The OSI Model
Seven layers describing how data travels from an application on one machine to an application on another. In cybersecurity, naming the layer immediately tells you what kind of problem, log signature, or exploit you are dealing with.
The Stack (Physical to Application)
Mnemonic (Bottom-Up): Please Do Not Throw Sausage Pizza Away (Physical, Data Link, Network, Transport, Session, Presentation, Application).
Layer Breakdown & Offensive Security Angles
A switch forwards a frame based on a MAC address, and gets flooded with thousands of fake MAC addresses until its CAM table overflows and it starts broadcasting all packets to every port. What OSI layer is this attack, and what is it called?
Reveal Solution
Attack Name: MAC Flooding (CAM Table Overflow) — Turns an intelligent switch into a dumb hub, allowing an attacker to sniff all traffic across the LAN without active ARP poisoning.
You run nmap -sS target.com and it discovers that port 443 is open. Which OSI layers were directly involved in producing this result?
Reveal Solution
Why: L3 routes IP packets to the target. L4 handles the TCP SYN packet and reads the SYN-ACK response on port 443. L7 is not touched because Nmap aborts with an RST before establishing a TLS/HTTPS handshake.
TCP/IP Model & the Three-Way Handshake
The practical model the internet actually runs on. 4 layers instead of 7 — OSI is the conceptual reference, while TCP/IP is the implementation stack.
| TCP/IP Layer | Maps to OSI | Protocols & Examples |
|---|---|---|
| Application | L5, L6, L7 | HTTP, HTTPS, DNS, SSH, FTP, SMTP |
| Transport | L4 | TCP (reliable), UDP (fast/stateless) |
| Internet | L3 | IPv4, IPv6, ICMP, ARP (L2/L3 hybrid) |
| Network Access | L1, L2 | Ethernet, 802.11 Wi-Fi, MAC frames, Fiber |
TCP vs UDP Comparison
| Property | TCP (Transmission Control Protocol) | UDP (User Datagram Protocol) |
|---|---|---|
| Connection State | Connection-oriented (3-way handshake required) | Connectionless (fire and forget) |
| Reliability | Guaranteed delivery, acknowledgments, retransmission | Best-effort, packets can be dropped or arrive out of order |
| Header Overhead | 20–60 bytes (flags, sequence numbers, checksums) | 8 bytes (minimal header, low latency) |
| Primary Uses | HTTPS, SSH, SFTP, REST APIs, Database connections | DNS queries, VoIP, Video streaming, DHCP, SNMP |
The TCP Three-Way Handshake (SYN → SYN-ACK → ACK)
Client Server | | | -------------- [SYN: Seq = X] -----------------> | "Client initiating connection, my sequence is X" | | | <------- [SYN-ACK: Seq = Y, Ack = X+1] --------- | "Server agrees, my sequence is Y, acknowledging X+1" | | | -------------- [ACK: Ack = Y+1] ---------------> | "Client acknowledges Y+1, connection established!" | | | <============= Full Duplex Stream =============> |
Nmap's default SYN scan (-sS) sends a SYN, reads the SYN-ACK to verify the port is open, and immediately transmits an RST packet without sending the final ACK. This "half-open" scan is fast and historic logging engines only recorded completed connections.
In a Wireshark capture, you see a host send a SYN packet, the server reply with SYN-ACK, but no final ACK is ever returned. What are the two most likely explanations?
Reveal Solution
Explanation 2: Network Issue: Stateful firewall silently dropping outbound ACK packets, or high packet loss on the return route.
Why do attackers prefer UDP over TCP when performing DNS or NTP reflection DDoS amplification attacks?
Reveal Solution
IP Addressing & CIDR
An IPv4 address consists of 32 bits arranged in four 8-bit octets (0–255), separated by dots.
Decimal: 192 . 168 . 1 . 10 Binary: 11000000 . 10101000 . 00000001 . 00001010 (32 total bits)
Private vs. Public IPv4 Ranges (RFC 1918)
| Range (RFC 1918) | CIDR Block | Total Addresses | Typical Environment |
|---|---|---|---|
| 10.0.0.0 – 10.255.255.255 | 10.0.0.0/8 | 16,777,216 | Large enterprise networks, cloud VPCs |
| 172.16.0.0 – 172.31.255.255 | 172.16.0.0/12 | 1,048,576 | Corporate branches, Docker networks |
| 192.168.0.0 – 192.168.255.255 | 192.168.0.0/16 | 65,536 | Home networks, SOHO routers |
| 127.0.0.0 – 127.255.255.255 | 127.0.0.0/8 | 16,777,216 | Loopback (Localhost: 127.0.0.1) |
| 169.254.0.0 – 169.254.255.255 | 169.254.0.0/16 | 65,536 | APIPA (DHCP assignment failure) / AWS IMDS |
When conducting internal network penetration tests, discovering 10.x.x.x or 172.16–31.x.x confirms you have breached the internal perimeter and are inside private infrastructure. Finding 169.254.169.254 is the AWS Instance Metadata Service (IMDS) — a primary target for SSRF credential theft.
CIDR Notation & Usable Host Calculation
The slash number (/24) denotes how many bits from the left represent the network prefix. The remaining bits belong to the host portion.
Formula: Usable Hosts = 2(32 - CIDR) - 2 (Subtracting Network ID and Broadcast Address).
| CIDR | Subnet Mask | Host Bits (H) | Total IPs (2H) | Usable Hosts (2H - 2) |
|---|---|---|---|---|
| /24 | 255.255.255.0 | 8 | 256 | 254 |
| /25 | 255.255.255.128 | 7 | 128 | 126 |
| /26 | 255.255.255.192 | 6 | 64 | 62 |
| /27 | 255.255.255.224 | 5 | 32 | 30 |
| /28 | 255.255.255.240 | 4 | 16 | 14 |
| /29 | 255.255.255.248 | 3 | 8 | 6 |
| /30 | 255.255.255.252 | 2 | 4 | 2 (Point-to-point links) |
| /32 | 255.255.255.255 | 0 | 1 | 1 (Single host route) |
Is the IP address 172.28.104.12 a public or private IP?
Reveal Solution
172.16.0.0/12 (172.16.0.0 through 172.31.255.255).
How many usable host IP addresses are available on a /29 subnet?
Reveal Solution
Subnetting & CIDR — Worked Practice
The core mental math method to calculate Network Address, Broadcast Address, and Usable Ranges without relying on an online calculator.
5-Step Mental Subnetting Algorithm
- Identify the Interesting Octet: Determine which octet contains the split between network and host bits.
- Find the Subnet Mask Value: e.g.,
/26= 2 bits on in 4th octet = 128 + 64 = 192. - Calculate Block Size (Magic Number):
Block Size = 256 - Mask Value(256 - 192 = 64). - Count in Multiples of Block Size: 0, 64, 128, 192... to locate the subnet boundary containing the target IP.
- Derive Addresses:
- Network ID: The base multiple.
- Broadcast Address: Next block multiple minus 1.
- Usable Range: Network ID + 1 through Broadcast - 1.
Worked Example: 192.168.1.130/26 1. Mask for /26 = 255.255.255.192 (Interesting octet is the 4th octet) 2. Block size = 256 - 192 = 64 3. Blocks: 0, 64, 128, 192... 130 falls between 128 and 192 -> Network = 192.168.1.128 Results: Network Address: 192.168.1.128 First Usable IP: 192.168.1.129 Last Usable IP: 192.168.1.190 Broadcast Address: 192.168.1.191 (192 - 1)
Find the network address, broadcast address, and usable host range for 10.0.0.75/28.
Reveal Solution
2. Block Size: 256 - 240 = 16
3. Blocks: 0, 16, 32, 48, 64, 80... 75 falls between 64 and 80.
Network Address: 10.0.0.64
Usable Host Range: 10.0.0.65 – 10.0.0.78
Broadcast Address: 10.0.0.79
Are hosts 192.168.10.60/28 and 192.168.10.68/28 on the same subnet?
Reveal Solution
Host 1 (.60): Lies in subnet 192.168.10.48/28 (range: .49 to .62).
Host 2 (.68): Lies in subnet 192.168.10.64/28 (range: .65 to .78).
Result: No, different subnets. They require a router to communicate.
You are assigned 192.168.5.0/24 and instructed to split it into 4 equal subnets for SecOps, Engineering, HR, and Management. What is the new CIDR and what are the 4 subnets?
Reveal Solution
Block Size: 256 - 192 = 64.
Subnet 1: 192.168.5.0/26 (Usable: .1 to .62)
Subnet 2: 192.168.5.64/26 (Usable: .65 to .126)
Subnet 3: 192.168.5.128/26 (Usable: .129 to .190)
Subnet 4: 192.168.5.192/26 (Usable: .193 to .254)
A host has IP 172.16.14.200 with mask 255.255.240.0. What CIDR is that, and what is the network address?
Reveal Solution
Block Size: 256 - 240 = 16 in 3rd octet. Blocks: 0, 16, 32... 14 falls between 0 and 16.
Network Address: 172.16.0.0/20
NAT & DHCP
The two mechanisms powering LAN connectivity: NAT allows thousands of private IP endpoints to share public internet routes, while DHCP assigns IP configurations dynamically.
NAT Flavors
| NAT Type | Mapping Relationship | Use Case |
|---|---|---|
| Static NAT | 1 Private IP ↔ 1 Fixed Public IP | Exposing internal web/mail servers publicly |
| Dynamic NAT | Many Private IPs ↔ Pool of Public IPs | Temporary public IP mapping on demand |
| PAT (NAT Overload) | Thousands of Private IPs ↔ 1 Public IP (Unique Ports) | Standard residential and enterprise office egress |
The DHCP DORA Handshake
Client (0.0.0.0:68) DHCP Server (255.255.255.255:67) | | | -------- 1. DHCP Discover (Layer 2 & 3 Broadcast) --------------> | "Does any server have an IP for me?" | | | <------- 2. DHCP Offer (Unicast / Broadcast) -------------------- | "You can lease 192.168.1.50 with /24" | | | -------- 3. DHCP Request (Broadcast confirmation) --------------> | "I accept 192.168.1.50 from Server A" | | | <------- 4. DHCP Ack (Final Acknowledgement) -------------------- | "Confirmed! Lease valid for 24 hours."
An attacker connected to a corporate Wi-Fi network spawns a rogue DHCP server that replies to DHCP Discover broadcasts faster than the genuine router, assigning the attacker's laptop as the Default Gateway and DNS. What is this attack called and what does it accomplish?
Reveal Solution
Impact: Complete Man-in-the-Middle (MITM). All outbound user web traffic and DNS queries route directly through the attacker's machine for packet interception and credential harvesting.
A company has 300 internal employee laptops but only owns 5 public IP addresses. How is this possible?
Reveal Solution
Core Protocols Matrix
Memorize the port number, transport layer protocol (TCP/UDP), primary purpose, and plaintext vulnerability status for each foundational protocol.
| Protocol | Port | Transport | Purpose | Security State |
|---|---|---|---|---|
| DNS | 53 | UDP (TCP for large zones) | Domain Name to IP address resolution | Plaintext |
| DHCP | 67 / 68 | UDP | Automatic IP addressing & configuration | Plaintext |
| HTTP | 80 | TCP | Unencrypted Hypertext Web Traffic | Plaintext |
| HTTPS | 443 | TCP | TLS/SSL Encrypted Web Traffic | Encrypted |
| SSH | 22 | TCP | Encrypted remote shell administration | Encrypted |
| FTP | 20 / 21 | TCP | File transfer (Control on 21, Data on 20) | Plaintext |
| SMTP | 25, 587 | TCP | Email routing and client submission | STARTTLS Opt |
DNS Resolution Flow (Recursive Query Hierarchy)
1. Client requests "sub.example.com" -> Checks local OS DNS cache & /etc/hosts
2. Queries Recursive Resolver (e.g., 1.1.1.1, 8.8.8.8, or ISP)
3. Resolver queries Root Nameserver (".") -> Root returns .com TLD Server IP
4. Resolver queries .com TLD Nameserver -> TLD returns Authoritative NS for example.com
5. Resolver queries Authoritative NS for example.com -> Receives A Record (93.184.216.34)
6. Resolver caches record with TTL and returns answer to Client
During packet inspection, you notice an employee accessing a payroll site over port 80 and sending a POST request with authentication parameters. What is the vulnerability?
Reveal Solution
Impact: Any passive listener on the local subnet or network hop can read the username and cleartext password directly out of the TCP packet payload using Wireshark or tcpdump. The service must enforce HTTPS on port 443 with HSTS headers.
Match each scenario to a protocol: (a) A sysadmin remotely manages a Linux server, (b) A mail client sends a message to a recipient, (c) A browser resolves "google.com" to an IP.
Reveal Solution
(b) SMTP (Port 25 / 587 TCP) — Mail transfer agent submission.
(c) DNS (Port 53 / UDP) — Domain resolution.
Why does DNS predominantly operate over UDP instead of TCP?
Reveal Solution
Routing, ARP & VLANs
Switches move frames within a local broadcast domain via MAC addresses. Routers forward packets between subnets using IP routing tables. ARP bridges the two.
ARP (Address Resolution Protocol) Mechanism
Host A (192.168.1.10) wants to send frame to Host B (192.168.1.1) 1. ARP Request (Broadcast): "Who has 192.168.1.1? Tell 192.168.1.10 (MAC: AA:AA:AA:AA:AA:AA)" Destination MAC: FF:FF:FF:FF:FF:FF (Every device on the switch receives this) 2. ARP Reply (Unicast): "192.168.1.1 is at BB:BB:BB:BB:BB:BB" Host A saves (192.168.1.1 -> BB:BB:BB:BB:BB:BB) in its local ARP cache table.
ARP is completely stateless and unauthenticated. An attacker can send unsolicited gratuitous ARP replies claiming "192.168.1.1 (Gateway) is at Attacker-MAC". All local endpoints overwrite their ARP tables, routing their traffic directly through the attacker before forwarding it to the genuine router.
Simplified Routing Table Lookup
| Destination Prefix | Next Hop | Interface |
|---|---|---|
| 192.168.1.0/24 | Directly Connected | eth0 |
| 10.0.0.0/8 | 192.168.1.254 | eth0 |
| 0.0.0.0/0 (Default Gateway) | 203.0.113.1 | eth1 (WAN) |
A security analyst is plugged into a switch port on VLAN 10 (Engineering) and needs to scan a database server on VLAN 30 (Production Database) in the same physical datacenter rack. Why can't the Layer-2 switch facilitate this alone?
Reveal Solution
In Wireshark you notice one machine sending a flood of unsolicited ARP replies claiming to be the default gateway to multiple hosts that never asked. What is happening and what is the attacker's likely next move?
Reveal Solution
Next Move: The attacker will sniff plaintext credentials, session tokens, or perform SSL stripping on the hijacked traffic.
Wireshark — Reading Packets Live
Everything in networking is abstract theory until you inspect raw bytes on the wire. Wireshark decodes and visualizes packets layer by layer.
Essential Wireshark Display Filters (1-Click Copy)
Isolate standard DNS queries and response records.
Catch form data submissions and API payloads in plaintext.
Spot port scanning signatures and SYN flood attempts.
Filter ARP requests/replies to detect ARP spoofing.
Search raw payload bytes for unencrypted credentials.
Monitor SSH management sessions and brute force attempts.
You want to isolate every TCP SYN packet (without the ACK flag) going to port 22 across an entire subnet to spot someone port-scanning SSH. Write the Wireshark display filter.
Reveal Solution
tcp.port == 22 && tcp.flags.syn == 1 && tcp.flags.ack == 0
You suspect ARP spoofing on your local network. What single filter narrows the capture down, and what specifically would you look for once filtered?
Reveal Solution
arpIndicators: Look for duplicate IP addresses claimed by different MAC addresses, or an abnormally high volume of unsolicited ARP replies without preceding requests.
7-Day Mastery Checklist
Check these off as you complete your daily drills. Your progress is automatically saved in your browser's local storage.