Networking

2.1 · How machines talk — IP addresses and the client/server model

For one device to send data to another, it needs the other's address. That address is its IP address — for example 10.10.10.2. The everyday form is four numbers, each from 0 to 255, joined by dots; this is IPv4. (There is a newer, longer form called IPv6, written with colons and hex, but IPv4 is what you will read most of the time.)

Because each of the four numbers is 0–255, you already know something from Module 1: each one is a single byte. An IPv4 address is just four bytes. That is not trivia — it is exactly why subnetting works, as you will see shortly.

Private and public addresses

Some address ranges are private: used only inside home and office networks, never routed across the public internet. You will see them everywhere in labs and internal engagements. Learn to recognise the three private ranges:

A public IP, by contrast, is reachable from the wider internet — a website's server has one. When you see 192.168.1.20 you are almost certainly looking at a machine inside a private network; 8.8.8.8 (a well-known public DNS server) is out on the open internet. How private addresses still reach the internet is a puzzle solved later in this module, by NAT.

Client and server

Most conversations follow the client/server pattern. The server waits, offering a service — a website, a database. The client starts the conversation and asks for something — your browser fetching a page. The same machine can be a server for one thing and a client for another. Keep this simple picture, because almost everything you test is one side talking to the other.

2.2 · Ports and services (and TCP vs UDP)

An IP address gets your message to the right machine — but a machine runs many services at once. A port is a numbered doorway that says which service you want.

Many ports are agreed by convention, so a scanner reporting an open port tells you what is probably running. A handful are worth memorising:

TCP and UDP

Every port is one of two styles. TCP is like a phone call: the two sides connect, then confirm each piece arrived and re-send anything lost — reliable, with a little overhead; the web, SSH and most services use it. UDP is like posting a letter and not checking it arrived: faster and lighter, no guarantee, used for DNS, voice and video. So 22/tcp open tells you both the doorway (22) and the delivery style (TCP).

2.3 · The kit in the rack — the devices a network is built from

On your first engagement a client will hand you a network diagram, and it will be drawn with a small, standard set of boxes. Nobody will stop to explain them. This section is that explanation, so the diagram reads like a sentence rather than a puzzle.

Hub versus switch — a small history with a big lesson

A hub has no idea who is who. A frame arriving on one port is repeated out of every other port, and each machine decides whether the frame was meant for it. The consequence is the point: on a hub, any machine could quietly record everybody's traffic.

A switch learns which device sits on which port and delivers each frame to that port alone. Hubs have all but vanished from real networks — but the word survives in interview questions and in decade-old diagrams, and the distinction is exactly why capturing traffic on a modern switched network takes a deliberate trick (a mirrored port, or an attack that fools the switch) rather than simply plugging in and listening.

What a typical company network looks like

Put those boxes together and almost every organisation you visit looks roughly like this:

The pocket hanging off the firewall has a name worth knowing. A DMZ (demilitarised zone) holds the machines that must be reachable from the internet — a public website, a mail relay. They are deliberately kept out of the internal network, so that breaking into the public web server does not automatically place an attacker next to the payroll database.

When you are put on an internal test, your first two questions are answered by a picture like this one: which of those boxes am I plugged into, and how many firewalls sit between me and what I want to reach. The rest of this module is really about answering those two questions properly.

2.4 · Thinking in layers — the OSI and TCP/IP models

You now have addresses, ports and hardware. The next idea ties them together, and it is the one piece of theory in this module that you will be asked about in an interview almost every time.

Networking is split into layers. Each layer does one job and hands its result to the next, and no layer needs to know how the others do their work. The browser asking for a page does not care whether the packet travels by fibre or by Wi-Fi; the cable does not care that it is carrying a web page. That separation is why the internet can change underneath us without every program breaking.

There are two models of this. The OSI model has seven layers and is the shared vocabulary the industry talks in. The TCP/IP model has four and is closer to how the internet is actually built. You are expected to know both, and to know that they describe the same journey at different resolutions.

A mnemonic that has survived decades, reading from layer 7 down to layer 1: All People Seem To Need Data Processing.

Why a security person actually needs this

Not for the trivia. The layer numbers are the vocabulary of the job — colleagues and clients use them as shorthand constantly, and a weakness only makes sense once you know which layer it lives at.

The service lines in Module 5 map onto this cleanly too. Network penetration testing works mostly at layers 3 and 4 — what is reachable and what is listening. Web application testing lives almost entirely at layer 7 — what the application does with what you send it. Knowing which layer you are working at tells you which questions are even worth asking.

2.5 · Subnetting and CIDR

A big network is split into smaller blocks called subnets. A subnet is simply a group of IP addresses that sit together and can talk to each other directly. You must understand this for one very practical reason: your permission to test — your scope — is almost always written as a subnet, and you have to know exactly which addresses it covers.

Reading CIDR notation

The modern shorthand is CIDR: an address, a slash, and a number — 10.10.10.0/24. The slash number says how much of the address is "fixed", which tells you how many addresses are in the block. An IPv4 address is 32 bits; the CIDR number says how many of those bits are locked. The one you meet most is /24 — it locks the first three numbers and lets only the last vary, giving 256 addresses:

So if a client scopes you to 192.168.5.0/24, you may test the 256 addresses from 192.168.5.0 to 192.168.5.255 — and nothing outside them. Reading CIDR correctly is the line between authorised testing and trespassing, which is why it returns as a hard rule in Module 5.

2.6 · Switching — inside one network

Now we look at how devices actually reach each other. Start small: several computers on the same network. What connects them is a switch, and this is the world of switching — moving traffic within a single local network (a LAN, Local Area Network).

MAC addresses — the local name tag

On the local wire, devices are not found by their IP but by a second, lower-level address: the MAC address, a unique identifier burned into every network card (it looks like 00:1A:2B:3C:4D:5E). A helpful way to hold the two apart:

• The IP address is like a postal address — used to route mail across the world, between networks. It can change depending on where you plug in.
• The MAC address is like a name tag on the person — used for hand-to-hand delivery in the room. It stays with the device.

A switch's whole job is efficient hand-to-hand delivery: it learns which device (MAC) sits on which of its ports, and forwards each message only to the correct port instead of shouting to everyone. All the devices a switch connects form one LAN — they can reach each other directly, without a router.

VLANs — one switch, separate networks

A single physical switch can be divided into separate VLANs (Virtual LANs), so that devices plugged into the same switch are kept in different networks and cannot talk directly. This is a first taste of segmentation — deliberately separating groups of machines, say putting staff laptops on one VLAN and servers on another. Consultants routinely review VLAN setups, because weak segmentation lets an attacker who lands on one VLAN wander into others.

2.7 · Routing — getting between networks

A switch moves traffic within one network. But how does a packet get from your network to a different one — another office subnet, or a website on the internet? That is routing, and the device that does it is a router.

The default gateway

Every device follows one simple rule. When it wants to send a packet, it asks: "is the destination on my own network?" If yes, the switch delivers it locally. If no, it hands the packet to its default gateway — the address of the router that leads out of the local network. The gateway is the door out of your subnet; you saw it if you ran ipconfig earlier (the "Default Gateway" line).

Routing tables and hops

Routers keep a routing table — a list of "to reach this network, send to that next router." A packet may cross several routers to reach its destination; each one is a hop. The tool traceroute (or tracert on Windows) shows you the hops a packet takes. And crucially: if no router in the chain knows a path to the destination network, you get an error like "Network unreachable" or "No route to host." Hold that phrase — it is the difference, in the next section, between "there is no path" and "a firewall is blocking me."

2.8 · NAT — many private addresses, one public one

Here is the puzzle from section 2.1: private addresses like 192.168.1.20 are not allowed on the public internet, and there are nowhere near enough public IPv4 addresses for every device on Earth. So how does your laptop, on a private address, reach a website? The answer is NAT — Network Address Translation.

Your router performs a neat trick. As a packet leaves your network for the internet, the router rewrites the private source address to its own single public address, and notes the swap in a table. When the reply comes back to the public address, the router looks up the table and rewrites it back to the right private device. Every device in your home shares that one public IP — which is exactly what you saw in the "what is my IP" exercise.

Why a consultant cares

NAT has a side effect that matters constantly. Because internal machines hide behind the router, they are not directly reachable from the internet — someone outside cannot simply connect to 192.168.1.20. To deliberately expose an internal service (say a web server) to the outside, an administrator sets up port forwarding: "traffic arriving at my public IP on port 443, send to 192.168.1.20:443." Understanding this tells you why a scan from the internet sees only the router's public face, while the same scan from inside the network sees the real hosts — and why "which side am I testing from?" is always a fair question.

2.9 · Segmentation and reachability — why you can't reach that other subnet

This is the section that saves you looking lost on your first internal engagement. You are given access and placed on a subnet — say 10.10.20.0/24. You try to reach a server on a different subnet, 10.10.30.10, and… nothing. A fresher panics or assumes the target is down. A consultant knows there are two very different reasons, and learns to tell them apart.

The two reasons you can't get through

1. No route (a routing problem). The two subnets simply are not connected for you — your gateway has no path to 10.10.30.0/24. The tell is an error like "Network unreachable" or "No route to host", usually returned quickly (Module 2.5).
2. A security boundary (a firewall rule). There is a route, but a firewall sitting between the segments is deliberately dropping your traffic. This is network segmentation used on purpose as a security control. The tell is different: your connection often just hangs and times out (the firewall silently drops the packet), rather than giving an instant "no route".

A third, friendlier response is worth knowing: "Connection refused" usually means you did reach the host, but nothing is listening on that port (or it is politely rejecting) — you have connectivity, just not that service. So three outcomes, three meanings: no route (routing has no path), timeout (likely a firewall dropping you), connection refused (you reached the host, port closed).

Why this is the heart of internal testing

Organisations segment their networks precisely so that a breach in one place does not become a breach everywhere — staff laptops should not freely reach the core banking servers. A big part of an internal engagement is testing exactly that: "from where I landed, what else can I reach, and what is correctly blocked?" When an attacker (or tester) does manage to move from one segment toward another, that movement is called pivoting or lateral movement. Good segmentation, enforced by firewall rules between subnets, is what makes pivoting hard — and reviewing those firewall rules (next section) is how a consultant checks the boundary holds.

2.10 · DHCP and DNS — getting an address, finding a name

Two quiet services run before you do anything at all on a network. One hands your machine an address; the other turns names into addresses. You have never configured either by hand, which is exactly why they are easy to overlook — and both are gold for a tester.

DHCP — how your device gets an address

You have never typed an IP address into your laptop, yet it always has one. DHCP (Dynamic Host Configuration Protocol) is why. When a device joins a network it shouts, in effect, "is anybody handing out addresses?" A DHCP server — usually the router or firewall itself — answers with an offer, the device asks to keep it, and the server confirms. Four steps, and they have a name you will hear: DORA — Discover, Offer, Request, Acknowledge.

The address is a lease, not a gift: it is held for a set time and then renewed, which is why a machine can come back tomorrow with a different address. Servers, by contrast, are usually given a fixed address by hand, precisely so that other machines can rely on finding them.

What matters for you is that DHCP does not hand over an address alone. In that one exchange your machine is also told:

Read that column again. Within seconds of plugging into a client's network socket, DHCP has told you your subnet, its size, the router to reach everything else, and the address of a name server that is probably a domain controller. That is the whole opening move of an internal engagement, handed over for free.

The reverse is informative too. If you plug in and get no address, the port is likely protected — many organisations use NAC (network access control, often 802.1X) to refuse unknown devices. Silence is itself a finding, and a good sign the client has done something right.

DNS — finding a name

You type sesmo.in, not an IP address — yet the network only routes by IP. Something must translate the name into a number. That something is the Domain Name System (DNS): the phone book of the internet. Your machine asks a DNS server "what is the IP for sesmo.in?", gets back an answer like 198.51.100.24, and only then connects. DNS mostly runs on port 53.

Protocols you will keep meeting

A protocol is just an agreed set of rules for a conversation. A small handful come up again and again:

• HTTP / HTTPS — the language of the web (Module 3). HTTPS is HTTP wrapped in encryption.
• SSH — an encrypted terminal login to a remote server.
• DNS — name-to-IP lookups, as above.
• SMTP — the protocol that carries email between mail servers.
• DHCP — hands out IP addresses automatically, as above.

You will not memorise every rule. The goal is recognition: when a report says "the finding is in the SMTP service" or "DNS was misconfigured," you know which conversation is meant.

2.11 · Config files and firewall rules

You have now met the three devices that hold a network together — the switch (within a network), the router (between networks), and the firewall (the security boundary that enforces segmentation). Every one of them is controlled by a configuration file — usually just called the config: a text file listing addresses, passwords, routes, VLANs, and rules. On a router or firewall you will hear the phrase running-config — the live configuration currently in effect. "Grab the running-config" means export that text so it can be reviewed.

Config review and firewall-rule review

Reading these files is genuine consulting work. A config review reads a device's config against a security standard and flags weak settings — default passwords still in place, management left unencrypted, risky features switched on. And because a firewall's config is largely a list of rules — each saying "allow traffic from this source, to this destination, on this port — or deny it" — a firewall rule review reads that list for holes: a rule that permits far too much, a forgotten "allow any" at the top that quietly overrides everything below, or the very segmentation gaps from section 2.9 (a path that should be blocked but isn't). You do not need to write these rules yet; you need to know they exist, live in a config file, and that reading them is a task you may be handed on day one.

Module 2 glossary

IP address

A device's routable address, e.g. 10.10.10.2 (four bytes in IPv4).

Private vs public IP

Private ranges (10.x, 172.16–31.x, 192.168.x) stay inside networks; public IPs face the internet.

Hub / switch / router

Repeats traffic to every port (obsolete) / connects devices inside one network / connects networks to each other.

Firewall

Allows or blocks traffic at a boundary according to a rule list.

DMZ

A walled-off pocket holding machines the internet must reach, kept out of the internal network.

OSI model

Seven layers describing a network journey — 7 application, 4 transport, 3 network, 2 data link, 1 physical.

TCP/IP model

The four-layer version the internet is actually built on: application, transport, internet, link.

DHCP

Leases a device its IP address plus subnet mask, default gateway and DNS server (Discover, Offer, Request, Acknowledge).

DNS

Turns a name such as sesmo.in into an IP address. Port 53.

Port

A numbered doorway selecting a service (80/443 web, 22 SSH, 3389 RDP).

TCP / UDP

Reliable connection (phone call) vs fast fire-and-forget (posted letter).

Subnet / CIDR

A block of addresses; /24 = 256, /16 = 65,536, /32 = one host.

Switch / MAC address

Connects devices within one LAN, delivering by MAC (the device's fixed hardware "name tag").

VLAN

A virtual split of one switch into separate networks — a segmentation control.

Router / default gateway

Moves traffic between networks; the gateway is the router a device sends non-local traffic to.

Routing table / hop

A router's list of paths to networks; each router crossed is one hop.

NAT / port forwarding

Many private IPs share one public IP; port forwarding exposes one internal service outward.

Segmentation

Deliberately separating groups of machines so a breach in one does not spread.

Pivoting / lateral movement

Moving from the segment you landed on toward another.

Config (running-config)

The text file that sets up a device; reviewing it is "config review".