Master network visibility and protocol encapsulation concepts. Analyze legacy protocols traversing modern IP networks and determine the correct application layer mechanisms.
CND (312-38) Network Defense Simulation
Network Scenario
You are a Network Security Analyst for a large financial institution. The organization is currently maintaining a hybrid environment, connecting modern IP-based branch networks to a legacy IBM mainframe application located in the primary datacenter.
While reviewing baseline traffic to ensure the firewall rules for the new SD-WAN deployment are correctly tuned, you notice persistent, low-volume TCP traffic originating from branch workstations and destined for the core legacy routers. The traffic must be explicitly allowed through the internal segment firewall.
Traffic & Logs
An excerpt from the internal network monitoring tool (NetFlow/Firewall logs) shows the following activity:
PROTOCOL: TCP DPT: 2068 SPT: 51922 FLAGS: [S]
DEEP_PACKET_INSPECT: Payload encapsulates non-routable SNA/NetBIOS datagrams.
SESSION_ESTABLISHED: Keep-alives active. Traffic permitted by Rule 114 (Legacy_App_Transport).
Question
Expert Analysis
1. What is happening in the network:
The organization is running legacy mainframe applications that rely on SNA (Systems Network Architecture) and NetBIOS. These are legacy, non-routable protocols (they do not use IP addresses). To transport them across a modern routed TCP/IP network from a branch workstation to the core datacenter router, the traffic must be encapsulated inside TCP packets.
2. Identify behavior:
The firewall logs show traffic on TCP port 2068 traversing from a workstation to a router. Deep packet inspection identifies the payload as encapsulated SNA/NetBIOS. This is a classic tunneling technique used in enterprise environments transitioning away from legacy networks.
3. Why the correct answer is correct:
DCAP (Data Link Switching Client Access Protocol) is specifically designed to run on end-user workstations. It encapsulates SNA and NetBIOS traffic into TCP sessions (typically port 2068) and sends them to a central router (often a DLSw gateway). It solves the problem of how a single workstation participates in this legacy tunneling architecture without running full router-to-router protocols.
4. Why others are wrong:
• DLSw (Data Link Switching): Used for router-to-router encapsulation over IP WANs, not typically workstation-to-router.
• NetBEUI: This is the legacy, non-routable protocol itself. It is what is being encapsulated, not the transport protocol doing the encapsulation over TCP.
• DLC (Data Link Control): A Data Link layer protocol (Layer 2) originally used for mainframes and legacy network printers, not an application layer tunneling protocol over TCP.
5. Defensive action:
As a Network Defender, visibility is key. Legacy protocols like SNA/NetBIOS encapsulated in DCAP are transmitted in cleartext. Defenders must ensure:
- Strict Access Control Lists (ACLs) restrict TCP/2068 traffic only between authorized legacy workstations and the core router.
- If the network spans untrusted segments, this traffic should be further wrapped in an IPsec VPN tunnel to provide confidentiality and integrity.
🛡️ Mini Lesson: Protocol Visibility & Encapsulation
Detection vs. Prevention: Attackers often look for legacy protocols traversing networks because they lack modern security controls (like encryption or strong authentication). By tunneling them inside TCP, they can bypass simple layer 3/4 firewalls unless Deep Packet Inspection (DPI) is enabled.
Traffic Pattern Recognition: Knowing common ports is critical for a network defender. Seeing TCP 2068 should immediately flag as DCAP/DLSw traffic. If this traffic is seen originating from modern segments that shouldn't have mainframe access, it indicates a misconfiguration or an adversary attempting to map legacy infrastructure.
Ready to sharpen your Network Defense skills?
Master protocol analysis, firewall log auditing, and defense-in-depth strategies.
Explore more CND simulations