Why This Module Exists
Most learners understand IP addressing, Routing, DNS, and Ports. But real engineers and pentesters understand the "Why":
WHY packets fail.
WHY connections reset.
WHY latency happens.
WHY scans behave differently.
This module breaks down those internal mechanics.
1. DHCP Deep Dive (DORA Process)
Dynamic Host Configuration Protocol automatically assigns IP addresses to devices. It follows a strict 4-step sequence known as DORA.
💀 Security Insight
DHCP is built on implicit trust. This enables Rogue DHCP attacks, where an attacker stands up a fake DHCP server to hand out IPs and sets their own machine as the Default Gateway, instantly achieving a Man-In-The-Middle (MITM) position.
2. ICMP Internals
Internet Control Message Protocol handles network diagnostics and error reporting. It doesn't transport application data; it talks about the health of the network itself.
| Type | Purpose | Meaning |
|---|---|---|
| Echo Request (8) | Ping | "Are you alive?" |
| Echo Reply (0) | Ping Response | "Yes, I am alive." |
| Destination Unreachable (3) | Routing Failure | The router has no path to the target. |
| Time Exceeded (11) | TTL Expired | Packet died in transit (used by Traceroute). |
When you type ping google.com, you are actually sending an ICMP Echo Request.
Pentesting Importance
ICMP is the foundation of Reconnaissance. It is used for Host Discovery, Network Mapping, and Firewall Testing (seeing if a router drops ICMP but allows TCP).
3. MTU (Maximum Transmission Unit)
MTU defines the maximum packet size allowed on a network. For typical Ethernet, this is exactly 1500 bytes.
What happens if a packet is too large?
Packet Fragmentation occurs. The router takes the massive packet and chops it into smaller pieces to fit through the network.
1500 Bytes
500 Bytes
Problems Caused: Heavy fragmentation leads to slow connections, VPN tunnel failures (due to encryption overhead), and packet loss.
ping -M do -s 1472 target.com
# (-M do = Do not fragment. -s = payload size. If it fails, MTU is too low.)
4. TCP Flags Deep Dive
TCP is connection-oriented. It controls the "state" of a connection by setting specific bits (Flags) in the packet header to 1 or 0.
| Flag | Full Name | Meaning |
|---|---|---|
| SYN | Synchronize | Start connection / Sync sequence numbers. |
| ACK | Acknowledge | Acknowledge received data. |
| FIN | Finish | Graceful close. "I have no more data to send." |
| RST | Reset | Force terminate. Drop the connection immediately. |
| PSH | Push | Push data immediately to the application (bypassing buffers). |
| URG | Urgent | Marks priority data. (Rare today, but historically important). |
The PSH Flag in Action
Normally, TCP buffers data to send it efficiently in chunks. The PSH flag forces immediate delivery. It is heavily used in interactive sessions like SSH or live chat, where every keystroke needs to appear instantly.
Security Relevance: Port Scanning
Nmap relies entirely on manipulating TCP flags to see how firewalls and servers react.
SYN Scan: Sends a SYN. If it gets a SYN-ACK, the port is open. It never completes the handshake (stealthy).
Xmas Scan: Sends FIN, PSH, and URG simultaneously. How the server drops the weird packet reveals its OS.
5. TCP Connection States
As flags are exchanged, the socket on the computer changes states. Understanding these is critical for diagnosing hanging servers.
Why is this important?
In a SYN Flood Attack, an attacker sends millions of SYN packets but never replies with an ACK. The server creates millions of sockets stuck in the SYN_RCVD state until memory is exhausted and it crashes.
6. Load Balancing
Modern services (like Google or Netflix) never route you to a single server. A Load Balancer sits in front to distribute traffic.
Distribution Algorithms
- Round Robin: Requests distributed equally in order (1, 2, 3, 1, 2, 3).
- Least Connections: Traffic is sent to the server currently handling the fewest active users.
- IP Hash: The client's IP is hashed. The same client will always be sent to the same server (fixes session log-out issues).
Security Benefit: Prevents overload, improves availability, and absorbs DDoS attacks before they reach backend servers.
7. Real Network Behavior (Putting it Together)
When you browse a website, this is the true mechanical lifecycle:
8. Interview & Pentester Insights
You can now confidently explain:
- ✅ Why Ping fails but a website works: The firewall drops ICMP Echo Requests but allows TCP Port 443.
- ✅ Why a VPN disconnects randomly: Likely an MTU mismatch causing fragmented encrypted packets to be dropped.
- ✅ Why SYN scans are stealthy: They tear down the connection (RST) before it reaches ESTABLISHED, so the application log never records a full connection.
- ✅ Why servers enter TIME_WAIT: To ensure delayed "ghost" packets from a closed session don't accidentally corrupt a brand new connection using the same ports.
🧠 Knowledge Check
You now understand networks at the packet level. You comprehend protocol behavior, connection states, and infrastructure scaling logic.
- ✔ Protocol Behavior
- ✔ Packet Lifecycle
- ✔ Connection States
- ✔ Network Performance Logic