Mastering the OSCP Certification
Networking Basics
Models of Communication
To understand how networks function, it helps to use a model. Models are like blueprints; they don't build the house, but they show how all the pieces should fit together. In networking, two models are essential: the theoretical OSI model and the practical TCP/IP model.
The Open Systems Interconnection (OSI) model is a conceptual framework that standardises the functions of a telecommunication or computing system into seven abstract layers. Think of it as the textbook version of how networks should work.
| Layer | Name | Purpose |
|---|---|---|
| 7 | Application | The layer you interact with (e.g., your browser) |
| 6 | Presentation | Formats and encrypts data |
| 5 | Session | Manages connections between applications |
| 4 | Transport | Ensures data is sent and received correctly |
| 3 | Network | Handles addressing and routing (IP addresses) |
| 2 | Data Link | Moves data between physical devices (MAC addresses) |
| 1 | Physical | The actual hardware (cables, Wi-Fi signals) |
While the OSI model provides a detailed, seven-layer guide, the real world often uses a simpler framework: the TCP/IP model. This is the model the internet is actually built on. It collapses some of the OSI layers into four broader categories.
For a penetration tester, knowing these layers is vital. If you find a vulnerability, understanding which layer it exists on helps you understand how to exploit it. For example, a weakness in a web application is a Layer 7 problem, while intercepting traffic on a poorly secured Wi-Fi network is a Layer 1 or 2 issue.
Addressing and Subnetting
Every device on a network needs a unique address, just like every house on a street needs a number. In TCP/IP networks, this is the Internet Protocol (IP) address. The most common format, IPv4, looks like this: 192.168.1.10. It's made of four numbers, each ranging from 0 to 255.
An IP address has two parts: the network ID, which identifies the network the device is on, and the host ID, which identifies the specific device on that network.
But how does a device know which part of the address is for the network and which is for the host? That's the job of the subnet mask. A subnet mask 'masks' the network portion of an IP address, leaving the host portion visible. For example, a common subnet mask is 255.255.255.0. In binary, this looks like a string of ones followed by a string of zeros.
IP Address: 11000000.10101000.00000001.00001010 (192.168.1.10)
Subnet Mask: 11111111.11111111.11111111.00000000 (255.255.255.0)
Network ID: 11000000.10101000.00000001.00000000 (192.168.1.0)
Host ID: 00000000.00000000.00000000.00001010 (10)
Subnetting is the process of taking one large network and breaking it into smaller, more manageable sub-networks, or 'subnets'. This improves security and organisation. As a penetration tester, you'll often need to map out a target's network, and understanding their subnetting scheme is a key first step.
Core Protocols
Protocols are the rules of communication. Just like humans have rules for language and conversation, computers have protocols for sending data. Three of the most fundamental protocols operate at the Transport and Network layers.
TCP
noun
Transmission Control Protocol. A connection-oriented protocol that ensures reliable delivery of data. It establishes a connection before sending information and checks that all data arrived in the correct order.
TCP is all about reliability. Before it sends any data, it performs a 'three-way handshake' to establish a stable connection. This is a back-and-forth conversation to make sure both sides are ready to communicate.
The opposite of TCP is UDP.
UDP
noun
User Datagram Protocol. A connectionless protocol that sends data without establishing a connection first. It's fast but doesn't guarantee delivery or order.
Think of TCP as sending a registered letter you need a signature for, and UDP as dropping a postcard in the mail. Both have their uses. As a pen tester, you'll interact with services running over both protocols.
Finally, there's ICMP.
ICMP
noun
Internet Control Message Protocol. It's not used to exchange data between systems, but rather for sending error messages and operational information, like whether a requested service is available or if a host could not be reached.
Penetration testers use ICMP constantly for network reconnaissance to discover live hosts on a network.
Hardware and Layout
Data travels through a network using specialised hardware. You'll encounter a few key devices.
| Device | Function |
|---|---|
| Switch | Connects devices on the same local network (LAN). |
| Router | Connects different networks together and directs traffic between them. |
| Firewall | A security device that monitors and filters network traffic. |
The way these devices are connected is called the network topology. This is the logical layout of the network. A few common designs are the star, bus, and ring topologies.
Understanding a network's topology helps you predict how data flows and where you might find weaknesses to exploit. The star topology is the most common in modern networks.
Which networking model is considered the practical framework that the modern internet is built upon, typically consisting of four layers?
What is the primary function of a subnet mask in an IPv4 network?
These are the building blocks of any network. Mastering them is the first step towards being able to analyse, defend, and test any network environment you encounter.