Post cover image
The official room banner for Networking Essentials. Image Credit: TryHackMe.

July 23, 2026

Networking Essentials: DHCP, ARP, ICMP, Routing, and NAT

Introduction

By Jonathan Sanfer

10 min read

Introduction

Welcome to my walkthrough for the TryHackMe room Networking Essentials!

Following our exploration of core network structures in Networking Concepts, this room shifts focus toward the essential glue protocols that enable dynamic node configuration, local layer resolution, network diagnostics, packet routing, and address translation across modern IP networks.

If you missed the previous entry in this series, you can catch up on my walkthrough for Networking Concepts below.

A wide banner featuring a stylized green Earth overlaid with binary streams, connected network lines, and security icons against a dark blue gradient background.

What we will cover

  • Dynamic Host Configuration (DHCP): Automatic IP assignment via the four-step DORA process.
  • Address Resolution Protocol (ARP): Translating Layer 3 logical IP addresses into Layer 2 hardware MAC addresses.
  • Internet Control Message Protocol (ICMP): Diagnostic utilities including ping and traceroute.
  • Routing Protocols: Mechanics and routing algorithms behind OSPF, EIGRP, BGP, and RIP.
  • Network Address Translation (NAT): Conserving global IPv4 address space across local networks.

Room Information

Before we dive into the tasks, here is a quick overview of the room details.

  • Room Name: Networking Essentials
  • Path: Cyber Security 101
  • Module: Networking
  • Topic: Fundamental Network Protocols (DHCP, ARP, ICMP, Routing, NAT)
  • Difficulty: Easy
  • Room Link: TryHackMe — Networking Essentials

Task 1: Introduction

When connecting a smartphone or laptop to a foreign network, such as a coffee shop hotspot, the operating system instantly configures its IP address, default gateway, and DNS servers without requiring manual entry. Similarly, when dispatching requests across global web endpoints, packets traverse multiple intermediary hardware routers and geographic boundaries seamlessly.

This room explores the secondary foundational phase of the Cyber Security 101 Networking module. Building upon the OSI and TCP/IP stack models established in Networking Concepts, we examine the core operational protocols that bind local and global networks together.

Task 2: DHCP: Give Me My Network Settings

Whenever a device connects to a network, it requires specific parameters to communicate with local endpoints and external internet resources: an IP address with a subnet mask, a default gateway router address, and a DNS server address. While stationary servers use manually assigned static IP addresses to remain at predictable locations, mobile devices rely on automated network configuration to prevent manual configuration overhead and avoid IP address conflicts.

Automated network configuration is driven by the Dynamic Host Configuration Protocol (DHCP). Operating at the Application layer over UDP, DHCP relies on port 67 for the server and port 68 for the client.

A diagram displaying the letters D-O-R-A corresponding to Discover, Offer, Request, and Acknowledge.

The DORA Process

DHCP coordinates automated network configuration using a four-step interaction known by the acronym DORA:

A sequence diagram showing a laptop client sending DHCPDISCOVER, receiving DHCPOFFER from a server, responding with DHCPREQUEST, and receiving DHCPACK.

The process begins with DHCP Discover, where an unconfigured client broadcasts a DHCPDISCOVER packet across the local network segment seeking an active DHCP server. Upon receiving this discovery broadcast, the server responds with DHCP Offer, issuing a DHCPOFFER packet that presents an available IP address along with the subnet mask, default gateway, and DNS configuration.

The client evaluates the offer and responds with DHCP Request, sending a DHCPREQUEST message to formally accept the offered configuration parameters. Finally, the server issues a DHCP Acknowledge message (DHCPACK) confirming that the offered IP address is officially leased and assigned to the client.

Inspecting DHCP Traffic

To analyze DHCP packet exchanges without cluttering terminal sessions with lengthy capture data, network analysts can inspect pre-recorded packet capture files using command-line utilities like tshark:

user@TryHackMe$ tshark -r DHCP-G5000.pcap -n

Executing this command parses the capture file and highlights the transaction sequence. During the initial DHCPDISCOVER and DHCPREQUEST packets, the client does not yet possess an IP address, so it dispatches packets from the source IP 0.0.0.0 to the network-wide broadcast destination IP 255.255.255.255. Once the final DHCPACK frame is processed, the endpoint successfully completes interface setup with its newly leased IP address, default gateway route, and primary DNS resolvers.

Questions and Answers

How many steps does DHCP use to provide network configuration?

Answer:

4

What is the destination IP address that a client uses when it sends a DHCP Discover packet?

Answer:

255.255.255.255

What is the source IP address a client uses when trying to get IP network configuration over DHCP?

Answer:

0.0.0.0

Task 3: ARP: Bridging Layer 3 Addressing to Layer 2 Addressing

While applications and operating systems handle network communications using Layer 3 IP addresses, physical link hardware relies on Layer 2 MAC addresses to deliver data across local Ethernet or WiFi segments. A MAC address is a 48-bit unique hardware identifier typically formatted in hexadecimal, such as 44:DF:65:D8:FE:6C.

To transmit an IP packet across a local network link, the sending device must encapsulate the IP packet inside a Data Link layer frame addressed to the target host's physical MAC address. The Address Resolution Protocol (ARP) serves as the translation mechanism that dynamically maps Layer 3 network IP addresses to Layer 2 hardware MAC addresses.

How ARP Resolves Network Addresses

Devices on the same local segment do not maintain permanent awareness of every peer's hardware address. Instead, when a host with IP address 192.168.66.89 needs to communicate with 192.168.66.1, it first checks its local ARP cache table. If no entry exists, the host sends an ARP Request frame directed to the Ethernet broadcast MAC address ff:ff:ff:ff:ff:ff, asking the host assigned 192.168.66.1 to announce its physical address.

Every device on the local network segment receives this broadcast frame, but only the host configured with 192.168.66.1 responds. It returns an ARP Reply packet containing its hardware MAC address (44:df:65:d8:fe:6c) directly back to the requester.

A Wireshark window displaying packet details for an ARP reply, highlighting sender MAC address 44:df:65:d8:fe:6c associated with sender IP address 192.168.66.1.

Inspecting ARP Traffic via the Command Line

Because ARP functions directly above the Link layer to support IP operations, ARP requests and replies are encapsulated directly inside Ethernet frames rather than IP or UDP datagrams. We can inspect captured ARP exchanges using tshark:

user@TryHackMe$ tshark -r arp.pcapng -Nn

Running this command parses the packet capture file, detailing the initial broadcast query to ff:ff:ff:ff:ff:ff followed immediately by the unicast reply from host 192.168.66.1 revealing its physical MAC address 44:df:65:d8:fe:6c.

Questions and Answers

What is the destination MAC address used in an ARP Request?

Answer:

ff:ff:ff:ff:ff:ff

In the example above, what is the MAC address of 192.168.66.1?

Answer:

44:df:65:d8:fe:6c

Task 4: ICMP: Troubleshooting Networks

The Internet Control Message Protocol (ICMP) is an auxiliary network-layer protocol leveraged by diagnostic tools and network devices to report operational errors, relay status feedback, and measure latency. Unlike transport layer protocols such as TCP or UDP, ICMP does not transport application payload data or utilize port numbers; instead, it operates directly above the Internet Protocol.

Testing Reachability with Ping

The ping utility evaluates host reachability and round-trip network latency across IP networks. When initiated, ping sends an ICMP Echo Request (Type 8) packet to the target address. If the destination host is reachable and permitted by local host firewalls, it returns an ICMP Echo Reply (Type 0) packet back to the sender.

A Wireshark window detailing an ICMP Echo request frame highlighting Type 8 (Echo request) and showing a 40-byte data payload.

To run a connectivity test against a target address while limiting the probe count to four packets, network administrators execute the ping utility with specific flags from the command line:

user@TryHackMe$ ping 192.168.11.1 -c 4

Executing this command transmits four ICMP probe requests and prints summary statistics including total packet loss along with minimum, average, maximum, and standard deviation round-trip transit times.

Path Discovery with Traceroute

To discover the intermediate network hops across complex routing paths, Unix-like operating systems utilize traceroute (and Windows systems use tracert). This utility operates by manipulating the Time-to-Live (TTL) field embedded inside outgoing IP packet headers.

Every router along a transit path decrements an IP packet's TTL value by 1 before forwarding it. If a packet's TTL reaches 0 before reaching its final destination, the router drops the packet and returns an ICMP Time Exceeded (Type 11) message back to the originating IP address. By sending sequential packets starting with a TTL of 1 and incrementally increasing the TTL for each subsequent transmission, traceroute forces each successive router hop along the path to reveal its identity through ICMP responses.

user@TryHackMe$ traceroute example.com

Running this command traces the hop-by-hop path toward the target host. Asterisks (* * *) appearing along the output route denote individual hops where filtering devices or firewalls intentionally drop ICMP responses.

Questions and Answers

Using the example images above, how many bytes were sent in the echo (ping) request?

Answer:

40

Which IP header field does the traceroute command require to become zero?

Answer:

TTL

Task 5: Routing

Routing is the core process by which Layer 3 network devices (routers) inspect destination IP addresses in incoming packets and evaluate their internal routing tables to choose the optimal next-hop link across interconnected networks. Without routing, packets would remain strictly contained within their local network boundaries.

Understanding Dynamic Routing Protocols

To maintain up-to-date topology maps without requiring manual static route definitions from system administrators, routers utilize dynamic routing protocols. These protocols enable routers to discover network paths automatically, broadcast state changes, and re-route traffic seamlessly around link failures.

Interior gateway protocols manage routing within a single administrative domain or organization. Among these, Open Shortest Path First (OSPF) is a widely implemented link-state protocol that exchanges Link-State Advertisements (LSAs) to build a complete topological map of the network, calculating optimal paths via Dijkstra's algorithm. Another key interior protocol is the Enhanced Interior Gateway Routing Protocol (EIGRP), an advanced distance-vector protocol proprietary to Cisco that calculates path metrics based on bandwidth, delay, load, and link reliability. For smaller or legacy systems, the Routing Information Protocol (RIP) provides basic distance-vector routing using hop count as its sole metric, capped at a maximum distance of 15 hops.

For inter-domain routing across global infrastructure, networks rely on exterior gateway protocols. The Border Gateway Protocol (BGP) serves as the primary path-vector protocol powering the global Internet, coordinating routing decisions and traffic exchange policies between distinct Autonomous Systems (AS).

Questions and Answers

Which routing protocol discussed in this task is a Cisco proprietary protocol?

Answer:

EIGRP

Task 6: NAT

The rapid global expansion of internet-connected devices highlighted the limitations of IPv4's 32-bit address space, which provides roughly 4.3 billion total addresses. Network Address Translation (NAT) directly solves address exhaustion by allowing entire private local networks (RFC 1918) to share a single public IP address when communicating with external internet resources.

A network diagram depicting local devices including a camera, desktop, laptop, and phone connected to a router with private IP addresses, mapping to public IP 212.3.4.5 via a translation table.

How NAT Translation Functions

A NAT-enabled gateway router sits at the border between an internal private network and the public Internet. When an internal endpoint, such as the smartphone with IP address 192.168.0.137, sends outbound traffic to a remote web server, the packet passes through the gateway router. The router modifies the packet's IP header by replacing the internal private source IP with its own public IP address (212.3.4.5) and assigns a unique temporary source port number (such as 32759).

The router logs this mapping in its active state translation table. When the destination web server returns response packets to 212.3.4.5:32759, the router references its internal translation table, rewrites the destination back to 192.168.0.137:27912, and forwards the frame to the smartphone on the private network.

By tracking individual connections using 16-bit TCP and UDP port allocations, a single public IPv4 address can theoretically multiplex up to 65,535 simultaneous outbound connections across local network hosts.

Questions and Answers

In the network diagram above, what is the public IP that the phone will appear to use when accessing the Internet?

Answer:

212.3.4.5

Assuming that the router has infinite processing power, approximately speaking, how many thousand simultaneous TCP connections can it maintain?

Answer:

65

Task 7: Closing Notes

This final task consolidates the operational protocols explored throughout the room. Gaining a practical understanding of how core mechanisms like DHCP, ARP, ICMP, Routing, and NAT collaborate provides the necessary foundation for analyzing complex application traffic and conducting thorough network-level security assessments.

A side-by-side composite showing four interactive web simulation screens answering questions about DHCP, ICMP, ARP, and ICMP protocols.

Guided Walkthrough

To complete the practical exercise, click the View Site button at the top of the task to launch the interactive browser terminal. The simulation presents scenario-based questions designed to test protocol selection across routine networking tasks. Please note that the specific questions presented in your session may vary slightly or appear in a different order, but they will all center around the core protocols covered in this room.

Evaluating the network requirements reveals which protocol applies to each scenario:

  • When a host needs an IP address to join and communicate on the network, it relies on DHCP.
  • To verify packet exchange and test connectivity in a ping-pong fashion, the host uses ICMP.
  • To discover another host's physical MAC address using its IP, the host sends an ARP request.
  • When tracing the hop-by-hop path packets take across intermediate routers to reach a destination, the system utilizes ICMP via traceroute.
A popup box with a congratulations message and a green box displaying the retrieved completion flag.

Answering all scenario questions correctly completes the simulation and reveals the task completion flag.

Questions and Answers

Click on the View Site button to access the related site. Please follow the instructions on the site to obtain the flag.

Answer:

THM{computer_is_happy}

Summary & Key Takeaways

Congratulations on completing Networking Essentials you've now mastered the core protocols, from dynamic IP configuration and hardware address resolution to network diagnostics, routing, and address translation, that keep the modern Internet connected and running smoothly!

Key lessons:

  • Dynamic Network Initialization (DHCP): Automatically dispenses IP addresses, subnet masks, default gateways, and DNS configuration through the four-step DORA sequence (Discover -> Offer -> Request -> ACK) over UDP ports 67/68.
  • Hardware Address Resolution (ARP): Bridges Layer 3 logical IP addressing to Layer 2 physical MAC addresses via broadcast ARP Requests (ff:ff:ff:ff:ff:ff) and targeted unicast ARP Replies.
  • Diagnostic Control (ICMP): Facilitates network diagnostics using ping (ICMP Echo Request Type 8 / Echo Reply Type 0) and traceroute (manipulating IP packet TTL values to trigger ICMP Time Exceeded Type 11 messages).
  • Core Routing Mechanics: Routers evaluate optimal paths using dynamic protocols like OSPF, EIGRP (Cisco-proprietary), RIP, and BGP (the core protocol governing Internet Autonomous Systems).
  • Address Space Conservation (NAT): Maps private RFC 1918 networks to single public IP addresses by maintaining port translation tables for multiplexed connections.
A stylized blue and green wireframe Earth globe icon representing completed networking certification modules.