Every attack and defense on the internet travels through a network. Understanding how data moves — through protocols, ports, and packets — is non-negotiable for any ethical hacker. This lesson covers the networking knowledge that underpins every technique in this course.

The OSI Model — 7 Layers of Communication

Every piece of data travels through 7 layers from software to hardware:

  • Layer 7 — Application: HTTP, DNS, FTP (what users interact with).
  • Layer 6 — Presentation: Encryption, compression (SSL/TLS).
  • Layer 5 — Session: Manages connections between applications.
  • Layer 4 — Transport: TCP (reliable) and UDP (fast) — ports live here.
  • Layer 3 — Network: IP addressing and routing.
  • Layer 2 — Data Link: MAC addresses, switches.
  • Layer 1 — Physical: Cables, radio waves, hardware.

IP Addresses & Subnetting

An IP address is like a home address for a device. IPv4 uses 32-bit addresses (e.g., 192.168.1.1). A subnet mask (e.g., /24 = 255.255.255.0) defines which part is the network and which is the host. Private IP ranges: 192.168.x.x, 10.x.x.x, 172.16.x.x.

Common Ports & Protocols — Know These by Heart

  • Port 21 — FTP (File Transfer, often unencrypted)
  • Port 22 — SSH (Secure Shell — encrypted remote access)
  • Port 23 — Telnet (insecure remote access, avoid)
  • Port 25 — SMTP (email sending)
  • Port 53 — DNS (domain name resolution)
  • Port 80 — HTTP (web traffic, unencrypted)
  • Port 443 — HTTPS (web traffic, encrypted)
  • Port 3306 — MySQL database
  • Port 3389 — RDP (Windows Remote Desktop)

TCP vs UDP

TCP (Transmission Control Protocol) is connection-oriented — it confirms delivery (like a registered letter). UDP (User Datagram Protocol) is connectionless and fast — no confirmation (like a postcard). Hackers exploit both: TCP for reliable connections, UDP for DNS amplification attacks.

DNS — How Domain Names Resolve

When you type google.com, your computer asks a DNS resolver for the IP. DNS can be attacked via DNS poisoning (feeding false records) or used for enumeration (finding subdomains).

Practical Exercise: Network Analysis

  1. Step 1: Open your terminal. Run: ping google.com — observe TTL and response time.
  2. Step 2: Run: traceroute google.com (Linux/Mac) or tracert google.com (Windows). Map the hops.
  3. Step 3: Run: nslookup google.com — identify the IP address and DNS server.
  4. Step 4: Install Wireshark. Open it, select your network interface, and browse a website. Filter by ‘http’ and examine the packet contents.
  5. Step 5: Run: netstat -an — list all active connections and the ports your machine is using.

Tools Used in This Lesson

Tool

Purpose

Free / Paid

Wireshark

Packet capture & analysis

Free

ping / traceroute

Network diagnostics

Free (built-in)

nslookup / dig

DNS lookup tools

Free (built-in)

Cisco Packet Tracer

Network simulation

Free

 

Lesson Outcome

Students can explain the OSI model, identify IP addresses and subnets, know critical ports by memory, and capture/analyze live network traffic with Wireshark.
PreviousNext