Networking Basics
Tue, Mar 23, 2021 | #networking #tcp #ip #nmap
Some key learnings from TryHackMe Networking Module.
OSI mnemonics
A Penguin Said That Nobody Drinks Pepsi
People Don’t Need Those Stupid Packets Anyways
Enumeration with nmap
nmap is used for port scanning. It will connect to each port of the target in turn and depending on how the port responds, it can be determined as being open, closed or filtered. Once we know which ports are open, we can then look at enumerating which services are running on each port.
Important switches
TCP Scan
TCP scan perform a full three way handshake.
Succesful TCP Handshake in Wireshark:

If a port is closed the server sends back RST
(reset) instead of SYN/ACK
. If the port is filtered by firewall then the TCP SYN packet is either dropped, or spoofed with a TCP reset. Where TCP scans perform a full three-way handshake with the target, SYN scans sends back a RST
TCP packet after receiving a SYN/ACK
from the server (this prevents the server from repeatedly trying to make the request) => SYN scan = “half open” scan = “stealth” scan
Closed Port in Wireshark:

SYN scan pros:
- bypass older intrusion detection systems as they are looking out for a full three way handshake
- SYN scans are referred to as “stealth” scans because most applications only log fully established connections
- faster than standard tcp scans due to the incomplete connection
SYN scan cons:
- SYN scans require the ability to create raw packets => sudo permissions required
- unstable services are sometimes brought down by SYN scans
ICMP Network scanning
If we want to determine which ip address is assigned to an active host we can scan the network with a ping sweeper.
Ping sweep on 172.16.x.x network (netmask: 255.255.0.0) : nmap -sn 172.16.0.0/16
Firewall evasion
nmap hot tips
If your nmap scan takes a while you can check the scan progress with any key except {vdp?}.
v / V : decreases / increases verbosity level
d / D : decrease / increase debug level
p / P : turn on / off packet tracing
? : print a runtime interaction help screen