Every attack and defense on the internet travels through a network. Understanding how data moves — through protocols, ports, and packets — is non-negotiable for any ethical hacker. This lesson covers the networking knowledge that underpins every technique in this course.

The OSI Model — 7 Layers of Communication

Every piece of data travels through 7 layers from software to hardware:

• Layer 7 — Application: HTTP, DNS, FTP (what users interact with).
• Layer 6 — Presentation: Encryption, compression (SSL/TLS).
• Layer 5 — Session: Manages connections between applications.
• Layer 4 — Transport: TCP (reliable) and UDP (fast) — ports live here.
• Layer 3 — Network: IP addressing and routing.
• Layer 2 — Data Link: MAC addresses, switches.
• Layer 1 — Physical: Cables, radio waves, hardware.

IP Addresses & Subnetting

An IP address is like a home address for a device. IPv4 uses 32-bit addresses (e.g., 192.168.1.1). A subnet mask (e.g., /24 = 255.255.255.0) defines which part is the network and which is the host. Private IP ranges: 192.168.x.x, 10.x.x.x, 172.16.x.x.

Common Ports & Protocols — Know These by Heart

• Port 21 — FTP (File Transfer, often unencrypted)
• Port 22 — SSH (Secure Shell — encrypted remote access)
• Port 23 — Telnet (insecure remote access, avoid)
• Port 25 — SMTP (email sending)
• Port 53 — DNS (domain name resolution)
• Port 80 — HTTP (web traffic, unencrypted)
• Port 443 — HTTPS (web traffic, encrypted)
• Port 3306 — MySQL database
• Port 3389 — RDP (Windows Remote Desktop)

TCP vs UDP

TCP (Transmission Control Protocol) is connection-oriented — it confirms delivery (like a registered letter). UDP (User Datagram Protocol) is connectionless and fast — no confirmation (like a postcard). Hackers exploit both: TCP for reliable connections, UDP for DNS amplification attacks.

DNS — How Domain Names Resolve

When you type google.com, your computer asks a DNS resolver for the IP. DNS can be attacked via DNS poisoning (feeding false records) or used for enumeration (finding subdomains).

Practical Exercise: Network Analysis

1. Step 1: Open your terminal. Run: ping google.com — observe TTL and response time.
2. Step 2: Run: traceroute google.com (Linux/Mac) or tracert google.com (Windows). Map the hops.
3. Step 3: Run: nslookup google.com — identify the IP address and DNS server.
4. Step 4: Install Wireshark. Open it, select your network interface, and browse a website. Filter by ‘http’ and examine the packet contents.
5. Step 5: Run: netstat -an — list all active connections and the ports your machine is using.

Tools Used in This Lesson