Protocol	Port(s)	Usage	Requires Auth?	Tools for Interaction
ARP	N/A	Resolves IP to MAC addresses on the local subnet.	❌	arp, arpspoof, ettercap
ICMP	N/A	Ping, traceroute, and network diagnostics.	❌	ping, traceroute, hping3, nping
DHCP	UDP/67, 68	Assigns IP addresses to clients.	❌	dhclient, responder, dhcpig
DNS	UDP/53, TCP/53	Resolves domain names to IPs.	❌	nslookup, dig, fierce, nmap
LLMNR	UDP/5355	Local name resolution fallback.	❌	responder, metasploit
NBT-NS	UDP/137, TCP/139	NetBIOS name resolution.	❌	nbtscan, responder
SMB	TCP/445	File sharing, authentication.	✅ (mostly)	smbclient, crackmapexec, impacket-smbserver, rpcclient
LDAP	TCP/389, UDP/389	Active Directory queries.	✅ (unless anonymous binds allowed)	ldapsearch, windapsearch, impacket-GetADUsers
Kerberos	TCP/88, UDP/88	Authentication in AD environments.	✅ (except AS-REP roasting)	rubeus, impacket-GetTGT, klist
NTLM	TCP/135, 139, 445	Windows authentication fallback.	✅	hashcat, john the ripper, impacket-ntlmrelayx
Global Catalog	TCP/3268, 3269 (SSL)	AD information lookup.	✅ (unless misconfigured)	ldapsearch, adfind
RDP	TCP/3389, UDP/3389	Remote Desktop.	✅	rdesktop, xfreerdp, crackmapexec
WinRM	TCP/5985, 5986 (SSL)	Remote PowerShell execution.	✅	evil-winrm, psremoting
WMI	TCP/135, DCOM 49152+	Remote system info/query.	✅	wmic, impacket-wmiexec
Task Scheduler	TCP/135, 445	Creating/managing scheduled tasks.	✅	schtasks, at
SNMP	UDP/161, 162	Network device info retrieval.	❌ (if public community string is enabled)	snmpwalk, onesixtyone, snmp-check
IKEv2/IPSec	UDP/500, 4500	VPN authentication.	✅	ike-scan, strongswan
Proxy Autodiscovery	HTTP, HTTPS	Finds proxy settings via WPAD.	❌	curl, wpad
mDNS	UDP/5353	Local hostname resolution.	❌	avahi-browse, dns-sd
SSDP	UDP/1900	Discovery of UPnP devices.	❌	nmap -sU --script upnp-info, miniupnp
WSD	UDP/3702	Windows service discovery.	❌	wsdquery, nmap

• ✅ (Yes) – Authentication is required unless misconfigured.
• ❌ (No) – No authentication is required by default.