Cyber Defence
Networking Guide

Networking Fundamentals for Ethical Hackers

Building the Foundation for Penetration Testing Success

By Amit Kumar|February 22, 2026|14 min read

OSI Model and TCP/IP

# OSI Model (7 Layers)
7. Application    - HTTP, FTP, SMTP, DNS
6. Presentation   - SSL/TLS, ASCII, JPEG
5. Session        - NetBIOS, RPC
4. Transport      - TCP, UDP, Ports
3. Network        - IP, Routing, ICMP
2. Data Link      - Ethernet, ARP, MAC
1. Physical       - Cables, Signals

# TCP 3-Way Handshake (Connection)
Client ---SYN---> Server
Client <--SYN-ACK- Server
Client ---ACK---> Server
Connection Established!

# Common Ports
20/21  FTP (file transfer)
22     SSH (secure shell)
23     Telnet (unencrypted)
25     SMTP (email)
53     DNS (domain resolution)
80     HTTP (web)
443    HTTPS (secure web)
3306   MySQL
3389   RDP (Windows)
5432   PostgreSQL

Network Scanning Commands

# Host Discovery
nmap -sn 192.168.1.0/24          # Ping sweep
nmap -PR -sn 192.168.1.0/24      # ARP scan
netdiscover -i eth0 -r 192.168.1.0/24

# Port Scanning
nmap -sS -p- 192.168.1.100       # SYN scan all ports
nmap -sV -p 22,80,443,3306 target # Version detection
nmap -O target.com               # OS detection
nmap -A target.com                # Aggressive scan

# Service Enumeration
nmap --script=banner target.com   # Banner grabbing
nmap --script=http-enum target.com # HTTP enum
nmap --script=smb-enum-users target # SMB enum

# Output Options
nmap -oA scan_results target.com  # All formats
nmap -oX results.xml target.com    # XML format
nmap -oN results.nmap target.com   # Normal format

Network Attack Vectors

ARP Poisoning

Spoof ARP table to intercept traffic

DNS Spoofing

Redirect victims to fake websites

Man-in-the-Middle

Intercept communications between parties

MAC Flooding

Overwhelm switch MAC table

Frequently Asked Questions

What networking concepts are essential for ethical hacking?

Essential concepts: TCP/IP model and protocols, OSI model layers, IP addressing (IPv4/IPv6), subnetting, routing and switching, DNS, DHCP, ARP, common ports (HTTP=80, HTTPS=443, SSH=22, FTP=21), packet analysis, network segmentation, and firewall concepts. Understanding how data moves across networks is fundamental to both attacking and defending systems.

How does TCP/IP work for penetration testers?

TCP/IP model: Application layer (HTTP, FTP, DNS), Transport layer (TCP/UDP with ports), Internet layer (IP addressing, routing), Link layer (MAC addresses, ARP). Each layer offers attack vectors: DNS spoofing, port exploitation, IP spoofing, ARP poisoning. Understanding the 3-way handshake (SYN, SYN-ACK, ACK) is crucial for understanding port scanning and connection-based attacks.

What are the most important ports for hackers to know?

Critical ports: 21 (FTP), 22 (SSH), 23 (Telnet), 25 (SMTP), 53 (DNS), 80/443 (HTTP/HTTPS), 110/143 (Email), 139/445 (SMB), 3306 (MySQL), 3389 (RDP), 5432 (PostgreSQL), 8080 (HTTP Alt). During enumeration, scan these ports first as they commonly expose vulnerabilities. UDP ports like 53 (DNS), 67 (DHCP) also important.

How do I perform network reconnaissance?

Network recon steps: 1) Discover live hosts (ping sweep, ARP scan), 2) Identify OS (TTL analysis, banner grabbing), 3) Port scan (nmap syn scan), 4) Service enumeration (version detection), 5) OS fingerprinting, 6) Vulnerability assessment. Tools: nmap, masscan, rustscan for scanning; Wireshark for traffic analysis; netdiscover for ARP enumeration.

What is the difference between TCP and UDP scanning?

TCP scanning: Reliable, connection-oriented, 3-way handshake, slower but accurate. Types: SYN scan (stealth), Connect scan, ACK scan (firewall detection). UDP scanning: Faster, connectionless, unreliable. UDP services often go undetected. UDP scan sends packet and checks for ICMP port unreachable. Results less reliable - scan common UDP ports (53, 161, 123) explicitly.

Master Networking with Cyber Defence

Build solid networking foundations for your ethical hacking career.

View Course