This article is Day 5 of a 100-day ethical hacking course, providing foundational networking knowledge necessary for practical hacking work. It explains that nearly every ethical hacking operation—port scanning, traffic interception, reverse shells, and man-in-the-middle attacks—relies on networking concepts, and that using tools without understanding these fundamentals leads to failure when unexpected results occur. The article covers the OSI model, TCP vs UDP protocols, IP addressing, ports, DNS, ARP, HTTP vs HTTPS, and traces a complete packet journey from browser to server to unify these concepts.
- Why networking knowledge is essentialThe article argues that students who skip networking basics and jump directly to tools like Nmap and Burp Suite hit a wall when results differ from expectations because they cannot explain what packets are doing or why protocols behave differently. Every core hacking operation—Nmap port scanning using TCP packets, Burp Suite HTTP proxying, reverse shell TCP connections, and ARP poisoning for MITM attacks—is fundamentally a networking operation requiring conceptual understanding.
- OSI model layers and attack surfacesThe article presents the 7-layer OSI model with specific hacking implications for each: Layer 7 (Application) targets web vulnerabilities; Layer 6 (Presentation) faces SSL stripping and certificate spoofing; Layer 4 (Transport) is vulnerable to port scanning and SYN floods; Layer 3 (Network) to IP spoofing; Layer 2 (Data Link) to ARP poisoning and MAC spoofing; and Layer 1 (Physical) to wireless sniffing. The article notes most practitioners use a simplified TCP/IP 4-layer model but understanding all 7 layers is essential for certifications and professional communication.
- TCP three-way handshake mechanismThe article explains TCP connections require three steps: client sends SYN, server responds SYN-ACK, client sends final ACK. Nmap's SYN scan deliberately stops after receiving SYN-ACK by sending RST to avoid completing the handshake; if the target port is closed, the server immediately responds with RST; if filtered by a firewall, there is no response at all. This understanding is critical because incomplete connections appear different from closed or filtered ports.
- Private IP address ranges and usesThe article specifies three reserved private ranges: Class A (10.0.0.0/8) for enterprises and cloud providers with 16 million addresses, Class B (172.16.0.0/12) for VMs and Docker, and Class C (192.168.0.0/16) for most home routers. Special addresses include 127.0.0.1 for loopback, 0.0.0.0 for all interfaces in listeners, and 255.255.255.255 for broadcast. Understanding these ranges is necessary to identify which addresses are local network only versus routable on the internet.
- Port scanning and service enumerationThe article maps common ports to their protocols and hacker relevance: port 21 (FTP) offers anonymous auth opportunities, port 22 (SSH) and 3389 (RDP) support brute force, port 25 (SMTP) enables phishing, ports 139/445 (SMB) allow EternalBlue exploitation, and port 3306 (MySQL) represents exposed databases. Port ranges are categorized as well-known (0-1023, requiring root), registered (1024-49151), and dynamic/ephemeral (49152-65535), with the `ss -tuln` command showing listening services on a machine.
- DNS as reconnaissance and attack vectorThe article demonstrates DNS tools showing how attackers enumerate infrastructure: `nslookup` and `dig` reveal A records for IP resolution, MX records for mail servers, NS records for name servers, and TXT records for SPF/DKIM. Zone transfers via `dig axfr` can retrieve entire DNS zones listing all subdomains and records when misconfigured. The article notes DNS enumeration is valuable in bug bounty work because forgotten subdomains like dev.target.com and staging.target.com often run older, unpatched software.
- ARP poisoning enables man-in-the-middle attacksThe article explains ARP's function: devices broadcast requests for MAC addresses corresponding to IP addresses, and responses are cached without verification. Because ARP is completely trusting, an attacker can broadcast false ARP replies claiming an IP address maps to the attacker's MAC, causing all targeted traffic to be redirected through the attacker's machine. This is the foundational mechanism enabling ARP poisoning MITM attacks that appear later in the course.
- HTTPS encryption protects transit, not applicationsThe article clarifies that HTTPS adds TLS encryption protecting content in transit from network observers, whereas HTTP exposes all data in plaintext including passwords and cookies. However, the article explicitly states that HTTPS does not protect against application-level vulnerabilities—SQL injection, XSS, broken authentication, and other web flaws are equally possible on HTTPS sites. The lock icon indicates encrypted connection, not application security.
Bottom line: Networking fundamentals are non-negotiable for ethical hackers because every attack tool operates through network protocols; understanding the OSI model layers, TCP/UDP mechanics, IP addressing, ports, DNS, ARP, and the complete packet journey from browser to server allows practitioners to troubleshoot unexpected results and adapt techniques rather than blindly following tool instructions. The article provides a unified mental model showing how all these concepts connect through a single real-wo
Day 100 — Professional Pentester
This lesson has a reputation for being dry. I’m going to make it the opposite. We’re going to trace a real connection — from you typing a URL in a browser to receiving the page — and explain every networking concept through that single journey. No abstract theory divorced from reality. Just the real thing, explained clearly.
- Why Networking Is Non-Negotiable
- The OSI Model — 7 Layers Explained
- TCP vs UDP — The Two Protocols
- IP Addresses — Public vs Private
- Ports — The Service Directory
- DNS — The Internet’s Phone Book
- ARP — How Devices Find Each Other
- HTTP vs HTTPS — Why It Matters
- Tracing a Full Packet Journey
- Day 5 Practical Task
Why Networking Is Non-Negotiable for Ethical Hackers
Here is the honest truth: almost every attack in ethical hacking is a networking operation. When you scan for open ports, you’re sending TCP packets and reading responses. When you intercept traffic with Burp Suite, you’re acting as a proxy in an HTTP conversation. When you set up a listener for a reverse shell, you’re opening a TCP socket and waiting for a connection. When you perform a man-in-the-middle attack, you’re manipulating ARP tables.
The students who struggle most in this field are the ones who skipped networking basics and jumped straight to tools. They can run Nmap but can’t explain what a SYN packet is. They can intercept HTTP with Burp but don’t know why HTTPS is different. Tools without understanding is a dead end — you hit the first unexpected result and have no idea why.
The OSI Model — 7 Layers That Explain Everything
The OSI (Open Systems Interconnection) model is a conceptual framework with 7 layers that describes how network communication works. Each layer has a specific job and communicates with the layers immediately above and below it. When data travels from your browser to a server, it passes through all 7 layers — twice.
I’m going to give you the hacker’s take on each layer — not a textbook definition, but what each layer means for the attacks and defences you’ll encounter over the next 95 days.
TCP vs UDP — The Two Protocols Every Hacker Works With
At the Transport Layer (Layer 4), two protocols carry the vast majority of all internet traffic: TCP and UDP. Understanding the difference between them is not optional — Nmap’s scan types, reverse shell selection, and service fingerprinting all depend on it.
| Property | TCP | UDP |
|---|---|---|
| Connection | Connection-oriented (3-way handshake) | Connectionless (fire and forget) |
| Delivery | Guaranteed — retransmits lost packets | Not guaranteed — packets may be lost |
| Speed | Slower (overhead for reliability) | Faster (no connection overhead) |
| Use cases | HTTP, HTTPS, SSH, FTP, SMTP | DNS, VoIP, video streaming, gaming |
| Hacker relevance | Port scanning (SYN scan), reverse shells, exploits | DNS enumeration, UDP service discovery |
| Nmap flag | -sS (SYN) or -sT (TCP connect) | -sU (UDP scan) |
The TCP Three-Way Handshake — How Connections Are Established
Every TCP connection begins with a handshake. When Nmap does a SYN scan, it deliberately doesn’t complete this handshake — and understanding why requires knowing what the handshake looks like.
IP Addresses — Public, Private, and Why the Difference Matters
An IP (Internet Protocol) address is a number that uniquely identifies a device on a network. Think of it as a postal address — without it, nobody knows where to send data. There are two types that matter enormously in ethical hacking: public and private.
Ports — The Service Directory of Every Host
An IP address gets you to the right machine. A port gets you to the right service on that machine. Every server runs multiple services simultaneously — web server, SSH server, database, email. Ports (numbered 0–65535) allow all of these to coexist on one IP address. Port scanning is the act of knocking on each door and seeing who answers.
| Port | Protocol | Service | Hacker Relevance |
|---|---|---|---|
| 21 | TCP | FTP | Often anonymous auth, cleartext credentials |
| 22 | TCP | SSH | Brute force target, key-based auth |
| 23 | TCP | Telnet | Completely cleartext — dangerous if open |
| 25 | TCP | SMTP | Email — phishing infrastructure |
| 53 | TCP/UDP | DNS | DNS enumeration, zone transfers |
| 80 | TCP | HTTP | Web attacks — unencrypted traffic visible |
| 110 | TCP | POP3 | Email retrieval — often cleartext |
| 139/445 | TCP | SMB | EternalBlue, pass-the-hash, shares |
| 443 | TCP | HTTPS | Web attacks — encrypted but still vulnerable |
| 3306 | TCP | MySQL | DB exposed to network? Major finding. |
| 3389 | TCP | RDP | Windows remote desktop — brute force, BlueKeep |
| 8080/8443 | TCP | HTTP Alt | Dev servers, admin panels, web proxies |
DNS — The Internet’s Phone Book (And a Hacker’s Gold Mine)
DNS (Domain Name System) translates human-readable domain names — securityelites.com — into IP addresses that computers use. Without DNS, you’d have to memorise the IP address of every website you visit. DNS is also one of the most commonly exploited services in real-world attacks, because it’s almost always allowed through firewalls.
dev.target.com, staging.target.com) that run older, unpatched software. We go deeper into DNS and OSINT recon on Day 9.ARP — How Devices Find Each Other on a Local Network
ARP (Address Resolution Protocol) bridges the gap between Layer 3 (IP addresses) and Layer 2 (MAC addresses). When your computer wants to send data to 192.168.1.1 (the router), it needs to know the router’s physical MAC address to actually deliver the frame. ARP handles this lookup — and its trusting nature is exactly what makes ARP poisoning attacks possible.
HTTP vs HTTPS — Why the Lock Icon Is Not Enough
HTTP (Hypertext Transfer Protocol) is the language web browsers use to communicate with web servers. It’s the protocol at Layer 7, and it’s completely cleartext — meaning anyone who can see the traffic can read it. HTTPS adds TLS encryption to HTTP, which protects the content in transit.
- Everything visible to anyone on the network path
- Passwords, cookies, and form data readable in plaintext
- Trivially captured with Wireshark or a network tap
- Still used on internal networks and legacy systems
- Content encrypted — interceptors see ciphertext only
- Server identity verified by trusted certificate
- Still vulnerable to application-level attacks (XSS, SQLi)
- Can be stripped or certificate-spoofed without pinning
🗺️ Tracing a Full Packet Journey — URL to Response
Let’s trace exactly what happens when you type https://securityelites.com into your browser and press Enter. Every concept we covered today appears in this journey — this is the unified picture.
GET / HTTP/1.1 Host: securityelites.com. This travels inside the encrypted TLS tunnel.🎯 Day 5 Practical Task — Network Reconnaissance on Your Own Lab
ip route
arp -a
dig securityelites.com
dig google.com MX
dig -x 8.8.8.8
curl -I https://google.com
curl -v https://example.com 2>&1 | head -40
nmap -sV 127.0.0.1
nmap -p 1-1000 127.0.0.1
Use traceroute to trace the path from your Kali VM to Google’s DNS server. Count the hops. Which hop is your router? Which is your ISP? This is the real internet routing you read about today — now you can see it live.
traceroute 8.8.8.8
traceroute securityelites.com
📡
You know how every packet moves.
Five days in — you’ve built the mindset, the lab, the command line, the file system map, and now the networking foundation. Day 6 goes deeper into IP addressing and subnetting — the math behind how networks are designed and how pentesters identify target ranges. It’s easier than it sounds, and more useful than you’d expect.
Frequently Asked Questions — Day 5 Networking Basics for Hackers
Networking was the topic I was most intimidated by when I started. Then someone showed me that a packet is just a digital envelope with an address on it — and suddenly the entire model clicked. If it clicked for you today, you’re right on track. The tools we pick up from Day 10 onwards will make complete sense now.
