Part 3 of the "Hacking from Zero" series

Networking Fundamentals Every Hacker Must Know

Published June 7, 2026 · By 0xiMAK

"To hack a network, you must first understand it."

Understanding networks is foundational — you can memorize tools but lack effectiveness without grasping why ports exist, how data moves, or what DNS does. This guide covers networking concepts repeatedly encountered in TryHackMe and real penetration testing work.

🌐 The OSI Model — The 7 Layers Explained

The OSI framework describes how data travels between machines. You'll encounter this constantly in cybersecurity contexts.

Memory trick: "Please Do Not Throw Sausage Pizza Away" (Physical, Data Link, Network, Transport, Session, Presentation, Application)

As a hacker, you'll primarily work at Layers 3–7. Understanding all 7 helps you know where in the stack an attack occurs.

📦 TCP vs UDP — The Two Transport Protocols

Everything on the internet travels via either TCP or UDP at the Transport layer (Layer 4).

TCP — Transmission Control Protocol

TCP is reliable. It guarantees that data arrives, in order, without errors. It does this via a three-way handshake:

Client  →  SYN        →  Server    (I want to connect)
Client  ←  SYN-ACK    ←  Server    (OK, I'm ready)
Client  →  ACK        →  Server    (Great, let's go)

Why hackers care:

• Nmap's SYN scan (-sS) exploits this handshake — it sends a SYN but never completes the connection, making it stealthier
• TCP sequence numbers can be predicted in some attacks (session hijacking)
• SYN flood attacks overwhelm servers by sending thousands of SYN packets without completing handshakes

Used by: HTTP, HTTPS, SSH, FTP, SMTP — most services you'll target

UDP — User Datagram Protocol

UDP is fast but unreliable. It fires packets and doesn't check if they arrived. No handshake.

Why hackers care:

• UDP services are often overlooked — always scan with -sU
• DNS (port 53) runs on UDP — DNS poisoning attacks live here
• SNMP (port 161) runs on UDP — often misconfigured and leaks system info

Used by: DNS, DHCP, SNMP, VoIP, online gaming

🔢 IP Addresses & Subnetting

IPv4

An IP address is a 32-bit number written as four octets:

192.168.1.100

Each octet is 0–255. There are roughly 4.3 billion possible IPv4 addresses — almost all assigned.

Private IP ranges (not routable on the internet):

On TryHackMe, target machines are typically in the 10.10.x.x range.

Subnetting & CIDR Notation

A subnet divides a network into smaller segments. CIDR notation tells you how many bits are used for the network vs host:

192.168.1.0/24   →  256 addresses (192.168.1.0 – 192.168.1.255)
10.0.0.0/8       →  16,777,216 addresses
192.168.1.0/30   →  4 addresses (useful for point-to-point links)

Why hackers care: Knowing the subnet tells you how many hosts to scan. If you're on 10.10.10.0/24, there are up to 254 live hosts to discover.

Scan a whole subnet with Nmap:

nmap -sn 10.10.10.0/24    # Ping sweep — find live hosts

IPv6

128-bit addresses written in hex:

2001:0db8:85a3:0000:0000:8a2e:0370:7334

IPv6 is increasingly relevant. Many tools and firewalls are configured for IPv4 only — IPv6 is sometimes a blind spot worth probing.

🔄 How the Internet Works: A Packet's Journey

When you type https://tryhackme.com in your browser, here's what actually happens:

1. DNS lookup — Your computer asks, "What's the IP address for tryhackme.com?"
2. TCP handshake — Your browser connects to that IP on port 443
3. TLS handshake — Encryption is negotiated
4. HTTP request — Your browser asks for the webpage
5. HTTP response — The server sends the HTML back
6. Rendering — Your browser displays it

Each step is an attack surface. DNS can be poisoned. TLS can be stripped. HTTP can be intercepted. This is why understanding the full journey matters.

🌍 DNS — The Internet's Phone Book

DNS (Domain Name System) translates human-readable domain names into IP addresses.

tryhackme.com  →  DNS lookup  →  104.22.55.228

DNS Record Types

DNS Enumeration (Hacker's Perspective)

# Basic lookup
nslookup tryhackme.com

# Dig — more powerful
dig tryhackme.com
dig tryhackme.com MX          # Mail servers
dig tryhackme.com TXT         # TXT records
dig tryhackme.com ANY         # All records

# Zone transfer attempt (finds ALL subdomains if misconfigured)
dig axfr @ns1.tryhackme.com tryhackme.com

# Subdomain brute-force (with gobuster)
gobuster dns -d tryhackme.com -w /usr/share/wordlists/subdomains.txt

Zone transfers are a classic misconfiguration — a DNS server that allows zone transfers will dump every single subdomain and IP address for the domain. Always try it.

🔀 ARP — Connecting IPs to MAC Addresses

ARP (Address Resolution Protocol) works at Layer 2. When a device wants to send data to 192.168.1.5, it broadcasts, "Who has 192.168.1.5?" and the device with that IP replies with its MAC address.

ARP Poisoning / ARP Spoofing: An attacker sends fake ARP replies, claiming their MAC address belongs to the gateway's IP. All traffic meant for the gateway now flows through the attacker — a classic Man-in-the-Middle (MITM) attack.

# View your ARP table
arp -a

# ARP poisoning with arpspoof (for labs only)
arpspoof -i eth0 -t 192.168.1.5 192.168.1.1

🚪 Common Ports — The Hacker's Cheat Sheet

Knowing common ports cold will save you time on every CTF:

🔐 NAT, DHCP, and Firewalls (Quick Overview)

NAT (Network Address Translation)

Allows many private IP devices to share one public IP. Your home router does this. In pentests, NAT is why you can't directly reach internal machines from outside — you need to pivot.

DHCP

Automatically assigns IP addresses to devices on a network. On TryHackMe's VPN, your machine gets a 10.x.x.x address via DHCP.

Firewalls

Filter traffic based on rules (IP, port, protocol). Two types:

• Stateless — checks each packet in isolation
• Stateful — tracks connection state, smarter

Hacker implication: Firewalls block certain ports. When Nmap shows a port as filtered, a firewall is likely dropping your packets. Techniques like firewall evasion (-f for fragmentation, -D for decoys) can help.

🛠️ Essential Networking Commands

# Your IP address
ip a
ifconfig          # older systems

# Routing table
ip route
route -n

# Active connections
ss -tulpn
netstat -tulpn    # older systems

# DNS lookup
nslookup google.com
dig google.com

# Trace the route to a host
traceroute google.com
tracert google.com    # Windows

# Check if host is alive
ping 10.10.10.10

# ARP table
arp -a

# Download a file
wget http://10.10.10.10/file.txt
curl http://10.10.10.10/file.txt

🎯 Practice These on TryHackMe

🧩 Putting It All Together

Here's how networking knowledge directly translates to attack techniques:

Every concept in networking has an offensive equivalent. That's why understanding the fundamentals isn't just academic — it directly makes you a better attacker (and defender).

🚀 What's Next

Now that you can scan with Nmap and understand the network you're scanning, it's time to put it all together in a real room. Next, a full walkthrough of the RootMe room on TryHackMe — one of the most popular beginner rooms that covers web exploitation and privilege escalation from start to finish.

Tags: #Networking #CyberSecurity #TryHackMe #EthicalHacking #Pentesting #OSIModel #DNS #TCP #InfoSec

← Back to Blog