PATCH//NOTES Open the interactive version
← All lessons
Foundations · Beginner · 6 min

Networking basics

IP addresses, ports, DNS: the map every attacker and defender uses.

What it is

Every device on a network has an IP address, its street address. Ports are the doors on that address: web traffic uses 443 (HTTPS), remote shells use 22 (SSH), Windows remote desktop uses 3389. DNS is the internet's phone book, turning names like example.com into IPs. TCP sets up a reliable conversation with a three-way handshake (SYN, SYN-ACK, ACK); UDP just fires packets off. Firewalls decide which doors stay open.

See it: How a request leaves your network and comes back

  1. Your PC → Switch: Frame for the router. Your PC knows the site is on another network, so it sends the traffic to its default gateway, the router.
  2. Switch → Router: Forwarded to the right port. The switch delivers the frame only to the port the router is on.
  3. Router → Website: Routed onto the internet. The router swaps your private IP for its public one (NAT) and sends the packet towards the website's IP, found with DNS. Stopped by: A firewall here decides which traffic may pass.
  4. Website → Your PC: Reply comes back. The website answers to the router's public IP, and the router hands it back to your PC.

Step through the animated diagram in the app.

Real case · Ongoing

Exposed RDP

Remote Desktop (port 3389) left open to the internet with weak passwords has for years been one of the most common ways ransomware gangs get in. Sophos found RDP abused in 90% of the attacks its incident responders handled in 2023. Scanners find exposed RDP within minutes of it going online.

Source: Sophos: RDP abused in 90% of attacks (2024)

How defenders stop it

  • Close every port you don't need
  • Put remote access behind a VPN or zero-trust gateway with MFA
  • Segment networks
  • Monitor DNS. Malware has to phone home somehow.

Try it yourself

Open real packet captures in Wireshark

Check yourself

1. Which port does HTTPS use by default?

  1. 22
  2. 53
  3. 443
  4. 3389
Show answer

443. 22 is SSH, 53 is DNS, 3389 is RDP.

2. What does DNS do?

  1. Blocks malware
  2. Encrypts web traffic
  3. Turns names like example.com into IP addresses
  4. Assigns MAC addresses
Show answer

Turns names like example.com into IP addresses. DNS is the internet's phone book: your device asks it for the IP address behind a name.

3. What are the three steps of a TCP handshake?

  1. HELLO, KEY, DONE
  2. DISCOVER, OFFER, ACK
  3. SYN, SYN-ACK, ACK
  4. GET, POST, PUT
Show answer

SYN, SYN-ACK, ACK. TCP opens a reliable conversation with SYN, SYN-ACK, ACK. (Discover, Offer, Request, Acknowledge is DHCP.)

Answer them in the app to earn XP.

Next: Encryption & hashing →