Question

You are monitoring network traffic on your network, and you see traffic between two network hosts on port 1720.

What is the source of this network traffic?
Someone is using voice over IP (VoIP) to make a telephone call.
A man-in-the-middle attack is in progress.
A workstation is using the DNS protocol to send a name resolution request to a DNS server.
Someone is downloading files from a server using the FTP protocol.

Answer 1

Observing traffic on port 1720 typically indicates that Voice over IP (VoIP) communications are occurring, as this port is used for initiating VoIP calls via the H.323 protocol.

Step-by-step explanation:

When monitoring network traffic and observing traffic on port 1720, it is likely associated with Voice over IP (VoIP) communications, as this port is commonly used for initiating VoIP calls using the H.323 protocol. VoIP allows voice traffic to be sent over the internet, converting analog voice signals into digital data packets. This technology became increasingly popular as the internet expanded beyond its original military and academic uses into the commercial and residential spaces.

A man-in-the-middle attack does not have a specific port associated with it as it is a type of cyber attack, DNS (Domain Name System) queries are usually made over port 53, and FTP (File Transfer Protocol) usually operates over ports 20 and 21. The use of VoIP on port 1720 has no direct correlation with these other activities. Therefore, upon seeing traffic on port 1720, it is most appropriate to conclude that someone is likely using VoIP to make a telephone call over the network.