Post cover image
OSI, TCP/IP, ARP, DNS, DHCP, routing, NAT, TLS, wireless, and everything in between

August 22, 2026

Networking Fundamentals Every Pentester Must Know: The Complete Foundation

Every exploit, every reverse shell, every Nmap scan you’ll ever run rides on top of the same networking concepts. Skip this foundation and…

By Vipin_M

7 min read

Every exploit, every reverse shell, every Nmap scan you'll ever run rides on top of the same networking concepts. Skip this foundation and you're memorizing commands without understanding why they work.

This is the complete version — not just ports and the handshake, but the full stack a working pentester actually touches: address resolution, DHCP, routing, NAT, firewalls, VLANs, TLS, email protocols, and wireless basics. Long post, but it's the one you'll keep coming back to.

Tools referenced: Nmap, tcpdump, curl, dig, arp, traceroute, openssl, airodump-ng — all pre-installed on Kali Linux

None

Why Networking Knowledge Separates Analysts From Script-Runners

Anyone can run nmap -sV target. Understanding what's actually happening on the wire is what lets you troubleshoot a scan returning nothing, explain a finding to a client, or spot something a scanner missed entirely.

  • Every pentest starts with network-layer recon — you can't attack what you can't see
  • Firewalls, IDS, and segmentation all operate at the layers this post covers
  • Reading raw traffic (tcpdump/Wireshark) is a skill scanners can't replace

1. The OSI Model vs TCP/IP — Mapped Side by Side

You'll hear both referenced constantly. Here's how they line up:

OSI Layer          TCP/IP Layer      Examples
7 Application       Application       HTTP, DNS, SSH, FTP
6 Presentation      Application       TLS/SSL encoding
5 Session           Application       Session handling
4 Transport          Transport        TCP, UDP
3 Network             Internet        IP, ICMP, routing
2 Data Link             Link          Ethernet, ARP, switches
1 Physical              Link          Cables, Wi-Fi radio, NICs

Why it matters: "Layer 2 attack" (ARP spoofing), "Layer 3" (routing/IP), "Layer 4" (port-based firewall rules), "Layer 7" (web app firewalls, HTTP-based attacks) — these numbers are shorthand you'll hear in every report and client conversation.

2. IP Addressing & Subnetting

192.168.1.10       A single host address
192.168.1.0/24     A network of 256 addresses (.0 to .255)
10.0.0.0/8         A huge private range (16.7 million addresses)

The /24 is CIDR notation — it tells you how many bits are the "network" portion vs the "host" portion. A /24 fixes the first 24 bits, leaving 8 bits (256 values) for hosts. A /30 leaves only 2 usable hosts — common on point-to-point router links.

nmap -sn 192.168.1.0/24
Nmap scan report for 192.168.1.10
Nmap scan report for 192.168.1.15
Nmap scan report for 192.168.1.22

That single command pinged all 256 possible addresses and told you which hosts are alive — step one of any internal network engagement.

3. ARP: Mapping IP Addresses to Physical Hardware

IP addresses are logical; ARP (Address Resolution Protocol) is what actually finds the physical MAC address behind an IP on your local network segment.

None

Why it matters: ARP has no authentication built in — any host can claim to "be" any IP address on the segment. This is the root cause behind ARP spoofing / man-in-the-middle attacks on local networks, and why network segmentation and switch security (like Dynamic ARP Inspection) matter.

4. ICMP: Ping, Traceroute, and Diagnostics

None

ICMP isn't just "ping" — it's how routers report errors (destination unreachable, TTL exceeded) back to a sender. Traceroute actually abuses this: it sends packets with increasing TTL values and reads the "TTL exceeded" ICMP replies to map every hop along the path.

5. Ports: The Front Doors of a Host

0-1023        Well-known ports (SSH, HTTP, FTP, etc.)
1024-49151    Registered ports (app-specific services)
49152-65535   Ephemeral ports (temporary, client-side connections)
None

Why it matters: every open port is a potential entry point. Full port scans (-p-) matter because services often run on non-default ports specifically to dodge quick scans.

6. TCP vs UDP — Reliable vs Fast

TCP   Connection-based, guarantees delivery, used by HTTP, SSH, FTP
UDP   Connectionless, no delivery guarantee, used by DNS, DHCP, streaming

nmap -sU (UDP scans) are dramatically slower and less reliable than TCP scans, because there's no handshake to confirm a port is open — the scanner has to infer it from silence or ICMP responses.

7. The Three-Way Handshake

None

SYN → SYN-ACK → ACK. Nmap's default SYN scan (-sS) exploits this directly — it sends the SYN, reads the SYN-ACK to confirm the port is open, then never completes the handshake. That's the "stealth scan."

8. DHCP: How Hosts Actually Get an IP Address

None

The DHCP process is four steps, easy to remember as DORA: Discover, Offer, Request, Acknowledge. A rogue DHCP server on a network — handing out a malicious gateway or DNS server — is a classic internal-network attack vector.

9. Routing & the Default Gateway

None

When a host wants to reach an IP outside its own subnet, it sends the traffic to its default gateway — usually the router. Every routing table is just a set of rules for "which direction does this traffic go."

10. NAT: How Private Networks Reach the Internet

Private ranges (never routable on the public internet):
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16

NAT (Network Address Translation) is what lets an entire private network share one public IP address — your router rewrites the source address of outgoing packets and tracks the mapping so replies come back to the right internal host.

Why it matters: NAT is also why a host behind a home router isn't directly reachable from the internet by default — it's an incidental security boundary, not a real firewall, but it changes how you approach external vs internal engagements.

11. Firewalls & Filtering

iptables -L -n -v          # list current firewall rules (Linux)
ufw status verbose          # simpler front-end on Ubuntu/Debian

Firewalls filter at different layers: simple ones filter by IP/port (Layer 3/4), while next-gen firewalls and WAFs inspect actual HTTP content (Layer 7). Knowing which type you're up against changes your entire approach — a Layer 4 firewall won't stop a payload that looks like normal HTTP traffic.

12. VLANs & Network Segmentation

A VLAN (Virtual LAN) logically separates one physical switch into multiple isolated broadcast domains — devices on VLAN 10 can't see VLAN 20 traffic even though they share the same physical switch.

Why it matters: segmentation is one of the biggest defenses against lateral movement. A big part of internal pentesting is figuring out whether "VLAN hopping" (via double-tagging or misconfigured trunk ports) can get you from a guest network into a corporate one.

13. HTTP, HTTPS & TLS

curl -I https://target.com
None

Response headers alone can leak web server software, backend language, and framework versions — without sending a single "attack" payload.

None

openssl s_client lets you inspect a target's TLS certificate directly — issuer, expiry, and supported protocol version. Old TLS versions (1.0/1.1) or self-signed/expired certs are common, easy findings.

14. DNS: The Internet's Phone Book

None

Why it matters: DNS enumeration (subdomains, MX records, zone transfers) is one of the earliest passive recon steps. A misconfigured DNS server allowing zone transfers (AXFR) can leak a target's entire internal network map in one request.

15. Email Protocols: SMTP, POP3, IMAP

SMTP (25/587)   Sending mail — often reveals internal hostnames via banners
POP3 (110)      Retrieving mail — downloads and typically removes it
IMAP (143)      Retrieving mail — keeps it synced on the server

SMTP servers are commonly tested for open relay misconfigurations (allowing anyone to send mail through them) and for username enumeration via the VRFY/EXPN commands.

16. Wireless Networking Basics

None

Wireless adapters in "monitor mode" can passively see all nearby Wi-Fi traffic rather than just what's addressed to them — that's what tools like airodump-ng use to list nearby access points and connected clients. WPA2's 4-way handshake is the core of wireless auditing: capturing it (passively, on your own network) lets you test password strength offline.

17. VPNs & Tunneling

A VPN wraps traffic in an encrypted tunnel between two points — commonly used to reach internal-only assets during an authorized remote engagement. SSH tunneling (ssh -L / -D) does something similar on a smaller scale — forwarding traffic through an SSH connection, often used to pivot into a network segment you've gained a foothold in.

18. Common Protocols Reference

SSH (22)       Encrypted remote shell — check for weak auth, old versions
FTP (21)       File transfer — anonymous login is a classic finding
Telnet (23)    Unencrypted remote shell — a quick win if found open
SMTP (25)      Mail sending — open relay / user enumeration checks
DNS (53)       Name resolution — zone transfer misconfig checks
DHCP (67/68)   IP assignment — rogue server risk
HTTP/S (80/443) Web — headers, TLS config, app-layer testing
SMB (445)      Windows file sharing — huge historical attack surface
RDP (3389)     Windows remote desktop — brute-force and version checks
LDAP (389)     Directory services — anonymous bind checks
Kerberos (88)  Windows auth — ticket-based attacks (AS-REP roasting etc.)
SNMP (161)     Device monitoring — default community strings are common

19. Nmap Scan Types, Explained

None 
-sS   SYN scan (stealthy, default, needs root)
-sT   Connect scan (completes full handshake, more detectable)
-sU   UDP scan (slow, but necessary for UDP-only services)
-sA   ACK scan (used to map firewall rules, not open ports)
-sN / -sF / -sX   Null / FIN / Xmas scans (edge-case firewall evasion)

Each scan type behaves differently against firewalls and IDS — knowing which one to reach for (and why) is the difference between a scan that works and one that returns nothing against a filtered host.

20. Common Network-Layer Attack Concepts (Know These, Don't Fear Them)

You don't need exploitation detail yet — just recognize these terms and what they target:

ARP spoofing     Poisoning ARP tables to intercept local traffic (MITM)
DNS spoofing     Returning fake DNS responses to redirect victims
VLAN hopping     Escaping a restricted VLAN via trunk misconfiguration
Rogue DHCP       Handing out malicious gateway/DNS via fake DHCP server
Evil twin AP     A fake wireless access point mimicking a trusted one

Every one of these exploits a lack of authentication somewhere in a protocol we covered above — that's not a coincidence. Understanding why a protocol trusts what it trusts is what lets you predict where it can be abused.

21. Bringing It Together: A Real Recon Sequence

None

Host discovery → service/version scan → banner grabbing → local port check. Every step maps back to a concept covered in this post.