Techzone/Networking

Networking

3 min readArticle

Core networking knowledge is the foundation of everything in IT and security. If you don't understand how packets flow, you can't effectively attack or defend systems.

The OSI Model

Layer Name Examples
7 Application HTTP, FTP, DNS, SMTP
6 Presentation SSL/TLS, encoding
5 Session NetBIOS, RPC
4 Transport TCP, UDP
3 Network IP, ICMP, routing
2 Data Link Ethernet, WiFi (802.11), MAC
1 Physical Cables, radio waves

"Please Do Not Throw Sausage Pizza Away" (bottom up)

TCP vs UDP

Feature TCP UDP
Connection Handshake required Connectionless
Reliability Guaranteed delivery No guarantee
Order In-order delivery No ordering
Speed Slower (overhead) Faster
Use cases HTTP, SSH, FTP, SMTP DNS, DHCP, VoIP, video streaming

TCP Handshake

shell 
Client                    Server
  |---SYN---------------->|
  |<--SYN-ACK-------------|
  |---ACK---------------->|
  (connection established)

Key Protocols

IP Addressing

bash 
# Private ranges (RFC 1918)
10.0.0.0/8          # Class A (10.x.x.x)
172.16.0.0/12       # Class B (172.16-31.x.x)
192.168.0.0/16      # Class C (192.168.x.x)

# CIDR notation
192.168.1.0/24      # 256 addresses, 254 usable
192.168.1.0/25      # 128 addresses, 126 usable
192.168.1.0/30      # 4 addresses, 2 usable (point-to-point)

# Subnet mask cheat sheet
/8  = 255.0.0.0
/16 = 255.255.0.0
/24 = 255.255.255.0
/25 = 255.255.255.128
/28 = 255.255.255.240
/30 = 255.255.255.252

DNS

bash 
# Query DNS
nslookup google.com
dig google.com
dig google.com MX          # Mail records
dig google.com TXT         # Text records (SPF, DKIM, etc.)
dig @8.8.8.8 google.com   # Query specific DNS server

# Reverse lookup
dig -x 8.8.8.8

# Zone transfer attempt
dig axfr @ns1.target.com target.com

ARP

bash 
# View ARP table
arp -a
ip neigh

# ARP scan (find hosts)
arp-scan --interface=eth0 192.168.1.0/24

# Clear ARP cache
arp -d 192.168.1.1
ip neigh flush all

DHCP

bash 
# Renew DHCP lease
dhclient -r  # Release
dhclient     # Request new

# On Windows
ipconfig /release
ipconfig /renew

Common Ports Quick Reference

Port Protocol Service
21 TCP FTP
22 TCP SSH
23 TCP Telnet
25 TCP SMTP
53 TCP/UDP DNS
80 TCP HTTP
110 TCP POP3
143 TCP IMAP
443 TCP HTTPS
445 TCP SMB
3306 TCP MySQL
3389 TCP RDP
5432 TCP PostgreSQL
8080 TCP Alt HTTP
8443 TCP Alt HTTPS

Routing

bash 
# Show routing table
ip route show
route -n  # Linux legacy
netstat -rn

# Add static route
ip route add 10.0.0.0/8 via 192.168.1.1

# Default gateway
ip route add default via 192.168.1.1

# Trace route
traceroute google.com
tracepath google.com

Wireshark / Traffic Analysis

bash 
# Capture with tcpdump
sudo tcpdump -i eth0 -w capture.pcap

# Quick analysis
tcpdump -r capture.pcap -n 'tcp port 80'
tshark -r capture.pcap -Y "http"

Networking Tools Cheat Sheet

Tool Use
ping ICMP echo test
traceroute Path to host
nmap Port/service scan
netstat Active connections
ss Socket statistics (modern)
arp-scan LAN host discovery
nslookup/dig DNS queries
tcpdump Packet capture
wireshark Visual packet analysis
iptables Linux firewall rules

Sub-pages

  • cisco-networking-guide - Cisco IOS networking
  • fortigate-firewall-guide - FortiGate firewall
techzonesite.comUnlock Your IT Potential