Networking Fundamentals Every Hacker Must Know

Part 3 of the “Hacking from Zero” series

“To hack a network, you must first understand it.”

You can memorise every Nmap flag and still fail your first CTF if you don’t understand why ports exist, how data travels across a network, or what DNS actually does. Networking is the foundation everything else is built on.

This post covers the networking concepts that come up again and again on TryHackMe — and in real-world penetration testing. No fluff, no textbook padding. Just what you need to know as a hacker.

🌐 The OSI Model — The 7 Layers Explained

The OSI (Open Systems Interconnection) model is a framework that describes how data travels from one machine to another. You’ll see it referenced constantly in cybersecurity.

Layer Name What It Does Hacker Relevance 7 Application User-facing protocols (HTTP, FTP, DNS) SQL injection, XSS, web attacks 6 Presentation Encryption, encoding, compression SSL/TLS stripping, encoding attacks 5 Session Manages sessions between devices Session hijacking 4 Transport TCP/UDP — reliable delivery Port scanning, DoS 3 Network IP addressing, routing IP spoofing, MITM 2 Data Link MAC addresses, switches ARP poisoning, MAC spoofing, and 1 Physical Cables, signals, hardware Physical access attacks

Memory trick: “Please Do Not Throw Sausage Pizza Away” (Physical, Data Link, Network, Transport, Session, Presentation, Application)

As a hacker, you’ll mostly work at Layers 3–7. But understanding all 7 helps you know where in the stack an attack is happening.

📦 TCP vs UDP — The Two Transport Protocols

Everything on the internet travels via either TCP or UDP at the Transport layer (Layer 4).

TCP — Transmission Control Protocol

TCP is reliable. It guarantees that data arrives, in order, without errors. It does this via a three-way handshake:

Client  →  SYN        →  Server    (I want to connect)
Client  ←  SYN-ACK    ←  Server    (OK, I'm ready)
Client  →  ACK        →  Server    (Great, let's go)

Why hackers care:

• Nmap’s SYN scan (-sS) exploits this handshake — it sends a SYN but never completes the connection, making it stealthier
• TCP sequence numbers can be predicted in some attacks (session hijacking)
• SYN flood attacks overwhelm servers by sending thousands of SYN packets without completing handshakes

Used by: HTTP, HTTPS, SSH, FTP, SMTP — most services you’ll target

UDP — User Datagram Protocol

UDP is fast but unreliable. It fires packets and doesn’t check if they arrived. No handshake.

Why hackers care:

• UDP services are often overlooked — always scan with -sU
• DNS (port 53) runs on UDP — DNS poisoning attacks live here
• SNMP (port 161) runs on UDP — often misconfigured and leaks system info

Used by: DNS, DHCP, SNMP, VoIP, online gaming

🔢 IP Addresses & Subnetting

IPv4

An IP address is a 32-bit number written as four octets:

192.168.1.100

Each octet is 0–255. There are roughly 4.3 billion possible IPv4 addresses — almost all assigned.

Private IP ranges (not routable on the internet):

Range Common Use 10.0.0.0–10.255.255.255 Large corporate networks 172.16.0.0–172.31.255.255 Medium networks 192.168.0.0–192.168.255.255 Home networks

On TryHackMe, target machines are typically in the 10.10.x.x range.

Subnetting & CIDR Notation

A subnet divides a network into smaller segments. CIDR notation tells you how many bits are used for the network vs host:

192.168.1.0/24   →  256 addresses (192.168.1.0 – 192.168.1.255)
10.0.0.0/8       →  16,777,216 addresses
192.168.1.0/30   →  4 addresses (useful for point-to-point links)

Why hackers care: Knowing the subnet tells you how many hosts to scan. If you’re on 10.10.10.0/24, there are up to 254 live hosts to discover.

Scan a whole subnet with Nmap:

nmap -sn 10.10.10.0/24    # Ping sweep — find live hosts

IPv6

128-bit addresses written in hex:

2001:0db8:85a3:0000:0000:8a2e:0370:7334

IPv6 is increasingly relevant. Many tools and firewalls are configured for IPv4 only — IPv6 is sometimes a blind spot worth probing.

🔄 How the Internet Works: A Packet’s Journey

When you type https://tryhackme.com in your browser, here's what actually happens:

1. DNS lookup — Your computer asks, “What’s the IP address for tryhackme.com?”
2. TCP handshake — Your browser connects to that IP on port 443
3. TLS handshake — Encryption is negotiated
4. HTTP request — Your browser asks for the webpage
5. HTTP response — The server sends the HTML back
6. Rendering — Your browser displays it

Each step is an attack surface. DNS can be poisoned. TLS can be stripped. HTTP can be intercepted. This is why understanding the full journey matters.

🌍 DNS — The Internet’s Phone Book

DNS (Domain Name System) translates human-readable domain names into IP addresses.

tryhackme.com  →  DNS lookup  →  104.22.55.228

DNS Record Types

Record Purpose Hacker Relevance A Domain → IPv4 address Basic lookup AAAA Domain → IPv6 address IPv6 recon MX Mail server for domain Email spoofing recon CNAME Alias for another domain Subdomain takeover TXT Arbitrary text (SPF, DKIM) Recon, email security checks NS Nameservers for domain DNS zone transfers PTR IP → domain (reverse DNS) Reverse lookups

DNS Enumeration (Hacker’s Perspective)

# Basic lookup
nslookup tryhackme.com

# Dig — more powerful
dig tryhackme.com
dig tryhackme.com MX          # Mail servers
dig tryhackme.com TXT         # TXT records
dig tryhackme.com ANY         # All records

# Zone transfer attempt (finds ALL subdomains if misconfigured)
dig axfr @ns1.tryhackme.com tryhackme.com

# Subdomain brute-force (with gobuster)
gobuster dns -d tryhackme.com -w /usr/share/wordlists/subdomains.txt

Zone transfers are a classic misconfiguration — a DNS server that allows zone transfers will dump every single subdomain and IP address for the domain. Always try it.

🔀 ARP — Connecting IPs to MAC Addresses

ARP (Address Resolution Protocol) works at Layer 2. When a device wants to send data to it 192.168.1.5, it broadcasts, "Who has 192.168.1.5?" and the device with that IP replies with its MAC address.

ARP Poisoning / ARP Spoofing: An attacker sends fake ARP replies, claiming their MAC address belongs to the gateway’s IP. All traffic meant for the gateway now flows through the attacker — a classic Man-in-the-Middle (MITM) attack.

# View your ARP table
arp -a

# ARP poisoning with arpspoof (for labs only)
arpspoof -i eth0 -t 192.168.1.5 192.168.1.1

🚪 Common Ports — The Hacker’s Cheat Sheet

Knowing common ports cold will save you time on every CTF:

Port Protocol Service Notes 21 TCP FTP Check anonymous login 22 TCP SSH Brute-force with Hydra 23 TCP Telnet Unencrypted — sniff traffic 25 TCP SMTP Email relay attacks 53 TCP/UDP DNS Zone transfer, poisoning 80 TCP HTTP Full web attack surface 110 TCP POP3 Email retrieval 139/445 TCP SMB EternalBlue, pass-the-hash 443 TCP HTTPS, and HTTPS web attacks 3306 TCP MySQL DB dumping if exposed 3389 TCP RDP Brute-force, BlueKeep 5985 TCP WinRM Windows remote management 8080 TCP HTTP-alt Dev servers, Jenkins

🔐 NAT, DHCP, and Firewalls (Quick Overview)

NAT (Network Address Translation)

Allows many private IP devices to share one public IP. Your home router does this. In pentests, NAT is why you can’t directly reach internal machines from outside — you need to pivot.

DHCP

Automatically assigns IP addresses to devices on a network. On TryHackMe’s VPN, your machine gets an 10.x.x.x address via DHCP.

Firewalls

Filter traffic based on rules (IP, port, protocol). Two types:

• Stateless — checks each packet in isolation
• Stateful — tracks connection state, smarter

Hacker implication: Firewalls block certain ports. When Nmap shows a port as filtered, a firewall is likely dropping your packets. Techniques like firewall evasion (-f for fragmentation, -D for decoys) can help.

🛠️ Essential Networking Commands

# Your IP address
ip a
ifconfig          # older systems

# Routing table
ip route
route -n

# Active connections
ss -tulpn
netstat -tulpn    # older systems

# DNS lookup
nslookup google.com
dig google.com

# Trace the route to a host
traceroute google.com
tracert google.com    # Windows

# Check if host is alive
ping 10.10.10.10

# ARP table
arp -a

# Download a file
wget http://10.10.10.10/file.txt
curl http://10.10.10.10/file.txt

🎯 Practice These on TryHackMe

Room What You’ll Learn Intro to Networking OSI model, TCP/IP in depth How The Web Works DNS, HTTP, cookies, and end-to-end DNS in Detail Every record type, zone transfers HTTP in Detail Requests, responses, methods, status codes Packet Analysis (Wireshark) See real packets flowing Introductory Networking Subnetting, routing, ARP

🧩 Putting It All Together

Here’s how networking knowledge directly translates to attack techniques:

Concept Attack-Enabled DNS records Subdomain enumeration, zone transfer ARP MITM via ARP poisoning TCP handshake SYN flood, session hijacking Open ports Vulnerability targeting Subnets Host discovery, lateral movement SMB (445) EternalBlue, pass-the-hash Firewalls Evasion, port knocking

Every concept in networking has an offensive equivalent. That’s why understanding the fundamentals isn’t just academic — it directly makes you a better attacker (and defender).

🚀 What’s Next

Now that you can scan with Nmap and understand the network you’re scanning, it’s time to put it all together in a real room. In Blog #4, we’ll do a full walkthrough of the RootMe room on TryHackMe — one of the most popular beginner rooms that covers web exploitation and privilege escalation from start to finish.

Upcoming in the “Hacking from Zero” series:

1. ✅ Getting Started with TryHackMe — Learning Path Overview
2. ✅ Nmap Deep Dive: The Hacker’s Swiss Army Knife
3. ✅ (You are here) Networking Fundamentals Every Hacker Must Know
4. 🔜 TryHackMe Walkthrough: RootMe Room
5. 🔜 OSINT: How Hackers Find Information About You

Follow for Blog #4 dropping soon. If this helped, leave a clap 👏 — it genuinely helps more people find it.

Tags: #Networking #CyberSecurity #TryHackMe #EthicalHacking #Pentesting #OSIModel #DNS #TCP #InfoSec

Written as part of the “Hacking from Zero” TryHackMe blog series.