Protocol

A protocol specification has three parts: syntax (the exact format of each message), semantics (what each field means and what the receiver must do) and timing or sequencing (which messages may follow which). The sequencing is often defined as a finite state machine; the TCP connection states from LISTEN and SYN-SENT to TIME-WAIT in RFC 9293 are the classic example. Encodings range from fixed binary fields (IP, TCP), through type-length-value structures (TLS extensions, ASN.1 DER in X.509 certificates), to text protocols such as SMTP and HTTP/1.1, whose grammar is written in ABNF (RFC 5234). IETF specifications use the BCP 14 keywords MUST, SHOULD and MAY (RFC 2119 and RFC 8174) to separate hard requirements from recommendations, and a surprising number of interoperability and security problems live in the gap between SHOULD and MUST.

Protocols are layered, each layer using the service of the one below and encapsulating its data. The OSI reference model (ISO/IEC 7498-1) has seven layers; the internet's own model, as described in RFC 1122, has four: link, internet, transport and application. Standards come from different bodies: the IETF publishes RFCs for internet protocols, IEEE defines link layers such as 802.3 and 802.11, W3C and WHATWG cover web platform standards, and domain bodies such as HL7 define health-data standards like FHIR, the kind of shared protocol the laboratory example relies on. Protocols can be stateful, like TCP, or stateless, like HTTP, where applications rebuild state with cookies or tokens.

Jon Postel's robustness principle, "be conservative in what you send, be liberal in what you accept" (RFC 761, later RFC 1122), helped early interoperability but is now viewed critically. RFC 9413 (2023) argues that tolerating deviations lets bugs become entrenched and creates parser differentials that attackers exploit. A related problem is ossification: middleboxes that reject anything unfamiliar make protocols hard to evolve. TLS 1.3 therefore presents itself on the wire much like a TLS 1.2 session resumption, and GREASE (RFC 8701) makes clients send random reserved values so that extension points stay usable.

Many security failures are protocol failures. Parsers that trust a length field produce bugs such as Heartbleed (2014, in OpenSSL's TLS heartbeat extension); two components that parse the same message differently allow HTTP request smuggling; version negotiation without downgrade protection enabled attacks such as POODLE against SSL 3.0; and legacy cleartext protocols such as Telnet, FTP, SNMPv1/v2c with community strings, or LDAP simple binds without TLS expose credentials to anyone on the path. Defences include fuzzing protocol implementations, formally analysing designs (TLS 1.3 was analysed with tools such as Tamarin and ProVerif during standardisation), inventorying which protocols actually run on the network from flow data, and disabling obsolete versions.