoint detection, adds network, cloud and identity data, and responds automatically, for example by isolating a laptop. Many companies run both, and the products overlap more every year.

Q: Is Wazuh really free?

Yes. Wazuh is open source and free to download and run on your own servers, with all features. The company behind it earns money from a hosted cloud version, support and training.

Q: Which public DNS server is the best?

There is no single winner. For privacy and malware blocking, Quad9 and Cloudflare’s 1.1.1.2 are popular; in the EU, DNS4EU is the new public option; for families, the family variants of Cloudflare, CleanBrowsing or AdGuard. Measure speed from your own network, and use DNS over HTTPS or TLS so the questions travel encrypted.

Q: How do I check if a port is open on Windows?

Open PowerShell and run Test-NetConnection followed by the host and -Port with the number, for example Test-NetConnection 10.0.0.100 -Port 8006. TcpTestSucceeded : True means the port answered. Telnet works too, once the Telnet Client feature is switched on.

Q: Is it legal to scan with Nmap?

Scanning your own network, or one you have written permission to test, is normal administration. Scanning other people’s systems without permission can break computer misuse laws or your internet provider’s terms. Nmap offers scanme.nmap.org for practice.

Q: Are SSL and TLS the same thing?

TLS is the successor of SSL, and people still say SSL out of habit. Every SSL version is now forbidden; secure sites use TLS 1.2 or 1.3. An “SSL certificate” is a TLS certificate under its old name.

Q: Why do email servers check reverse DNS?

Legitimate mail servers have a PTR record whose name points back to the same address. Spam often comes from hijacked home computers or dynamic addresses that have none, or only a generic one, so receivers such as Gmail treat a missing or mismatched PTR as a strong spam signal.

Q: Which ports does SAP GUI need?

SAP GUI connects to the dispatcher on 32NN, where NN is the instance number (3200 for instance 00). Logging on through a message server (load balancing) also needs 36NN, where NN is the instance number of the ASCS or SCS instance that runs it, and SAProuter connections use 3299. The port calculator on the SAP Basis page lists them all for any instance.

What is cybersecurity?

Cybersecurity is the practice of protecting computers, servers, mobile devices, networks, applications and data from attack, damage and unauthorized access. Whatever the tool, every control on this page serves one of three goals, known as the CIA triad:

ConfidentialityOnly the right people can read it. Encryption and access control live here.
IntegrityNobody changed or destroyed it without permission. Signatures, hashes and change logs.
AvailabilityIt is there, on time, when it is needed. Backups, redundancy and DDoS protection.

Six areas of cybersecurity

Network security
Keeps intruders off the network, whether a targeted attacker or opportunistic malware: firewalls, segmentation, VPNs, intrusion detection.
Application security
Keeps software and devices free of exploitable flaws. It starts at design, long before go-live, and continues with patching. A weak application exposes the very data it was built to protect.
Information security
Protects the integrity and privacy of data, both stored and in transit: encryption, classification, data loss prevention.
Operational security
The processes and decisions around data: who gets which permissions, and the rules for where data may be stored or shared. In SAP, this is roles, PFCG and segregation of duties.
Disaster recovery and business continuity
How the company answers an incident or any event that stops operations. Disaster recovery restores systems and data; business continuity is the plan for working without them in the meantime.
End-user education
People are the least predictable factor. Teaching everyone to spot phishing, to leave unknown attachments and USB drives alone and to report what looks odd closes the door most attacks walk through.

The NIST framework in six verbs

Version 2.0 of the NIST Cybersecurity Framework, one of the most widely used references, sorts everything a company does about security into six functions. Govern, new in 2.0, sits in the middle and steers the other five. Pick one to see where this page helps.

New in CSF 2.0

Govern

Set the direction: the risk strategy, who is responsible for what, the policies, and how risk from suppliers is managed. It sits at the centre of the framework and informs the other five.

On this page: Segregation of duties and access governance in SAP are covered on SAP GRC

Know what you have

Identify

Understand the assets, data, suppliers and weaknesses you have, so you know what to protect first.

On this page: Nmap finds the hosts and open ports you did not know about: Network toolbox

Safeguards

Protect

Use safeguards to manage risk: identity and access control, awareness training, data security and hardened platforms.

On this page: Encryption in transit, DNSSEC and reverse proxies: SSL and TLS

Spot it early

Detect

Find attacks and anomalies quickly, by monitoring and analysing what happens across the estate.

On this page: SIEM, XDR and the free Wazuh platform: SIEM vs XDR

Contain it

Respond

Act on a detected incident: manage it, analyse it, contain it, and communicate with the people who need to know.

On this page: XDR’s automated responses and Wazuh’s active response: Wazuh

Get back to normal

Recover

Restore the systems and data the incident affected, confirm they are clean, and return to normal operations.

On this page: Disaster recovery and business continuity form one of the six areas

2026 in four numbers

$4.99M
Average cost of a data breach worldwide, up from US$4.44 million in the 2025 edition.
IBM, Cost of a Data Breach Report 2026
31%
of breaches started with an exploited vulnerability, now the most common way in.
Verizon, Data Breach Investigations Report 2026
62%
involved a human element: a phishing click, a mistake, stolen credentials.
Verizon, Data Breach Investigations Report 2026
1 in 4
malicious breaches were AI-enabled, costing about US$6 million on average.
IBM, Cost of a Data Breach Report 2026

Detection

Detect and respond: SIEM vs XDR

Prevention fails sometimes. What decides the damage is how fast someone notices and acts. Two families of tools do that work, and they overlap more every year.

SIEM

Security information and event management

The security system of record. It collects logs and events from firewalls, servers, applications, intrusion detection and cloud services, keeps them in one searchable store, and correlates them to raise alerts.

Collect and keep: central log management with long retention for audits and forensics.
Correlate: rules match events across sources, such as many failed logins followed by one success.
Monitor: real-time dashboards and alerts.
Investigate: search months of history when something happens.
Prove compliance: reports for PCI DSS, HIPAA, GDPR and similar rules.

XDR

Extended detection and response

XDR grew out of endpoint detection and response (EDR). It joins what endpoints, the network, cloud, identity and email see, analyses it with behavioural analytics and threat intelligence, and acts on its own.

One view across endpoints, network and cloud, so an attack that hops between them stays one story.
Behaviour, not only signatures: machine learning and anomaly detection catch new tricks.
Automated response: isolate a laptop, kill a process, block an address, disable an account.
Threat hunting: search for indicators of compromise everywhere at once.
Fewer alerts: related events grouped into incidents.

The key differences

SIEM compared with XDR
Aspect	SIEM	XDR
Data sources	Mainly logs: firewalls, servers, applications, network devices, intrusion detection.	Telemetry beyond logs: endpoint activity, network traffic, cloud, identity and email.
Focus	Network- and log-centric; endpoint data only if someone sends it.	Endpoint first (EDR built in), plus network detection (NDR).
How it detects	Correlation rules and signatures that match known patterns. Modern SIEMs add analytics.	Behavioural analytics, machine learning and threat intelligence for unknown threats.
Response	Alerts and reports for people to act on; automation usually through a SOAR tool.	Built-in automated actions: isolate a host, block traffic, start remediation.
Retention	Months or years of searchable history, the basis for audits.	Shorter, focused on investigation; long-term storage often goes to a SIEM.
Best at	Compliance, any data source, forensic searches.	Fast detection and containment with a small team.

The alphabet soup, decoded

EDR · Endpoint detection and response

An agent on laptops and servers records what processes do, flags suspicious behaviour, and can contain the machine and suggest a fix.

NDR · Network detection and response

Watches network traffic, as raw packets or flow records, for abnormal behaviour. It also sees devices that cannot run an agent, such as printers, cameras and IoT.

XDR · Extended detection and response

Joins EDR, NDR and other sources such as cloud, identity and email into one detection and response platform, with automated actions.

SIEM · Security information and event management

The system of record for security events: it collects, stores and correlates them from across the company and its cloud services, for detection, investigation and compliance.

SOAR · Security orchestration, automation and response

Playbooks that run response steps across many tools automatically, such as enriching an alert and opening a ticket. Many vendors now build it into their SIEM.

MDR · Managed detection and response

A service: an outside team watches your alerts around the clock and responds for you, usually with its own tools.

SOC · Security operations centre

The team, in-house or outsourced, that uses all of the above to watch, investigate and respond.

You need logs for auditors
Start with a SIEM. Retention and reports are its home ground.
Small team, mostly laptops and servers
XDR, or MDR if nobody can watch the alerts at night.
You want both, for free
Wazuh does SIEM and XDR in one open source platform.

Where the name comes from: Palo Alto Networks says its co-founder and CTO, Nir Zuk, introduced the XDR concept in 2018.

Open source SIEM and XDR

Wazuh: free XDR and SIEM in one platform

Wazuh is a free, open source security platform that unifies XDR and SIEM. One agent on each machine feeds one server and one dashboard, whether the workload runs on premises, in virtual machines, in containers or in the cloud. It is the easiest way to see a real SIEM working in a lab or a homelab.

Current: 4.14.9 · 14 Oct 2026Next: 5.0, in release candidates

Endpoint security
Configuration assessment against benchmarks, malware detection and file integrity monitoring.
Threat intelligence
Threat hunting, log data analysis and vulnerability detection for installed software.
Security operations
Incident response with active responses, regulatory compliance and IT hygiene.
Cloud security
Container security, cloud posture management and workload protection.

How it is built

Agent
Runs on each endpoint (Linux, Windows, macOS and more), collects events and carries out responses.
Sends to the server on 1514 · enrols on 1515
Server
Decodes and analyses what agents send, against rules and threat intelligence, and manages the agents.
Server API on 55000
Indexer
Stores and indexes the alerts so that months of data can be searched quickly.
Indexer API on 9200
Dashboard
The web interface: security events, vulnerabilities, integrity, compliance and settings.
HTTPS on 443

The indexer is a fork of OpenSearch and the dashboard a fork of OpenSearch Dashboards. In a lab all three central parts run on one machine; past about 100 agents Wazuh recommends spreading them over several.

What one server needs

Wazuh’s own sizing for the all-in-one install, keeping 90 days of alerts.

Wazuh all-in-one sizing
Agents	CPU	Memory	Disk, 90 days
1 to 25	4 vCPU	8 GiB	50 GB
26 to 50	8 vCPU	8 GiB	100 GB
51 to 100	8 vCPU	8 GiB	200 GB

Operating system: 64-bit Linux on Intel, AMD or ARM. Recommended: Ubuntu 16.04 to 24.04, Red Hat Enterprise Linux 7 to 10, CentOS Stream 10, Amazon Linux 2 and 2023.
Browser for the dashboard: Chrome 95, Firefox 93 or Safari 13.7 and later. Other Chromium browsers may work; Internet Explorer 11 does not.
Licence: Open source and free. Wazuh sells a hosted cloud version and support.

Install, upgrade and restart

Install on UbuntuInstall with DockerUpgrade on DockerRestart on Docker

Wazuh’s installation assistant puts the indexer, server and dashboard on one machine with one command. These are the steps for version 4.14; always check the quickstart for the current version first.

1
Optional: bring the system up to date.
```
sudo apt update && sudo apt upgrade -y
```

Download and run the installation assistant with -a (all in one).

curl -sO https://packages.wazuh.com/4.14/wazuh-install.sh && sudo bash ./wazuh-install.sh -a

3
If it stops on the hardware check, add -i to skip it. In a lab only.
```
sudo bash ./wazuh-install.sh -a -i
```
Without -i the assistant refuses machines with fewer than 2 cores or about 4 GB of memory for the indexer and dashboard.
4
At the end it prints the admin user and password. Open the dashboard in a browser.
```
https://<wazuh-server-ip>
```
If you see “Wazuh dashboard server is not ready yet”, wait a minute and reload.

Lost the password? It is inside the file the assistant left behind.

sudo tar -O -xvf wazuh-install-files.tar wazuh-install-files/wazuh-passwords.txt

The single-node Docker deployment runs the three central components as containers. Wazuh asks for at least 4 CPU cores and 8 GB of memory on the host. The commands use sudo; add your user to the docker group to drop it.

Raise the memory map limit the indexer needs, now and after every reboot.

sudo sysctl -w vm.max_map_count=262144
echo "vm.max_map_count=262144" | sudo tee /etc/sysctl.d/99-wazuh-max-map-count.conf

2
Install Docker Engine with the Compose plugin: from Docker’s own repository, or on Ubuntu:
```
sudo apt install docker.io docker-compose-v2
```
Use “docker compose” (version 2). The old docker-compose command is no longer maintained.

Get the deployment files for the version you want.

git clone https://github.com/wazuh/wazuh-docker.git -b v4.14.9
cd wazuh-docker/single-node/

Generate the certificates the components use to talk to each other.

sudo docker compose -f generate-indexer-certs.yml run --rm generator

5
Start everything in the background and watch it come up.
```
sudo docker compose up -d
sudo docker compose ps
```
Sign in at https://<docker-host-ip> as admin / SecretPassword, then change that password straight away.
Wazuh’s documentation has a page on changing the default password for the Docker deployment.

With Wazuh’s compose files unchanged, an upgrade is a checkout of the new tag. Back up first, and read the release notes.

1
Go to the deployment folder and stop the running version.
```
cd wazuh-docker/single-node/
sudo docker compose down
```
2
Fetch the new tags and check out the target version.
```
git fetch --all --tags
git checkout v4.14.9
```
3
Start the new version.
```
sudo docker compose up -d
```
Edited the compose files yourself? Follow the extra steps in Wazuh’s upgrade guide: new image tags, regenerated certificates, changed paths and a fresh manager configuration file.

After a reboot of the host, or when the dashboard starts showing errors, restarting the containers usually brings it back while you read the logs.

1
Stop the containers and wait until every one shows “Removed”.
```
cd wazuh-docker/single-node/
sudo docker compose down
```
2
Start them again.
```
sudo docker compose up -d
```
3
Check that all three are running, and read the last log lines if one is not.
```
sudo docker compose ps
sudo docker compose logs --tail 50
```

Lessons learned before you install

CPU and memory
The check sees only the memory the VM has right now
The assistant reads the CPU count and the total memory the system reports, and stops below 2 cores or about 3.7 GB for the indexer and dashboard. With Hyper-V dynamic memory the guest reports what it holds at that moment, not the maximum you set, so the check can fail on a VM that would grow later. Give it fixed memory for the install, or use -i in a lab.
Disk
It fails at the last step because the disk is “full”
Ubuntu Server’s guided LVM layout can leave part of a large disk unallocated, so the root volume fills up during the dashboard step and the installer rolls back. Check for free space in the volume group and grow the root volume before installing.
```
# VFree in the output is the unused space
sudo vgs
sudo lvextend -r -l +100%FREE /dev/ubuntu-vg/ubuntu-lv
```
Virtual disk
A dynamic virtual disk only grows
The indexer writes all the time. A dynamically expanding disk (Hyper-V, VirtualBox) grows towards its maximum and does not shrink when old alerts are deleted. Set a realistic maximum size and an index retention policy.

Your first agent. In the dashboard, open Agents management › Summary › Deploy new agent, choose the operating system, and copy the command it builds for you onto that machine.

Change the default passwords (the Docker version starts with admin / SecretPassword), and keep the dashboard off the internet: reach it through a VPN or a reverse proxy with sign-in.

Network

Proxies: forward and reverse

A proxy is a server that speaks on someone else’s behalf. A forward proxy sits in front of the clients and goes out to the internet for them. A reverse proxy sits in front of the servers and takes the internet’s requests for them. Same idea, opposite sides of the connection.

Forward proxyReverse proxy

YouLaptopthe client
ProxyForward proxycompany web gateway
PathInternet
ThemWebsiteany server

The website sees the proxy, not you. Every request leaves through the proxy, so the company can apply its rules and the site only learns the proxy’s address.

ThemVisitorany client
PathInternet
ProxyReverse proxyNginx, a CDN, a tunnel
YouYour serversweb, API, dashboards

The visitor never reaches your servers directly. Only the proxy is exposed. It decides which server answers, can cache and filter, and holds the TLS certificates.

Why companies use a forward proxy

Apply the web policy: block categories, scan downloads and log which sites were visited.
Hide the clients’ own addresses from the sites they visit.
Reach content restricted by network or location, where the rules allow it.
Cache popular content once for many users.

Why sites use a reverse proxy

Load balancing across several servers, and global server load balancing (GSLB) across regions.
Protection: the servers’ addresses stay hidden, attacks hit the proxy first, and a web application firewall can sit there.
Caching of static files close to the visitor.
TLS termination: certificates are managed in one place instead of on every server.
One public address for many applications, routed by host name.

Common reverse proxies

NginxWeb server and reverse proxy, the most common choice in front of web applications.
HAProxyLoad balancer and proxy for TCP and HTTP, built for high traffic.
CaddyGets and renews HTTPS certificates by itself, with no extra setup.
TraefikFinds services by itself, from Docker labels or Kubernetes Ingress rules, and routes to them.
Cloudflare TunnelA small connector makes an outbound-only link, so no inbound port is opened on your firewall.

Did you know? A content delivery network is a reverse proxy spread across the world: your visitor talks to the nearest edge server, which talks to your origin.

Homelab tip. Never forward the port of an admin dashboard (Wazuh, Proxmox, a router) to the internet. Put it behind a reverse proxy with sign-in, or behind a tunnel that only opens outbound.

Names and addresses

DNS: the internet’s phone book

The Domain Name System turns the names people remember into the IP addresses computers use. You type www.example.com; DNS answers with an address such as 192.0.2.10, and only then can the browser connect. When nothing is cached, one lookup takes eight steps through four kinds of server, and two more to fetch the page. Walk through them:

With a cache, most steps disappear. If the resolver already holds the answer, it replies at once and the browser jumps straight to the connection. Every answer is kept for the time-to-live (TTL) its owner set.

The root has 13 names, not 13 machines. a.root-servers.net to m.root-servers.net are run by 12 independent operators, and each name is answered by many servers around the world that share one address (anycast).

DNS record types

A zone is a list of records. These are the ones you meet when you set up a domain, its email and its certificates. Examples use the reserved names and addresses for documentation.

AAddress
Maps a name to one or more IPv4 addresses.
www.example.com. 300 IN A 192.0.2.10
AAAAIPv6 address
Maps a name to one or more IPv6 addresses.
www.example.com. 300 IN AAAA 2001:db8::10
CNAMECanonical name
Makes a name an alias of another name. It points to a host name, never to a URL or a path, and cannot sit at the bare domain next to other records.
shop.example.com. CNAME shops.myplatform.example.
SVCB · HTTPSService binding
Tells the browser up front how to connect: which protocols the server speaks (HTTP/3 included), address hints and encryption keys, saving a round trip.
example.com. HTTPS 1 . alpn="h3,h2"
MXMail exchange
Names the servers that receive email for the domain, with a priority: the lowest number is tried first.
example.com. MX 10 mail.example.com.
SPFSender Policy Framework
Lists who may send email for the domain. Published as a TXT record; the old SPF record type is no longer used.
example.com. TXT "v=spf1 include:_spf.google.com -all"
DKIMDomainKeys Identified Mail
Publishes the public key that checks the signature the sending server puts on every message. A TXT record under a selector name.
s1._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIIBIj…"
DMARCDomain-based Message Authentication, Reporting and Conformance
Tells receivers what to do with mail where neither SPF nor DKIM passes in line with the From domain (none, quarantine, reject), and where to send reports.
_dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"
CAACertification Authority Authorization
Lists the certificate authorities allowed to issue TLS certificates for the domain. Every public CA must check it.
example.com. CAA 0 issue "letsencrypt.org"
DS · DNSKEYDNSSEC keys
DNSKEY holds the zone’s public keys; DS, published by the parent zone, holds their fingerprint. Together with the RRSIG signatures they build DNSSEC’s chain of trust.
example.com. DS 2371 13 2 1F987CC6…
PTRPointer
Maps an IP address back to a name: the reverse lookup used by mail servers and logs.
10.2.0.192.in-addr.arpa. PTR mail.example.com.
TXTText
Free text. Used for SPF, DKIM and DMARC, and to prove you own a domain to Google, Microsoft and others.
example.com. TXT "google-site-verification=…"
NSName server
Says which servers are authoritative for the zone. The parent zone holds a copy, which is how resolvers find them.
example.com. NS ns1.dnshost.example.
SOAStart of authority
The zone’s header: primary name server, the administrator’s mailbox, a serial number that changes with every edit, and the refresh and caching timers.
example.com. SOA ns1.dnshost.example. hostmaster.example.com. 2026110201 …
SRVService
Gives the host and port of a service, such as SIP calls, chat or Active Directory.
_sip._tcp.example.com. SRV 10 60 5060 sip.example.com.

Three kinds of DNS query

Recursive: The client asks the resolver for the final answer, and the resolver must return it or an error. This is what your laptop sends.
Iterative: The server gives the best answer it has, often a referral to a server further down the tree. This is how the resolver talks to the root, TLD and authoritative servers.
Non-recursive: The server answers straight away because it is authoritative for the name or has it in its cache.

Do not mix up the recursive query (the request) with the recursive resolver (the server that does the walking).

Look it up yourself

Every operating system

nslookup www.example.com

Linux and macOS: the whole walk from the root, then a reverse lookup

dig +trace www.example.com
dig -x 192.0.2.10 +short

Windows PowerShell

Resolve-DnsName example.com -Type MX

Where answers are cached, and how to clear them

Caching makes the web fast and makes DNS changes look slow: the browser, the operating system, the router and the resolver may all hold the old answer until its TTL runs out.

Windows: ipconfig /flushdns
macOS: sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder
Linux (systemd-resolved): resolvectl flush-caches
Chrome and Edge: chrome://net-internals/#dns › Clear host cache

Security

DNSSEC: proof that an answer was not forged

Plain DNS has no way to prove an answer is genuine, so an attacker who can inject a fake reply can send you to the wrong server. DNSSEC adds signatures: each zone signs its records, and the zone above vouches for its key, all the way up to the root. A validating resolver checks the chain and throws away anything that does not match.

Turning it on is two steps: your DNS host signs the zone, and the DS record goes to your registrar. When both are the same company it is usually one switch. DNSSEC proves authenticity; it does not hide your queries. For privacy, see encrypted DNS below.

DNSKEYThe zone’s public keys, published in the zone itself.
RRSIGA signature over each set of records, checked with the DNSKEY.
DSA fingerprint of the key, published by the parent zone (.com for example.com): the link in the chain of trust.

Two relatives: reverse DNS and multicast DNS

rDNS

Reverse DNS: from address to name

A reverse lookup asks which name belongs to an IP address. The answer is a PTR record stored under a special domain with the address written backwards: 192.0.2.1 lives at 1.2.0.192.in-addr.arpa. IPv6 uses ip6.arpa, one hexadecimal digit per label.

Who sets it: whoever owns the IP block (your ISP, hosting or cloud provider), not the company that hosts your domain’s DNS.
Email: receiving servers check that the sender’s address has a PTR whose name points back to the same address (forward-confirmed reverse DNS). Without it, mail is often refused or marked as spam.
Logs: tools show names instead of bare numbers.

The standards recommend that every address has one, but it is not required for the internet to work, so many addresses have none.

mDNS

Multicast DNS: names without a DNS server

On a home or office network, devices can find each other by name with no DNS server at all. A device asks the whole local network “who is printer.local?” and the owner answers. That is how printers, Chromecast, AirPlay speakers and Home Assistant show up by themselves.

Questions go to the multicast address 224.0.0.251 (ff02::fb in IPv6) on UDP port 5353. The standard is RFC 6762 (2013); DNS-SD, RFC 6763, adds service discovery on top.
It never leaves the local network segment. To see .local devices on another VLAN you need an mDNS reflector, such as the Avahi package on pfSense.

In the browser: to stop web pages from reading your local IP address, browsers put a random name such as 1f4712db-ea17-4bcf-a596-105139dfd8bf.local in place of it when a video call (WebRTC) collects its connection candidates. Those candidates are gathered by ICE (Interactive Connectivity Establishment, RFC 8445 from 2018, which replaced RFC 5245): local addresses, the public address a STUN server sees, and a relay on a TURN server. Trickle ICE (RFC 8838) sends candidates as soon as they are found, so calls connect faster.

Public DNS

Encrypted DNS and public resolvers

Your devices send their DNS questions to a resolver, usually your internet provider’s. A public resolver is a free alternative run by a company or a non-profit: often faster, sometimes with malware or adult-content blocking, and usually reachable over an encrypted channel. Remember the trade: whoever runs the resolver sees every name you look up, so read its privacy policy.

Ways to send a DNS question

DNS transports, their ports and standards
Transport	Port	Standard	What the network in between sees
Classic DNS	53 UDP and TCP	RFC 1035 (1987)	Everything: every name you ask for, in clear text, and an attacker on the path can change the answer.
DNS over TLS (DoT)	853 TCP	RFC 7858 (2016)	That you use encrypted DNS (its own port gives it away), but not the questions.
DNS over HTTPS (DoH)	443	RFC 8484 (2018)	Ordinary-looking HTTPS traffic. Built into Chrome, Edge, Firefox and Windows 11.
DNS over QUIC (DoQ)	853 UDP	RFC 9250 (2022)	Encrypted UDP traffic; faster set-up than DoT.
DNSCrypt	Often 443 (AdGuard: 5443)	Not an IETF standard	Encrypted traffic. Older than DoH and DoT, supported by fewer resolvers.
Oblivious DoH	443	RFC 9230 (2022, experimental)	A relay sees your address but not the question; the resolver sees the question but not your address.

Find a resolver

Addresses checked on each provider’s own page on 2 November 2026. Filter by what you want blocked, or search by name.

Public DNS resolvers
Provider	IPv4	IPv6	Encrypted (DoH · DoT)	Blocks
CloudflareStandard · US	1.1.1.11.0.0.1	2606:4700:4700::11112606:4700:4700::1001	https://cloudflare-dns.com/dns-queryone.one.one.one	NothingDNSSEC validation
CloudflareMalware blocking · US	1.1.1.21.0.0.2	2606:4700:4700::11122606:4700:4700::1002	https://security.cloudflare-dns.com/dns-querysecurity.cloudflare-dns.com	Malware, phishing
CloudflareFamilies · US	1.1.1.31.0.0.3	2606:4700:4700::11132606:4700:4700::1003	https://family.cloudflare-dns.com/dns-queryfamily.cloudflare-dns.com	Adult contentMalware and adult content
Google Public DNSStandard · US	8.8.8.88.8.4.4	2001:4860:4860::88882001:4860:4860::8844	https://dns.google/dns-querydns.google	NothingDNSSEC validation
Quad9Secure (recommended) · Switzerland	9.9.9.9149.112.112.112	2620:fe::fe2620:fe::9	https://dns.quad9.net/dns-querydns.quad9.net	Malware, phishingNon-profit; DNSSEC validation
Quad9Secure with ECS · Switzerland	9.9.9.11149.112.112.11	2620:fe::112620:fe::fe:11	https://dns11.quad9.net/dns-querydns11.quad9.net	Malware, phishingPasses part of your address to the sites’ DNS servers, for nearer CDN servers
Quad9Unsecured · Switzerland	9.9.9.10149.112.112.10	2620:fe::102620:fe::fe:10	https://dns10.quad9.net/dns-querydns10.quad9.net	NothingNo blocklist; still validates DNSSEC
Cisco OpenDNSHome · US	208.67.222.222208.67.220.220	2620:119:35::352620:119:53::53	https://doh.opendns.com/dns-query—	Malware, phishingPhishing protection
Cisco OpenDNSFamilyShield · US	208.67.222.123208.67.220.123	—	https://doh.familyshield.opendns.com/dns-query—	Adult contentAdult content
AdGuard DNSDefault · Cyprus	94.140.14.1494.140.15.15	2a10:50c0::ad1:ff2a10:50c0::ad2:ff	https://dns.adguard-dns.com/dns-querydns.adguard-dns.com	Ads, trackersAlso DoQ and DNSCrypt
AdGuard DNSFamily protection · Cyprus	94.140.14.1594.140.15.16	2a10:50c0::bad1:ff2a10:50c0::bad2:ff	https://family.adguard-dns.com/dns-queryfamily.adguard-dns.com	Adult contentAds, trackers and adult content
AdGuard DNSNon-filtering · Cyprus	94.140.14.14094.140.14.141	2a10:50c0::1:ff2a10:50c0::2:ff	https://unfiltered.adguard-dns.com/dns-queryunfiltered.adguard-dns.com	Nothing
CleanBrowsingSecurity filter · US	185.228.168.9185.228.169.9	2a0d:2a00:1::22a0d:2a00:2::2	https://doh.cleanbrowsing.org/doh/security-filter/security-filter-dns.cleanbrowsing.org	Malware, phishing
CleanBrowsingAdult filter · US	185.228.168.10185.228.169.11	2a0d:2a00:1::12a0d:2a00:2::1	https://doh.cleanbrowsing.org/doh/adult-filter/adult-filter-dns.cleanbrowsing.org	Adult contentNote the .11 secondary
CleanBrowsingFamily filter · US	185.228.168.168185.228.169.168	2a0d:2a00:1::2a0d:2a00:2::	https://doh.cleanbrowsing.org/doh/family-filter/family-filter-dns.cleanbrowsing.org	Adult contentAlso forces safe search
Control DUnfiltered (p0) · Canada	76.76.2.076.76.10.0	2606:1a40::2606:1a40:1::	https://freedns.controld.com/p0p0.freedns.controld.com	NothingAlso DoQ
Control DMalware (p1) · Canada	76.76.2.176.76.10.1	2606:1a40::12606:1a40:1::1	https://freedns.controld.com/p1p1.freedns.controld.com	Malware, phishing
Control DAds and malware (p2) · Canada	76.76.2.276.76.10.2	2606:1a40::22606:1a40:1::2	https://freedns.controld.com/p2p2.freedns.controld.com	Ads, trackersp3 also blocks social media
DNS4EUProtective · European Union	86.54.11.186.54.11.201	2a13:1001::86:54:11:12a13:1001::86:54:11:201	https://protective.joindns4.eu/dns-queryprotective.joindns4.eu	Malware, phishingEU co-funded, run by Whalebone (Czechia) since June 2025
DNS4EUChild protection · European Union	86.54.11.1286.54.11.212	2a13:1001::86:54:11:122a13:1001::86:54:11:212	https://child.joindns4.eu/dns-querychild.joindns4.eu	Adult content
DNS4EUAd blocking · European Union	86.54.11.1386.54.11.213	2a13:1001::86:54:11:132a13:1001::86:54:11:213	https://noads.joindns4.eu/dns-querynoads.joindns4.eu	Ads, trackers
DNS4EUUnfiltered · European Union	86.54.11.10086.54.11.200	2a13:1001::86:54:11:1002a13:1001::86:54:11:200	https://unfiltered.joindns4.eu/dns-queryunfiltered.joindns4.eu	Nothing
CIRA Canadian ShieldPrivate · Canada	149.112.121.10149.112.122.10	2620:10A:80BB::102620:10A:80BC::10	https://private.canadianshield.cira.ca/dns-queryprivate.canadianshield.cira.ca	NothingRun by Canada’s .ca registry
CIRA Canadian ShieldProtected · Canada	149.112.121.20149.112.122.20	2620:10A:80BB::202620:10A:80BC::20	https://protected.canadianshield.cira.ca/dns-queryprotected.canadianshield.cira.ca	Malware, phishing
CIRA Canadian ShieldFamily · Canada	149.112.121.30149.112.122.30	2620:10A:80BB::302620:10A:80BC::30	https://family.canadianshield.cira.ca/dns-queryfamily.canadianshield.cira.ca	Adult content
DNS.SBStandard · Germany	185.222.222.22245.11.45.11	2a09::2a11::	https://doh.dns.sb/dns-querydot.sb	NothingSays it keeps no logs
UncensoredDNSAnycast and unicast · Denmark	91.239.100.10089.233.43.71	2001:67c:28a4::2a01:3a0:53:53::	https://anycast.uncensoreddns.org/dns-queryanycast.uncensoreddns.org	NothingNo censorship lists; also DoQ
CZ.NIC ODVRStandard · Czechia	193.17.47.1185.43.135.1	2001:148f:ffff::12001:148f:fffe::1	https://odvr.nic.cz/dohodvr.nic.cz	NothingRun by the .cz registry; DNSSEC validation

Also worth knowing: NextDNS (free tier, filtering you configure in an account) and Wikimedia DNS (encrypted only, no plain port 53). Regional services such as AliDNS and DNSPod in China or Yandex DNS in Russia mainly serve local users.

Closed, sold or not public

Lists of public resolvers age fast, and a resolver that disappears leaves every device pointed at it without names. These still appear in older lists online.

ClosingMullvad DNS. Mullvad announced in September 2026 that its public DNS service ends on 2 November 2026, and that it now funds Quad9 instead.
Closeddns0.eu. The European resolver shut down in October 2025, saying it was no longer sustainable, and pointed users to DNS4EU or NextDNS.
DeadFreenom World (80.80.80.80). No longer answers; its address block has been withdrawn from the internet’s routing.
DeadDyn Internet Guide. Dyn’s free services ended after Oracle wound the company down.
SoldVerisign Public DNS (64.6.64.6). Sold to Neustar in 2020 and folded into UltraDNS Public, now owned by DigiCert.
Not publicWatchGuard DNSWatchGO. A paid product tied to WatchGuard’s security suite, not a resolver anyone can use.
RemovedSmall and personal resolvers. Services run by one person can disappear any day, so entries with no current official page (0ms, Nawala, Safe Surfer and others) are not listed.

How to choose

Speed: measure from your own network. The distance to the nearest server matters more than the brand.
Privacy: read the logging policy and use DoH or DoT so nobody on the way reads your questions.
Protection: a filtering variant blocks known malware and phishing domains before the connection starts.
Everywhere at once: set it on the router or firewall. pfSense’s DNS resolver (Unbound) can forward over TLS, and AdGuard Home or Pi-hole add your own blocklists.

Email

Email address tricks: plus addressing, dots and aliases

Much of the mail you never asked for starts with a company that sold, shared or leaked your address. Give each site a slightly different address and the inbox tells you who passed it on.

Plus addressing

Add +anything before the @

Gmail delivers johndoe+shop@gmail.com to johndoe@gmail.com, with the full address still visible in the To line. Use a different word for every site; when spam arrives at one of them, you know which company let it out.

Try it: the site you are signing up to

johndoe+shop@gmail.com

Works in: Gmail and Google Workspace, Microsoft 365 (on by default in Exchange Online), and your own domain with Cloudflare Email Routing, where subaddressing arrived in July 2025.

Limits: some sign-up forms reject the + sign, and anyone selling the list can strip the tag and reveal your real address.

Dotted addressing

Gmail ignores dots

For @gmail.com addresses, john.doe@gmail.com, j.ohndoe@gmail.com and johndoe@gmail.com all reach the same inbox. Sites almost never block dots, so it works where + is refused.

Fewer variations than plus addressing, and a list seller can remove the dots just as easily as a + tag.
Only for @gmail.com. In Google Workspace (work or school) addresses, a dot does change the address.
Seeing mail from a service you never joined, sent to a dotted version of your address? Someone may have signed up with it. Don’t add payment details; check with the service.

Aliases

Better still: a separate address you can switch off

An alias hides your real address completely and forwards to it. When one starts receiving spam, you turn that alias off and nothing else changes.

Hide My Email, part of iCloud+ and built into Sign in with Apple.
Firefox Relay from Mozilla, with free email masks.
SimpleLogin by Proton, 10 free aliases.
DuckDuckGo Email Protection: free, unlimited addresses, and it removes hidden trackers.
Your own domain with a catch-all or one rule per address, for example in Cloudflare Email Routing.

If you send email

SPF, DKIM and DMARC are no longer optional

Since February 2024 Google and Yahoo refuse or junk mail from bulk senders that do not authenticate it, and Microsoft followed for Outlook.com in May 2025. The three records live in your DNS; the record types above show what each looks like.

Google (Gmail)From February 2024 · stricter from November 2025Bulk senders (about 5,000 messages a day to Gmail): SPF and DKIM, DMARC at p=none or stricter, valid forward and reverse DNS, one-click unsubscribe, spam rate below 0.1% and never reaching 0.3%.
YahooFrom February 2024The same rules for bulk senders: SPF, DKIM, DMARC, one-click unsubscribe and a low spam rate. Yahoo publishes no volume threshold.
Microsoft (Outlook.com)From 5 May 2025Domains sending more than 5,000 messages a day need SPF, DKIM and DMARC at p=none or stricter. Failing mail goes to Junk or is rejected.

Troubleshooting

The network toolbox: ping, ports, Telnet, Nmap and Wireshark

A handful of free tools answer most “is it the network?” questions. Start with why the most famous one cannot do what everyone asks of it.

Why you can’t ping a port

Ping sends an ICMP echo request and waits for the echo reply. ICMP lives at the internet layer, next to IP, and has no port numbers: ports belong to TCP and UDP, one layer up. So “ping port 443” really means try to open a TCP connection to port 443 and see what comes back. That is what every tool below does.

A bit of history: Mike Muuss wrote ping in December 1983 at the US Army’s Ballistic Research Laboratory and named it after the sound of sonar. “Packet InterNet Groper” was fitted to the name later.

A failed ping proves little either: many firewalls, Windows Defender Firewall included, drop ICMP by default while the web server behind them works fine.

Three possible answers

OpenA program is listening and the connection completes. The service is reachable from where you stand.
ClosedThe host answers at once with a reset: it is up, but nothing listens on that port (or a firewall rejects it actively).
FilteredNo answer at all until the tool gives up. A firewall is silently dropping the packets, or the host is down.

Test a port from any system

The examples test port 8006, the web interface of a Proxmox server at 10.0.0.100. Swap in your own host and port.

Commands that test a TCP port
Tool	Runs on	Command	Open looks like
PowerShell	Windows	Test-NetConnection 10.0.0.100 -Port 8006	TcpTestSucceeded : True
Netcat	Linux, macOS	nc -vz 10.0.0.100 8006	… port [tcp/*] succeeded!
Nmap	All	nmap -p 8006 10.0.0.100	8006/tcp open
Telnet	Windows, Linux	telnet 10.0.0.100 8006	Connected to … (or a blank screen)
Bash	Linux	timeout 3 bash -c '</dev/tcp/10.0.0.100/8006' && echo open	open
curl	All (curl.exe on Windows)	curl -v telnet://10.0.0.100:8006	* Connected to 10.0.0.100 … port 8006

Install the tools

Installing Telnet, Netcat, Nmap and Wireshark
Tool	Ubuntu and Debian	RHEL, Fedora, Rocky	Windows and macOS
Telnet client	sudo apt install telnet	sudo dnf install telnet	Windows: Turn Windows features on or off › Telnet Client, or in an admin PowerShell: Enable-WindowsOptionalFeature -Online -FeatureName TelnetClient. macOS: brew install telnet
Netcat	sudo apt install netcat-openbsd	sudo dnf install nmap-ncat	macOS: already installed (nc)
Nmap	sudo apt install nmap	sudo dnf install nmap	Installer from nmap.org. Check with nmap --version
Wireshark	sudo apt install wireshark	sudo dnf install wireshark	Installer from wireshark.org. Check with wireshark --version

On Ubuntu, netcat is only a virtual name for two real packages, so apt install netcat fails and tells you to pick one: ask for netcat-openbsd by name. On Red Hat systems nc is Ncat, which prints Ncat: Connected to 10.0.0.100:8006. instead, and yum still works as an alias of dnf.

Three classics up close

TelnetNmapWireshark

Telnet · remote terminal

A remote terminal from 1969, still handy today

Telnet gives you a text terminal on a remote computer over TCP, port 23. It was first proposed in 1969, in the ARPANET’s earliest documents, and standardised in RFC 854 in 1983. For decades it was how administrators reached servers, routers and switches, until SSH arrived in 1995.

Not secure. Everything, user name and password included, crosses the network in clear text, and anyone on the path can read it. Use SSH to administer systems, and never leave a Telnet server switched on.

What it is still good for

Checking that a port answers: telnet 10.0.0.100 8006. A blank screen or “Connected” means open.
Talking to a mail server by hand to debug SMTP.
Reaching old network devices and legacy systems that offer nothing else.

To leave a Telnet session, press Ctrl + ] and type quit.

Nmap · Network Mapper

What is on the network, and what is it running?

Nmap (Network Mapper) is a free, open source scanner for network discovery and security auditing, first released by Gordon Lyon in 1997. With raw packets it works out which hosts are up, which ports are open, which services and versions answer, which operating system runs, and what firewalls are in the way. It runs on Linux, Windows and macOS; the latest release in its changelog is 7.993 (23 October 2026).

Common Nmap commands
Command	What it does
nmap -sT 192.0.2.10	TCP connect scan of the 1,000 most common ports. Needs no admin rights.
sudo nmap -sS 192.0.2.10	SYN scan: faster and quieter. The default when you run Nmap as root or administrator.
nmap -p- 192.0.2.10	All 65,535 TCP ports instead of the top 1,000.
nmap -sV -p 3200 sap.example.com	Ask each open port which service and version answers.
sudo nmap -O 192.0.2.10	Guess the operating system from how it answers.
nmap -sn 10.0.0.0/24	Find which hosts are up, without scanning ports.
nmap --script vuln 192.0.2.10	Run the scripts of the vuln category (Nmap Scripting Engine) to look for known weaknesses.

The name is a guess

Without -sV, the SERVICE column only repeats what Nmap’s list says usually runs on that port. Scan an SAP GUI port and you get:

PORT     STATE SERVICE
3200/tcp open  tick-port

Port 3200 is SAP’s dispatcher for instance 00, but the list knows it as “Press-sense Tick Port”. Add -sV and Nmap asks the service itself.

Scan only networks you own or have written permission to test. Scanning someone else’s systems can break the law or your provider’s terms. Nmap’s own scanme.nmap.org is there for practice.

Wireshark · packet analyser

A voltmeter for network traffic

Wireshark captures the packets crossing a network interface and shows every field of every protocol in them. Network administrators use it to troubleshoot, security engineers to examine attacks, developers to debug protocols, and students to learn how they work. It is free and open source, and was called Ethereal until it was renamed in 2006.

It does: live capture from Ethernet, Wi-Fi, USB and more; open and save tcpdump and other capture formats; decode thousands of protocols; filter, search, colour and count.

It does not: detect intrusions or raise alarms, and it never changes the traffic. It only measures.

Install on Ubuntu, the safe way

sudo apt install wireshark          # answer Yes: non-superusers may capture
sudo usermod -aG wireshark $USER    # then sign out and back in
wireshark

Run it as your normal user, not with sudo: the Wireshark team advises against running the whole program as root. For a newer release than Ubuntu ships, add the developers’ PPA ppa:wireshark-dev/stable; remove it with sudo add-apt-repository --remove ppa:wireshark-dev/stable.

Display filters worth memorising

ip.addr == 10.0.0.100: Traffic to or from one host
tcp.port == 443: One TCP port, either direction
dns: DNS queries and answers
http.request: Unencrypted HTTP requests
tls.handshake.type == 1: TLS Client Hello: shows the site name (SNI)
tcp.flags.reset == 1: Resets: refused or killed connections
icmp: Ping and other ICMP messages

On a server without a screen, capture with tcpdump or Wireshark’s own tshark, save to a file, and open it in Wireshark on your laptop.

Protocols

Network protocols: the shared language

A protocol is a set of rules that lets machines from any vendor, on any operating system, understand each other. Each one fixes three things: the syntax (the format of the data), the semantics (what each part means) and the timing (who speaks when, and how fast). Data travels in small packets, each carrying its source and destination address, and every layer adds its own header.

4ApplicationOSI layers 5 to 73TransportOSI layer 42InternetOSI layer 31LinkOSI layers 1 and 2

OSI layers 5 to 7

Application layer

What programs say to each other: fetch this page, send this email, resolve this name, start this SAP GUI screen. Encryption with TLS is usually counted here too, wrapped around the application data.

HTTP
HTTPS
DNS
SMTP
IMAP
POP3
SSH
FTP
RDP
SNMP
SIP
MQTT
SAP DIAG
SAP RFC

Unit of data: Message (data)
Tools that see it: Wireshark, curl, browser developer tools

Ping is not an application protocol: it is a program that sends ICMP messages, one layer further down.

OSI layer 4

Transport layer

Gets data from one program to another, using port numbers to tell the programs apart. TCP adds reliability and order; UDP does not.

TCP
UDP
QUIC (over UDP)
SCTP
DCCP

Unit of data: Segment (TCP) or datagram (UDP)
Tools that see it: nc, Nmap, Test-NetConnection, Telnet

RTP, often listed here, is a protocol for audio and video that runs on top of UDP, so it belongs to the application layer.

OSI layer 3

Internet layer

Moves packets from one network to another using IP addresses, hop by hop through routers. ICMP reports errors and answers ping.

IPv4
IPv6
ICMP
ICMPv6
IPsec

Unit of data: Packet
Tools that see it: ping, traceroute (tracert), pathping, mtr

No ports here: that is why you cannot ping a port.

OSI layers 1 and 2

Link layer

Moves frames across one local link, by cable or radio, using hardware (MAC) addresses. ARP finds the MAC address that belongs to an IP address on the same network.

Ethernet
Wi-Fi (802.11)
PPP
PPPoE
ARP
VLAN (802.1Q)

Unit of data: Frame
Tools that see it: arp -a, Wireshark capture, switch port lights

Older link technologies such as FDDI and Token Ring have all but disappeared: today it is Ethernet and Wi-Fi.

Protocols and their ports

The protocols you meet most, with their standard ports and the secure version to prefer. Type a name or a port number.

Protocols, their ports and the secure version to prefer
Protocol	Port	What it does	Prefer instead
HTTPHypertext Transfer Protocol	80	Fetches web pages and APIs, request and response, in clear text.	HTTPS
HTTPSHTTP over TLS	443 (UDP 443 for HTTP/3)	The same HTTP, encrypted and authenticated with TLS.	Already secure
DNSDomain Name System	53 UDP and TCP	Turns names into addresses and back.	DoH or DoT
DoH / DoT / DoQDNS over HTTPS, TLS or QUIC	443 / 853 / 853 UDP	Encrypted DNS: the same questions, hidden from the network in between.	Already secure
SMTPSimple Mail Transfer Protocol	25 (server to server), 587 (submission)	Sends and relays outgoing email.	STARTTLS, or 465 with TLS
IMAPInternet Message Access Protocol	143	Reads mail that stays on the server, synced across devices.	IMAPS on 993
POP3Post Office Protocol 3	110	Downloads incoming mail to one device, usually removing it from the server.	POP3S on 995
FTPFile Transfer Protocol	21 (control), 20 (data, active mode)	Transfers files; user name and password travel in clear text.	SFTP (port 22) or FTPS
SSH / SFTPSecure Shell / SSH File Transfer	22	Encrypted remote command line and file transfer.	Already secure
TelnetRemote terminal protocol	23	Remote text terminal with no encryption at all.	SSH
RDPRemote Desktop Protocol	3389	Windows remote desktop. A favourite target when exposed to the internet.	Behind a VPN or gateway
SMBServer Message Block	445	Windows file and printer sharing.	Never open to the internet
LDAPLightweight Directory Access Protocol	389	Reads and writes directory data such as Active Directory users.	LDAPS on 636
DHCPDynamic Host Configuration Protocol	67 and 68 UDP	Hands out IP addresses, gateway and DNS servers on a network.	Local network only
NTPNetwork Time Protocol	123 UDP	Keeps clocks in sync; certificates, logs and Kerberos depend on it.	NTS where supported
SNMPSimple Network Management Protocol	161, 162 (traps) UDP	Monitors routers, switches and printers.	SNMPv3 with encryption
SIPSession Initiation Protocol	5060 (5061 with TLS)	Sets up voice and video calls; the audio itself goes over RTP.	SIP over TLS
MQTTMessage Queuing Telemetry Transport	1883 (8883 with TLS)	Light publish and subscribe messaging for IoT and events.	MQTT over TLS
mDNSMulticast DNS	5353 UDP	Finds devices by .local name on the local network.	Local network only
WireGuardWireGuard VPN	51820 UDP (default)	Modern, lean VPN: built into the Linux kernel, a package on pfSense.	Already secure
GopherGopher	70	A menu-based document system from 1991, overtaken by the web within a few years.	History

TCP vs UDP

Both carry data between programs; they make opposite trade-offs. TCP sets up a connection and guarantees that every byte arrives, in order. UDP just sends each message and moves on: less overhead and no waiting, but nothing is resent.

TCP compared with UDP
Aspect	TCP · Transmission Control Protocol	UDP · User Datagram Protocol
Connection	Opens one with a three-way handshake before any data moves.	None. Each message is sent on its own.
Delivery	Guaranteed: lost data is resent until acknowledged.	Best effort: a lost message stays lost.
Order	Data arrives in the order it was sent.	Messages may arrive out of order.
Shape of data	A continuous stream of bytes, with no message boundaries.	Separate datagrams: each message keeps its boundaries.
Flow and congestion control	Yes: slows down when the receiver or the network is overloaded.	No: the application must take care of it.
Error check	Checksum plus acknowledgements and retransmission.	Checksum only: optional in IPv4, required in IPv6.
Header size	20 to 60 bytes	8 bytes
Speed	Slower to start, steady once running.	No set-up delay; nothing waits for lost data.
Used by	Web (HTTP/1.1 and HTTP/2), email, SSH, file transfer, SAP GUI and RFC.	DNS, voice and video calls, online games, DHCP, NTP, WireGuard, and QUIC for HTTP/3.

QUIC is the twist in the story. Standardised in 2021 (RFC 9000), it runs on UDP but adds TCP’s reliability plus TLS 1.3 encryption, and it carries HTTP/3, which 41% of websites support (W3Techs, November 2026). “UDP is unreliable” describes plain UDP, not what is built on top of it.

Encryption

SSL vs TLS: one protocol, renamed and rebuilt

SSL and TLS do the same three jobs: encryption (nobody on the way can read the data), authentication (the server is who it claims to be) and integrity (nobody changed the data). TLS is SSL’s successor, and every version of SSL is now forbidden. The “SSL certificates” sold today are simply used with TLS.

NetscapeSSL 1.0Never releasedNever published outside Netscape.
1995SSL 2.0ProhibitedBanned by RFC 6176 in 2011.
1996SSL 3.0ProhibitedBroken by POODLE in 2014; deprecated by RFC 7568 in 2015.
1999TLS 1.0DeprecatedRFC 2246. Deprecated by RFC 8996 in 2021.
2006TLS 1.1DeprecatedRFC 4346. Deprecated in 2021 with 1.0.
2008TLS 1.2SupportedRFC 5246. Still fine with modern ciphers.
2018TLS 1.3RecommendedRFC 8446, revised in 2026 as RFC 9846.

What actually changed

SSL compared with TLS
Aspect	SSL 2.0 and 3.0	TLS 1.2 and 1.3
Status	Prohibited by the IETF. Browsers removed SSL 3.0 after the POODLE attack in 2014.	TLS 1.2 and 1.3 are what the web runs on. TLS 1.0 and 1.1 have been deprecated since 2021.
Ciphers	Allowed algorithms now known to be weak, such as RC4, MD5 and export-grade keys.	TLS 1.3 keeps only authenticated encryption (AES-GCM, ChaCha20-Poly1305).
Message integrity	SSL 3.0 used its own early MAC construction.	HMAC in TLS 1.0 to 1.2; in TLS 1.3 integrity is part of the cipher itself.
Key exchange	Mostly static RSA: whoever steals the server’s key later can decrypt recorded traffic.	TLS 1.3 removed static RSA: every full handshake uses fresh keys (forward secrecy).
Handshake	Two round trips, mostly readable on the wire.	TLS 1.3: one round trip, and everything after the first reply is encrypted.
Names	Secure Sockets Layer, designed at Netscape.	Transport Layer Security, standardised by the IETF from 1999.

Fewer round trips before the first byte

TLS 1.2 · two round trips

1 · Hello, certificate2 · Key exchange, finished

TLS 1.3 · one round trip

1 · Hello with key share, doneData already flowing

A returning client can even send data in its first message (0-RTT), at the cost of replay protection for that data.

Ports: implicit TLS or STARTTLS

Neither SSL nor TLS owns a port. A service either starts encrypted on its own port (implicit TLS: HTTPS 443, IMAPS 993, POP3S 995, mail submission 465) or opens in clear text and upgrades with the STARTTLS command (SMTP 25 and 587). For email clients, RFC 8314 (2018) prefers implicit TLS.

What is changing now

Post-quantum

Key exchange that a future quantum computer can’t break

Attackers can record encrypted traffic today and decrypt it once quantum computers are strong enough. The defence is a hybrid key exchange, X25519MLKEM768, which mixes a classic curve with ML-KEM, the NIST post-quantum standard. Chrome first switched on a hybrid post-quantum exchange in version 124 (2024) and moved to this one in version 131; Firefox and Apple’s iOS and macOS 26 followed, and by April 2026 Cloudflare saw it on more than 65% of human traffic.

Certificates

Maximum lifetime of a public TLS certificate

Until 14 March 2026398 days
From 15 March 2026200 days
From 15 March 2027100 days
From 15 March 202947 days

CA/Browser Forum ballot SC-081, April 2025. Manual renewals stop being realistic: automate with ACME.

Let’s Encrypt

The biggest certificate authority moves first

Turned off OCSP in August 2025: revocation now goes through lists (CRLs).
Six-day certificates, and certificates for IP addresses, generally available since January 2026.
Default lifetime still 90 days; 64 days from February 2027 and 45 days from February 2028.

SAP

The protocols SAP uses

Next to the standard web protocols, an SAP landscape speaks a few of its own. You meet them whenever a firewall rule, a VPN or a security scan is involved. In the ports, NN is the instance number: instance 00 uses 3200, instance 01 uses 3201.

DIAG32NN
Dynamic Information and Action Gateway
How SAP GUI talks to the application server’s dispatcher. The data is compressed but not encrypted: user names and passwords cross the network readable unless SNC is switched on.
RFC over CPI-C33NN · 48NN
Remote Function Call
System-to-system calls, interfaces and many tools. RFC is built on CPI-C, a programming interface IBM defined in 1987. The gateway listens on 33NN; the secure gateway port 48NN only accepts SNC-protected connections (SNC also works on 33NN).
SNCon DIAG and RFC
Secure Network Communications
SAP’s layer that authenticates and encrypts DIAG and RFC, using the SAP Cryptographic Library (CommonCryptoLib). Encrypting SAP GUI and RFC traffic with SNC needs no extra licence.
HTTP(S) and OData80NN · 443NN
Internet Communication Manager
SAP Fiori, OData services and web services go through the ICM. OData is an OASIS standard (version 4 in 2014) and ISO/IEC 20802; SAP Gateway serves OData V2 and V4.
SAProuter3299
SAP’s application-level gateway
Controls which SAP connections may pass between networks. SAP Support reaches your system through it when you open a service connection.
SAP HANA SQL3NN13 · 3NN15 · 3NN41+
Database connections
The system database answers on 3NN13. The first tenant, created at installation or converted from a single-container system, usually keeps 3NN15 (30015 for instance 00); tenants added later get 3NN41, 3NN44 and up. HANA’s instance number is often different from the application server’s.
AMQP and MQTTover WebSocket
Event messaging
SAP Event Mesh accepts AMQP 1.0 and MQTT 3.1.1 over WebSocket, plus a REST interface. Current SAP S/4HANA releases send their business events over AMQP, also to SAP Integration Suite, advanced event mesh; early releases also offered MQTT.

SAP Security Patch Day is the second Tuesday of every month; the next one is 10 November 2026. In April 2025, CVE-2025-31324 in NetWeaver Visual Composer (CVSS 10.0) was exploited before a patch existed, until SAP Note 3594142 closed it. SAP systems on the internet are targets like any other.

Every port for your instance number is worked out by the port calculator on the SAP Basis page. Roles and authorizations, the other half of SAP security, are on PFCG and SAP GRC.

Cloud

Public cloud services compared

Cloud services are computing, storage and software rented over the internet, so the customer neither buys nor maintains the hardware. The three big providers sell the same building blocks under different names, and the names keep changing.

Security is shared

The provider secures the cloud itself; you secure what you put in it. AWS calls this security “of” the cloud versus “in” the cloud. Where the line falls depends on the service model:

Who secures what in IaaS, PaaS and SaaS
Layer	IaaS	PaaS	SaaS
Data and access	You	You	You
Application	You	You	Provider
Operating system	You	Provider	Provider
Virtualization	Provider	Provider	Provider
Hardware and data centre	Provider	Provider	Provider

Your data, your users and their access are always yours to protect, whatever the model.

Equivalent services in Microsoft Azure, Amazon Web Services and Google Cloud
Service	Microsoft Azure	Amazon Web Services	Google Cloud
Virtual machines	Azure Virtual Machines	Amazon EC2	Compute Engine
Block storage	Azure Managed Disks	Amazon EBS	Persistent Disk, Hyperdisk
Kubernetes	Azure Kubernetes Service (AKS)	Amazon EKS	Google Kubernetes Engine (GKE)Changed was Container Engine
Containers without Kubernetes	Azure Container Apps, Container InstancesChanged Azure Container Service retired in 2020	Amazon ECS with FargateChanged was EC2 Container Service	Cloud Run
Web app hosting (PaaS)	Azure App ServiceChanged Cloud Services (classic) retired in August 2024	AWS Elastic Beanstalk	App Engine
Streaming analytics	Azure Stream Analytics	Amazon Managed Service for Apache FlinkChanged was Kinesis Data Analytics	DataflowChanged was Cloud Dataflow
Automation and configuration	Azure Automation	AWS Systems ManagerChanged OpsWorks ended in May 2024	VM Manager
Content delivery (CDN)	Azure Front DoorChanged Azure CDN Standard from Microsoft (classic) retires in September 2027	Amazon CloudFront	Cloud CDN
DNS	Azure DNS (Traffic Manager is load balancing by DNS)	Amazon Route 53	Cloud DNS
Identity and access	Microsoft Entra IDChanged was Azure Active Directory, renamed in 2023	AWS IAM, IAM Identity Center	Cloud IAM
Key management	Azure Key Vault	AWS KMS	Cloud KMS
Secrets	Azure Key Vault	AWS Secrets Manager	Secret Manager
Compliance reports	Microsoft Service Trust PortalChanged was Azure Trust Center	AWS Artifact	Compliance Reports Manager
Threat detection and posture	Microsoft Defender for Cloud	Amazon GuardDuty, AWS Security Hub	Security Command Center
SIEM	Microsoft Sentinel	Amazon Security Lake with a partner SIEM	Google Security OperationsChanged was Chronicle
Web application firewall	Azure Web Application Firewall	AWS WAF	Cloud Armor

Frequently asked questions

What is the difference between SIEM and XDR?

A SIEM collects and keeps logs from everything in the company and correlates them into alerts, which makes it strong for investigations and compliance. XDR starts from endpoint detection, adds network, cloud and identity data, and responds automatically, for example by isolating a laptop. Many companies run both, and the products overlap more every year.

Is Wazuh really free?

Yes. Wazuh is open source and free to download and run on your own servers, with all features. The company behind it earns money from a hosted cloud version, support and training.

Which public DNS server is the best?