Networking Fundamentals Refresher

Relax. We'll talk through this in plain words — no textbook voice.

What you'll walk away with

Understand the Networking Fundamentals Refresher without the intimidation factor
Get hands-on running tools yourself in an authorized lab environment
Be ready to apply this concept directly in a real assessment/report

Let's think about this for a moment

An IP address is a device's network address — a port is the number that distinguishes one service from another on that device (for example, port 80 = HTTP, port 443 = HTTPS, port 22 = SSH). A protocol (TCP, UDP) is the rule set for how data gets sent — TCP is reliable (it resends lost packets), while UDP is faster but doesn't guarantee delivery. The 'attack surface' refers to every open port/service on a system — in other words, every entry point an attacker could get in through.

Let's connect it to a real scenario

If a web server has ports 80 (HTTP), 443 (HTTPS), and 22 (SSH) open — that's an attack surface of 3 ports. Leave one extra port open unnecessarily (say, MySQL's port 3306), and the attack surface grows — giving an attacker one more possible path in. This is basically the 'least privilege' principle applied at the network level: only open what you actually need.

IP address = a device's network address, port = the number that distinguishes a service
TCP (reliable) vs UDP (fast, no guarantee) — the two protocol types
Attack surface = every open port/service on a system (i.e., every entry point)

Let's look at an example together

text

Common ports to recognize:

21   - FTP (file transfer, often insecure)
22   - SSH (secure remote login)
25   - SMTP (email sending)
53   - DNS
80   - HTTP (unencrypted web)
443  - HTTPS (encrypted web)
3306 - MySQL
3389 - RDP (Windows remote desktop)

You should see

Be able to explain TCP/UDP, ports, and the attack surface concept.

Try it in 5 minutes

Check the open ports on your own laptop/router (just your own device) using `netstat` or your router's admin panel — try to guess which service each port belongs to.

A quick word of caution

Assuming a non-standard port (say, running SSH on port 2222 instead of 22) makes you secure through 'security by obscurity' is a misconception — attackers can still find it via a port scan (Basic lesson 6); it's just an extra layer, not a primary defense.

Easy traps

Oversimplifying the TCP vs UDP difference as 'one is just better, one is just worse' — it really depends on the use case (video calls = UDP, file downloads = TCP)
Memorizing port numbers without connecting them to service names — understanding the context matters a lot when reading real scan output

Now try it yourself

Check the open ports on your own laptop/router (just your own device) using `netstat` or your router's admin panel — try to guess which service each port belongs to.

You'll know it worked when: Be able to explain TCP/UDP, ports, and the attack surface concept.