 |
| Ethical Hacking |
🛡️ Ethical Hacking — Day 5
Networking Deep Dive: IP, MAC, ARP, TCP, UDP, DNS & Subnets
⚠️ LEARNING PURPOSE ONLY: This tutorial is strictly for educational and defensive cybersecurity learning. Perform practical exercises only on systems, networks, virtual machines, applications, or labs that you own or have explicit permission to test. Never scan, probe, exploit, or disrupt unauthorized systems.
Welcome to Day 5 of the Ethical Hacking Learning Series.
On Day 2, we introduced networking. Today we'll go deeper into how network communication actually works.
This is one of the most important foundations for ethical hacking because tools such as Nmap, Wireshark, Burp Suite, and Metasploit become much easier to understand once you know what is happening underneath them.
🎯 Day 5 Learning Objectives
By the end of today, you should understand:
IPv4 addresses
Subnet masks
CIDR notation
Network and host portions
Default gateways
MAC addresses
ARP
ICMP
TCP
TCP three-way handshake
UDP
DNS
Common ports
Routing
Basic network troubleshooting
Network commands on Linux, Windows and macOS
1. The Big Picture
When your computer communicates with another system, several layers of networking are involved.
A simplified view:
Application
↓
TCP / UDP
↓
IP
↓
Ethernet / Wi-Fi
↓
Network Hardware
For example, when you open an HTTPS website:
Browser
↓
HTTPS
↓
TCP
↓
IP
↓
Wi-Fi / Ethernet
↓
Router
↓
Internet
↓
Web Server
An ethical hacker needs to understand each layer.
2. IPv4 Addressing
An IPv4 address contains 32 bits.
For example:
192.168.1.25
It consists of four octets:
192 . 168 . 1 . 25
Each octet contains 8 bits:
8 + 8 + 8 + 8 = 32 bits
3. Network vs Host
Consider:
192.168.1.25/24
The /24 tells us that the first 24 bits represent the network portion.
Conceptually:
Network Host
<----------------> <---->
192.168.1 .25
For a typical /24 network:
Network address: 192.168.1.0
Usable hosts: 192.168.1.1 - 192.168.1.254
Broadcast address: 192.168.1.255
The exact usable-host calculation depends on the subnet and addressing context, but /24 is a very common beginner example.
4. CIDR Notation
CIDR represents the network prefix using /number.
Examples:
| CIDR | Subnet Mask |
|---|---|
/8 | 255.0.0.0 |
/16 | 255.255.0.0 |
/24 | 255.255.255.0 |
/25 | 255.255.255.128 |
/26 | 255.255.255.192 |
/27 | 255.255.255.224 |
/28 | 255.255.255.240 |
You don't need to memorize all of these today.
The important idea is:
The larger the prefix length, the smaller the host portion generally becomes.
5. What Is a MAC Address?
An IP address operates at the network layer.
A MAC address is associated with a network interface at the link layer.
Example:
00:1A:2B:3C:4D:5E
A simplified communication model is:
IP Address
↓
Find local network destination
↓
MAC Address
↓
Ethernet / Wi-Fi frame
This leads us to an important protocol:
ARP
6. What Is ARP?
ARP = Address Resolution Protocol
On traditional IPv4 local networks, ARP helps determine which MAC address corresponds to an IPv4 address on the local network.
Conceptually:
Computer:
"Who has 192.168.1.1?"
↓
Network device:
"192.168.1.1 is at
AA:BB:CC:DD:EE:FF"
The computer can then use that MAC address for local-layer communication.
7. ARP Cache
Your computer normally keeps recently learned mappings.
Conceptually:
IP Address MAC Address
192.168.1.1 AA:BB:CC:DD:EE:FF
192.168.1.20 11:22:33:44:55:66
Let's inspect your own computer's ARP/neighbor table.
🐧 Linux — ARP / Neighbor Table
Run:
ip neigh
You may see something similar to:
192.168.1.1 dev wlan0 lladdr aa:bb:cc:dd:ee:ff REACHABLE
This tells you that your computer has learned a link-layer address for that IP.
🍎 macOS — ARP Table
Run:
arp -a
You may see local network entries.
You can also inspect the routing information:
route -n get default
🪟 Windows — ARP Table
Open PowerShell:
arp -a
You can also use:
Get-NetNeighbor
This provides neighbor information for your local network interfaces.
⚠️ Important
The commands above are local inspection commands.
You are not attacking anything.
Learning Purpose Only: Inspect only your own computer and networks you are authorized to administer.
8. What Is ICMP?
ICMP = Internet Control Message Protocol
ICMP is used for network control and diagnostic messaging.
One of the most familiar tools using ICMP is:
ping
When you run ping, your computer can send an ICMP Echo Request and receive an Echo Reply if the destination permits it.
🧪 Practical Lab: Ping Your Own Computer
Linux
ping -c 4 127.0.0.1
macOS
ping -c 4 127.0.0.1
Windows
ping 127.0.0.1 -n 4
Expected result:
Reply from 127.0.0.1
Remember:
127.0.0.1 = localhost
9. Ping Your Default Gateway
You can also test connectivity to your own local network gateway.
First identify your gateway.
Linux
ip route
macOS
route -n get default
Windows
ipconfig
Suppose your gateway is:
192.168.1.1
You could test it.
Linux
ping -c 4 192.168.1.1
macOS
ping -c 4 192.168.1.1
Windows
ping 192.168.1.1 -n 4
Use the gateway address reported by your own computer rather than blindly using the example.
10. What Is TCP?
TCP = Transmission Control Protocol
TCP provides connection-oriented communication.
Before exchanging normal TCP application data, the endpoints establish a connection.
A simplified TCP connection begins with a:
Three-Way Handshake
Client Server
SYN ---------------------->
<---------------------- SYN + ACK
ACK ---------------------->
Connection Established
The three messages are commonly described as:
SYN
SYN-ACK
ACK
This is fundamental to understanding network traffic.
11. Why Does the TCP Handshake Matter?
Suppose a browser connects to an HTTPS service.
Conceptually:
Browser
│
│ TCP connection
▼
Server
│
│ TLS negotiation
▼
HTTPS communication
Understanding this sequence helps when later analyzing packets with Wireshark.
12. What Is UDP?
UDP = User Datagram Protocol
UDP is connectionless and has lower protocol overhead than TCP.
Conceptually:
Application
↓
UDP Datagram
↓
IP Packet
↓
Network
UDP doesn't provide TCP-style connection establishment and reliable ordered delivery.
Common applications can include:
DNS
DHCP
Real-time communications
Streaming-related traffic
13. TCP vs UDP
| TCP | UDP |
|---|---|
| Connection-oriented | Connectionless |
| Reliable delivery mechanisms | No TCP-style delivery guarantee |
| Ordered byte stream | Datagram-based |
| More overhead | Lower overhead |
| Common for HTTPS/SSH | Common for DNS/DHCP and real-time traffic |
Neither protocol is simply "better."
The correct choice depends on the application.
14. Common Ports
Ports identify application endpoints.
Some commonly encountered ports:
| Port | Common protocol/service |
|---|---|
| 22 | SSH |
| 25 | SMTP |
| 53 | DNS |
| 80 | HTTP |
| 110 | POP3 |
| 143 | IMAP |
| 443 | HTTPS |
| 3389 | RDP |
Remember:
A port number does not by itself prove which service is running.
Service identification requires observation and verification.
15. DNS Deep Dive
DNS translates names into network addresses.
For example:
example.com
↓
DNS Resolver
↓
IP Address
Let's perform a safe DNS lookup.
🐧 Linux
Try:
nslookup example.com
If available:
dig example.com
🍎 macOS
nslookup example.com
or:
dig example.com
🪟 Windows
nslookup example.com
🧪 What Should You Observe?
Look for:
Name
Address
Server
The exact output can vary because DNS infrastructure and responses can change.
16. DNS Record Types
You'll encounter several DNS record types.
| Record | Purpose |
|---|---|
| A | IPv4 address |
| AAAA | IPv6 address |
| CNAME | Canonical/alias name |
| MX | Mail server |
| NS | Name server |
| TXT | Text information |
For example:
example.com
│
├── A
├── AAAA
├── MX
└── TXT
We'll study DNS security in much greater depth later.
17. Routing
Your computer needs to know where network traffic should go.
The routing table provides that information.
Conceptually:
Your Computer
↓
Routing Table
↓
Where should this packet go?
↓
Gateway / Interface
🐧 Linux Routing
ip route
Example:
default via 192.168.1.1 dev wlan0
192.168.1.0/24 dev wlan0
🍎 macOS Routing
netstat -rn
For the default route:
route -n get default
🪟 Windows Routing
route print
You can also use:
Get-NetRoute
18. Traceroute / Tracert
A traceroute-style utility helps show the network path toward a destination.
It can be useful for troubleshooting and understanding routing.
Linux
traceroute example.com
If traceroute isn't installed, some systems provide alternatives such as:
tracepath example.com
macOS
traceroute example.com
Windows
tracert example.com
⚠️ Learning Purpose Only: Use these diagnostic commands responsibly and respect network policies. For this course, use them for basic learning and troubleshooting rather than reconnaissance of systems you don't own or have permission to assess.
19. Viewing Network Connections
You can inspect network connections on your own computer.
🐧 Linux
ss -tun
For listening services:
ss -tuln
🍎 macOS
netstat -an
For listening TCP services:
lsof -nP -iTCP -sTCP:LISTEN
🪟 Windows
netstat -ano
PowerShell also provides:
Get-NetTCPConnection
These commands allow you to investigate your own system's network activity.
20. Understanding Localhost, LAN & Internet
Think about network scope.
Level 1 — Localhost
127.0.0.1
Your own machine.
Level 2 — Local Network
Example:
192.168.1.x
Your LAN.
Level 3 — Internet
Publicly reachable infrastructure outside your local network.
A simplified model:
Internet
│
Router
│
┌────────┴────────┐
│ │
Computer A Computer B
192.168.1.20 192.168.1.30
🧪 Day 5 Main Practical Lab
Now let's combine today's concepts.
Step 1 — Identify your IP
Linux
ip addr
macOS
ifconfig
Windows
ipconfig
Record only your private IP for your own notes.
Step 2 — Identify Your Gateway
Linux
ip route
macOS
route -n get default
Windows
ipconfig
Find:
Default Gateway
Step 3 — Inspect Your Local Neighbor/ARP Table
Linux
ip neigh
macOS
arp -a
Windows
arp -a
Observe the relationship between:
IP address
↓
MAC address
Step 4 — Test Localhost
Linux
ping -c 4 127.0.0.1
macOS
ping -c 4 127.0.0.1
Windows
ping 127.0.0.1 -n 4
Step 5 — Test Your Gateway
Use the gateway you discovered earlier.
Linux/macOS
ping -c 4 YOUR_GATEWAY
Windows
ping YOUR_GATEWAY -n 4
Replace YOUR_GATEWAY with the actual gateway shown by your own computer.
Step 6 — DNS Lookup
Linux
dig example.com
macOS
dig example.com
Windows
nslookup example.com
Step 7 — View Your Routing Table
Linux
ip route
macOS
netstat -rn
Windows
route print
Step 8 — View Your Network Connections
Linux
ss -tuln
macOS
lsof -nP -iTCP -sTCP:LISTEN
Windows
netstat -ano
🔬 Day 5 Mini Investigation
Create a table like this for your own machine:
| Item | Your Result |
|---|---|
| Network Interface | __________ |
| Private IPv4 | __________ |
| Subnet/CIDR | __________ |
| Default Gateway | __________ |
| MAC Address | __________ |
| DNS Resolver | __________ |
| ARP/Neighbor Entries | __________ |
| Listening TCP Ports | __________ |
⚠️ Don't publish this information publicly. MAC addresses, IP addresses, hostnames, usernames, and network details can reveal information about your environment.
🧠 Day 5 Security Mindset
When looking at network traffic, ask:
1. Who is communicating?
Source → Destination
2. What protocol is being used?
TCP?
UDP?
ICMP?
DNS?
HTTP?
HTTPS?
3. Which port is involved?
Source Port → Destination Port
4. What is the destination?
Local?
LAN?
Internet?
5. Is the communication expected?
This last question is especially important in defensive security.
🧪 Bonus: Compare TCP and UDP on Your Own Computer
Run:
Linux
ss -tuln
macOS
netstat -an
Windows
netstat -ano
Look at whether entries are associated with:
TCP
UDP
Don't attempt to modify or interfere with those connections.
Your objective is simply to understand what your operating system reports.
📝 Day 5 Assignment
Answer these questions:
1.
What is the purpose of an IP address?
2.
What does /24 mean in CIDR notation?
3.
What is a MAC address?
4.
What problem does ARP solve?
5.
What is ICMP?
6.
What happens during the TCP three-way handshake?
7.
What is the main conceptual difference between TCP and UDP?
8.
What does DNS do?
9.
What is the difference between a port and an IP address?
10.
What is a default gateway?
11.
What is a routing table?
12.
What is the difference between localhost, a private network address, and a public Internet address?
🏆 Day 5 Challenge
On your own computer, complete this workflow:
1️⃣ Find your IP
↓
2️⃣ Find your subnet/gateway
↓
3️⃣ Inspect ARP/neighbor information
↓
4️⃣ Test localhost
↓
5️⃣ Test your own gateway
↓
6️⃣ Perform a DNS lookup
↓
7️⃣ View your routing table
↓
8️⃣ View your own network connections
Then explain:
How does a packet travel from my computer toward another network?
Try to describe it using these terms:
Application
↓
TCP/UDP
↓
IP
↓
Gateway
↓
Router
↓
Destination
⚠️ Ethical Hacking Reminder
LEARNING PURPOSE ONLY: All commands in this lesson are intended for educational, troubleshooting, and authorized security testing purposes. Practice only on systems and networks you own or are explicitly authorized to test. Do not use ping, traceroute, DNS queries, network inspection, packet analysis, or future scanning techniques against unauthorized systems.
Permission comes before testing.
✅ Day 5 Summary
Today you learned:
IPv4 addressing
CIDR
Subnets
Network and host portions
MAC addresses
ARP
ICMP
TCP
TCP three-way handshake
UDP
Ports
DNS
Routing
Gateways
Traceroute
Network connections
Linux networking commands
Windows networking commands
macOS networking commands
The key concept is:
Ethical hackers need to understand how packets move before they can understand how network attacks work.
🔜 Day 6 — Nmap Fundamentals
Tomorrow we'll begin our first major security tool:
🔎 Nmap — Network Discovery & Security Auditing
We'll learn:
What Nmap is
Host discovery
Port concepts
TCP/UDP scanning concepts
Service detection
OS detection concepts
Reading Nmap results
Installing Nmap on Linux, Windows and macOS
Safe Nmap exercises against your own computer
Understanding why different scan types produce different results
⚠️ We will keep the practical work inside an authorized lab/your own machine.
🔐 Learn → Practice → Understand → Secure.
No comments:
Post a Comment