Skip to content
Start free
Get App

Networking for Ethical Hackers – Complete Course (Beginner to Pro) | 12+ Hours

A beginner-to-pro networking course for ethical hackers covering network basics, IP addressing, MAC addresses, OSI layers, DNS, TCP handshakes, packet capture, and Linux networking tools.

Key Takeaways

  • Cyber security depends on understanding normal network communication before analyzing attacks or anomalies
  • Networking relies on layered responsibilities, which the OSI model helps organize
  • Linux command-line tools provide practical visibility into interfaces, routes, connectivity, and traffic
  • Packet captures and protocol knowledge (ARP, DNS, TCP) let analysts distinguish normal behavior from suspicious activity

What the video covers

  • Introduces networks as groups of devices communicating via a sender, network path, and receiver model
  • Explains why networks exist: devices need to communicate and share resources such as servers, printers, and cloud services
  • Demonstrates Linux networking commands like 'ip address', 'ip route', and 'ping' to inspect interfaces and connectivity
  • Classifies networks by size and scope, including PAN, LAN, WAN, and MAN
  • Covers IP addressing and subnet masks, using 10.0.2.0/24 as an example
  • Explains MAC addresses, how switches use them, and why security professionals care about them
  • Introduces the OSI model's seven layers to organize networking responsibilities
  • Describes DNS resolution and caching, and how recursive resolvers store answers
  • Explains the TCP three-way handshake (SYN, SYN-ACK, ACK) and what port responses reveal
  • Walks through a Linux troubleshooting workflow for a website not loading, and demonstrates packet capture with tcpdump

Chapters

  1. 00:00 Introduction to Networks and Network Communication
  2. 00:38 MAC Addresses and Switching
  3. 01:22 IP Addressing and Subnet Masks
  4. 02:04 The OSI Model
  5. 02:46 DNS Resolution and Caching
  6. 03:27 HTTP and the TCP Handshake
  7. 04:07 Packet Capture with tcpdump
  8. 07:32 Linux Network Troubleshooting Workflow

Answers

Questions about this video

What is the basic model of network communication taught in this course?

The course describes network communication as a sender, a network path, and a receiver. Data travels from one device to another, and networking technologies control how that communication happens.

Which Linux commands does the course use to inspect networking?

The course uses 'ip address' to view interfaces and IP addresses, 'ip route' to see routing and gateways, 'ping' to test connectivity, and 'tcpdump' to capture network traffic.

Why do cyber security professionals need to understand normal network traffic?

Understanding normal communication is necessary before identifying attacks, traffic anomalies, or suspicious behavior. The course emphasizes that analysts must distinguish legitimate activity from malicious activity, such as malware communicating with a suspicious server.

Full Transcript — Download SRT & Markdown

00:00
Speaker A
Every time you open a website, send a message, watch a video, or log into an online account, your device is communicating with other devices. You don't see most of it happening, but underneath the screen, data is constantly moving through networks.
00:19
Speaker A
if you want to understand cyber security, you need to understand what is happening on those networks. Because before you can understand network attacks, traffic analysis or security monitoring, you first need to understand normal network communication.
00:40
Speaker A
And if you want to understand cyber security, you need to understand what is happening on those networks. Because before you can understand network attacks, traffic analysis, or security monitoring, you first need to understand normal network communication.
00:50
Speaker A
Those devices could be computers, phones printers servers cameras or many other devices. For example, if two computers can exchange information, they are communicating through a network.
01:06
Speaker A
So let's start from the beginning. What exactly is a network? In the simplest terms, a network is a group of devices that can communicate with each other.
01:26
Speaker A
imagine computer A wants to send a file to computer B. Computer A has the information. Computer B needs the information. The network provides the communication path between them. The same basic idea applies when your phone requests a website. Your phone sends a
01:46
Speaker A
Those devices could be computers, phones, printers, servers, cameras, or many other devices. For example, if two computers can exchange information, they are communicating through a network.
01:57
Speaker A
Sender, network, receiver. That's the foundation of network communication. Why networks exist? Why do networks exist? Because devices need to communicate and share resources.
02:12
Speaker A
Now, a phone, a printer, and a server together form a larger network. And when many different networks connect together, you eventually get something much bigger: the internet. So networking is fundamentally about communication between devices.
02:23
Speaker A
Users may access websites and cloud services. Security systems may send logs to monitoring systems. Without networking, these devices would be isolated.
02:36
Speaker A
The simple idea: imagine computer A wants to send a file to computer B. Computer A has the information. Computer B needs the information. The network provides the communication path between them.
02:55
Speaker A
How communication travels. Real network communication is usually more complicated than one device connecting directly to another. Your device may first communicate with a router. That router may forward the traffic to another network. more routers may be involved before the traffic
03:15
Speaker A
The same basic idea applies when your phone requests a website. Your phone sends a request. The network carries that communication. A server receives the request and sends information back.
03:34
Speaker A
exactly the kinds of questions networking will help us answer. You will learn the technologies behind these processes throughout this course. What actually moves?
03:47
Speaker A
So remember this simple mental model: sender, network, receiver. That's the foundation of network communication.
04:04
Speaker A
For now, you don't need to understand the complete technical structure of a packet. Just remember this. Data has to travel from one device to another and networking technologies control how that communication happens. Later we will look much deeper into packets, frames,
04:25
Speaker A
Why do networks exist? Because devices need to communicate and share resources. In a company, computers may need to access shared servers. Employees may need network printers. Applications may communicate with databases. Users may access websites and cloud services. Security systems may send logs to monitoring systems.
04:34
Speaker A
run IP address. The IP command is used to interact with network configuration on Linux. The address option tells it to display network address information. You may see interfaces with names such as E T0 ENP03 or WL0.
04:54
Speaker A
Without networking, these devices would be isolated. Networking gives them a way to communicate. Your home Wi-Fi is a simple example. Your phone connects to your home network. Your router connects that network to other networks. Eventually, your communication can reach a server somewhere on the internet.
05:02
Speaker A
For example, your computer may have an Ethernet interface for a cable connection or a wireless interface for Wi-Fi. You may also see an IP address in the output. Don't worry about understanding IP addresses yet. That is coming later in the course. For now,
05:22
Speaker A
How does communication travel? Real network communication is usually more complicated than one device connecting directly to another. Your device may first communicate with a router. That router may forward the traffic to another network. More routers may be involved before the traffic reaches its destination.
05:32
Speaker A
Run ping 8.8.8.8. The ping command tests whether your machine can communicate with a destination and receive a response. If replies appear, you may see lines containing information such as the destination address and response time.
05:52
Speaker A
This creates an important question. How does the network know where the information should go? How does a router know which direction to forward it? And how does the destination know where the communication came from? These are exactly the kinds of questions networking will help us answer. You will learn the technologies behind these processes throughout this course.
06:13
Speaker A
Imagine you're monitoring a company network. You see one computer communicating with another system. How do you know whether that communication is normal? Maybe the user is visiting a legitimate website. Or maybe malware is communicating with a suspicious server.
06:33
Speaker A
What actually moves? When information travels across a network, it is transported in smaller units of data. One important term you will learn later is a packet. Think of a packet as a small unit of network data traveling toward its destination.
06:47
Speaker A
That's why networking is so important in cyber security. Security professionals work with network traffic, IP addresses, ports protocols packets DNS HTTP firewalls, and many other technologies.
07:03
Speaker A
For now, you don't need to understand the complete technical structure of a packet. Just remember this: data has to travel from one device to another, and networking technologies control how that communication happens. Later we will look much deeper into packets, frames, routing, and protocols.
07:11
Speaker A
A network allows devices to communicate. Networks exist because devices need to exchange information and share resources. Network communication involves a sender, a communication path, and a receiver. Data travels across networks using different networking technologies, and cyber security depends
07:34
Speaker A
Practical Linux observation: let's see some networking information on a real Linux machine.
07:53
Speaker A
types LAN WAN man and PAN. This will give us the vocabulary we need to start understanding how different networks are organized. I'll see you in video two.
08:11
Speaker A
Run `ip address`. The `ip` command is used to interact with network configuration on Linux. The `address` option tells it to display network address information. You may see interfaces with names such as `eth0`, `enp0s3`, or `wlan0`. The exact name depends on your system.
08:32
Speaker A
should a cyber security professional care about the difference? By the end of this lesson, you will be able to look at a network and understand its basic scope and type. Welcome to video two of networking for cyber security beginner
08:49
Speaker A
A network interface is the part of the system that provides network connectivity. For example, your computer may have an Ethernet interface for a cable connection or a wireless interface for Wi-Fi. You may also see an IP address in the output. Don't worry about understanding IP addresses yet. That is coming later in the course. For now, simply notice that Linux knows about the network interfaces available on the machine.
09:02
Speaker A
Networks can be classified by their size, coverage area, and purpose. Today we will focus on four important network types. P A N personal area network, LN local area network, MAN metropolitan area network and one wide area network.
09:22
Speaker A
Now let's test communication. Run `ping 8.8.8.8`. The ping command tests whether your machine can communicate with a destination and receive a response. If replies appear, you may see lines containing information such as the destination address and response time.
09:31
Speaker A
Let's begin with one simple question. How far does a network reach? Imagine your smartphone connected to wireless earbuds. That is a very small and personal connection. Now imagine your phone, laptop, smart TV and printer connected to your home Wi-Fi. That
09:51
Speaker A
The important idea is simple. Your computer sent network communication. A destination received it, and a response came back. That's networking happening in front of you.
10:12
Speaker A
way to understand network types is by thinking about their scope. Personal area, local area, metropolitan area, wide area. Let's start with PN. P stands for personal area network. A personal area network is a network centered around one person and their personal
10:31
Speaker A
Cyber security connection: now let's connect this to cyber security. Imagine you're monitoring a company network. You see one computer communicating with another system. How do you know whether that communication is normal? Maybe the user is visiting a legitimate website. Or maybe malware is communicating with a suspicious server. Maybe a machine is suddenly sending an unusual amount of traffic. Maybe someone is scanning systems on the network.
10:49
Speaker A
The important idea is not simply that the network is small. The important idea is that it is focused on personal devices around an individual. For example, your phone can send audio to your Bluetooth earbuds. Your smartwatch can exchange information with your phone
11:09
Speaker A
To recognize suspicious behavior, you first need to understand normal behavior. That's why networking is so important in cyber security. Security professionals work with network traffic, IP addresses, ports, protocols, packets, DNS, HTTP, firewalls, and many other technologies. You don't need to understand those terms yet. We're going to learn them one by one.
11:18
Speaker A
From a cyber security perspective, even a small network can matter. Personal wireless connections can have security risks if devices are poorly secured or contain vulnerabilities. So remember, small does not automatically mean safe.
11:34
Speaker A
Let's recap. A network allows devices to communicate. Networks exist because devices need to exchange information and share resources. Network communication involves a sender, a communication path, and a receiver. Data travels across networks using different networking technologies, and cyber security depends heavily on understanding network communication.
11:43
Speaker A
Think about your home. You might have a smartphone, laptop, smart TV, printer, and other devices connected to the same home network. That is a LAN. A school computer laboratory can have a LAN. An office can have a LAN. A small business
11:59
Speaker A
Next video: but not all networks are the same. Your home network, a company's network, and the internet can be very different in size and purpose. So in the next video we'll learn about four important network types: LAN, WAN, MAN, and PAN. This will give us the vocabulary we need to start understanding how different networks are organized.
12:13
Speaker A
For example, your laptop might communicate with a network printer. Your smartphone might communicate with another device connected to the same Wi-Fi network. This is where networking becomes very important for cyber security. An organization may have employee computers, servers, printers,
12:34
Speaker A
I'll see you in video two.
12:50
Speaker A
This is one reason cyber security professionals care about network boundaries and communication paths. The more we understand the structure of a LAN, the easier it becomes to understand where security controls should exist.
13:07
Speaker A
Now let's make the network larger. MAN stands for metropolitan area network. A metropolitan area network connects networks across a larger geographic area, often around a city or metropolitan region. Imagine a large organization with several buildings located in different parts of the same
13:29
Speaker A
city. Each building can have its own L. Those LANs can then be connected together across the metropolitan area.
13:40
Speaker A
The important difference is scale. A LAN might cover a home, office, building, or similar local environment.
13:49
Speaker A
A man can connect multiple local networks across a larger metropolitan area. The boundaries are not always perfectly defined in the real world.
14:00
Speaker A
These terms mainly help us describe the general scale and scope of a network. From a cyber security perspective, a larger network can introduce additional security challenges. There may be more locations, more devices, more connections, and more communication paths to monitor and protect. Now we
14:22
Speaker A
reach W. W. stands for wide area network. A WAN connects networks across large geographic distances. That could mean different cities, states, countries, or even continents. One of the biggest examples people know is the internet. But there is an important
14:42
Speaker A
distinction. The internet is a global network of interconnected networks. AW is a type of network that connects geographically separated networks.
14:54
Speaker A
Organizations can also have their own private ws. For example, imagine a company with offices in Lagos, Abuja, London and New York. Each office can have its own l.
15:08
Speaker A
Those ls can be connected using W technologies. Now networking becomes even more important for cyber security.
15:18
Speaker A
Traffic between locations may travel across multiple networks and communication links before reaching its destination.
15:26
Speaker A
Security professionals need to understand where traffic originates, where it travels, and where security controls are positioned. Put everything together. Let's compare the four network types. Pan means personal area network.
15:44
Speaker A
It focuses on personal devices around an individual. An example is a smartphone connected to Bluetooth earbuds. LAN means local area network. It connects devices within a limited local area. An example is a home, school or office network. MAN means metropolitan area
16:04
Speaker A
network. It connects networks across a larger metropolitan area. An example is multiple organizational networks connected across a city. One means wide area network. It connects networks across large geographic distances. An example is an organization's networks connected across different countries.
16:28
Speaker A
Now let's connect this to cyber security. Imagine a company. Inside one office you have a LAN. That land contains employee computers, printers, servers, and other devices. The company also has offices in different cities.
16:46
Speaker A
Those locations may be connected through a wan and an employee may also use a smartphone connected to wireless earbuds through a PA.
16:56
Speaker A
So, one person can interact with multiple network types at the same time. This is why cyber security professionals need networking knowledge. You cannot properly understand network security without understanding the environment where communication happens. You need to know what is connected, where it is
17:18
Speaker A
connected, how far the network extends, and how different parts of the network communicate. Practical observation.
17:29
Speaker A
Linux. Let's look at this from a real Linux system. We can use a simple command to inspect our network interfaces. Run IP adder. The IP adder command displays information about the network interfaces on your Linux system.
17:46
Speaker A
You may see an interface such as eth03 WL0 or another interface name depending on your system. You may also see an IP address assigned to that interface. Now there is an important point here. This command does not tell us this is a L or
18:10
Speaker A
this is a W. Instead, it gives us information about our own device and its network interfaces.
18:19
Speaker A
To understand the larger network, we need more information about the network architecture around the device. This distinction is important. A command can show us what is happening on our device.
18:34
Speaker A
But understanding the entire network requires understanding how that device connects to other networks. Cyber security connection. Here's the big lesson. When a security professional investigates a device, they need to understand where that device sits within the network. Is it part of a personal
18:55
Speaker A
network? a local office network, a larger metropolitan network, or a network communicating across different geographic locations.
19:05
Speaker A
Understanding network scope helps security professionals reason about communication paths, security boundaries, network exposure, monitoring, and potential attack surfaces. This is why learning networking is not just about memorizing terms. It is about building a mental model of how devices and networks fit
19:29
Speaker A
together. Recap. Let's quickly review what we learned. P A N stands for personal area network. It focuses on personal devices around an individual.
19:42
Speaker A
LAN stands for local area network. It connects devices within a limited local area. Mayen stands for metropolitan area network. It connects networks across a larger metropolitan area. One stands for wide area network. It connects networks across large geographic distances. And
20:04
Speaker A
remember these categories mainly describe the scale and scope of a network. They are not simply about how many devices are connected. A network with many devices is not automatically a one. The geographic and organizational scope matters.
20:23
Speaker A
Now you know the major types of networks. But there is another important question. If a network contains many devices, how are those devices actually arranged and connected? Do all networks use the same design? Not at all. In the
20:40
Speaker A
next lesson, we are going to explore network topologies. You will learn different ways devices can be connected and how those designs affect performance, reliability and security.
20:53
Speaker A
That is video three. Network topologies. Two networks can contain the same number of computers, use the same internet connection, and even run the same applications, but they can be built completely differently. And that difference can affect performance, reliability cost troubleshooting and
21:20
Speaker A
even security. So after learning about L, W, M, and PAN in the previous video, we now need to answer another important question. How are the devices inside a network actually connected? That is where network topology comes in. A
21:39
Speaker A
network topology describes the way devices and connections are arranged within a network. Think of it like the layout of a road system. The devices are like buildings and the network connections are like roads between them.
21:55
Speaker A
The shape and arrangement of those roads determine how traffic can move. Today we will build a clear mental model of the major network topologies, see how they work and understand why a cyber security professional should care about the way a
22:13
Speaker A
network is designed. The simple idea. First, let's make the idea extremely simple. A topology is basically the structure of a network. It tells us how devices are connected and how communication can move between them.
22:31
Speaker A
There are two useful ways to think about topology. Physical topology describes how devices and cables are physically arranged. Logical topology describes how data actually moves through the network.
22:46
Speaker A
These two ideas can sometimes be different. For example, a network might physically use cables connected to a central switch, while the logical communication between devices follows specific paths determined by networking rules. You do not need to memorize that
23:04
Speaker A
distinction yet. The important idea is this. Topology is about the structure and organization of network connections.
23:14
Speaker A
Let's start with three classic topologies. bus, star and ring. First is the bus topology. In a bus network, multiple devices share a common communication line. Think of it like several houses connected along one main road. The design is simple, but if that
23:35
Speaker A
main connection has a serious problem, communication can be affected across the network. Next is star topology. Here devices connect to one central point.
23:48
Speaker A
This is extremely important because the star design is common in modern Ethernet networks. The central device can coordinate connections between the connected devices. If one individual cable fails, usually only that device loses its connection. But if the central
24:07
Speaker A
device fails, many connected devices can be affected. Now ring topology. In a ring, each device connects to the next device forming a closed loop. Data can travel around the ring according to the technology being used. The key idea is
24:25
Speaker A
the structure. The devices form a circle. Now let's look at more scalable structures. Mh.
24:33
Speaker A
Tree and hybrid. A mesh topology creates multiple connections between devices. Why would we want multiple paths?
24:42
Speaker A
Because if one connection fails, another path may still be available. This can improve redundancy and reliability, although it also increases complexity and cost. A full mesh can become expensive because many connections may be required. Next is tree topology. A
25:03
Speaker A
tree structure organizes networks into levels. It looks similar to the branches of a tree. This makes it useful for organizing larger networks into sections or layers. Finally, we have hybrid topology. A hybrid topology combines different topology designs. And this is
25:23
Speaker A
important because real world networks do not always fit into one perfect category. Organizations often combine different designs based on their requirements. Compare the topologies.
25:38
Speaker A
Now let's compare them. Bus is simple but a shared backbone can create limitations. Star is easy to manage and is widely used but the central connection is important. Ring provides a circular structure but failures can affect communication depending on the
25:57
Speaker A
implementation. Mesh provides strong redundancy because multiple paths can exist but it can become complex and expensive. Tree provides hierarchical organization and can scale well. But problems higher in the hierarchy can affect entire sections.
26:18
Speaker A
Hybrid gives network designers flexibility because different structures can be combined. So there is no single topology that is automatically the best.
26:28
Speaker A
The correct design depends on factors such as cost, scale, performance, reliability, and operational requirements. Step five, see the topology in a real network. Now, let's bring this into the real world. Imagine a small office. You have 10 computers,
26:49
Speaker A
several phones, a printer, and a server. If every computer had to connect directly to every other computer, the network could become difficult to manage. Instead, modern Ethernet networks commonly use a central switching structure. That gives us a practical example of why topology
27:08
Speaker A
matters. The topology affects how devices are connected, how failures behave, and how the network can be expanded. For this lesson, a diagram is more useful than a terminal command because topology is primarily about network structure rather than a command
27:28
Speaker A
line output. Notice what happens when one connection fails. The impact depends on where that connection sits within the topology. That is the real value of understanding network structure. Why cyber security professionals care? Now let's connect topology to cyber
27:47
Speaker A
security. A security professional should not look at a network as just a collection of computers. They need to understand how those computers are connected. Topology can influence where traffic flows, where security controls can be placed, and which parts of a
28:06
Speaker A
network may be affected when something fails. It also helps during reconnaissance and incident investigation.
28:15
Speaker A
For example, if you discover that many systems depend on a central network device, that device becomes an important part of understanding the environment.
28:27
Speaker A
Later in this course, you will learn about switches, routters, network segmentation, firewalls, monitoring, packet analysis, and network attacks. All of those topics become easier when you understand the structure connecting the devices. So remember, network topology is not just
28:50
Speaker A
about drawing computers and lines. It helps us understand the architecture of communication. Let's quickly review.
28:58
Speaker A
First, topology describes how devices and network connections are arranged. Second, major topologies include bus, star, ring, mesh, tree, and hybrid.
29:11
Speaker A
Third, different topologies provide different trade-offs in cost, reliability scalability and management. And fourth, topology matters to cyber security because the structure of a network affects communication, visibility, failures, and where security controls may be applied. Now you know how networks can be structured. But
29:35
Speaker A
there is still a major piece missing. We have computers, phones, servers, and connections. But what actually connects all of these devices together? In the next video, we are going to examine the devices that make networks work.
29:52
Speaker A
Routers, switches, hubs, and access points. Once you understand those devices, the network diagrams we have been studying will start to make much more sense.
30:08
Speaker A
When you connect your laptop to Wi-Fi and open a website, several network devices may be involved before that request reaches the internet. But what exactly are those devices doing? What is a router? What is a switch? Why did
30:26
Speaker A
older networks use hubs? And what exactly does a wireless access point do? If you are learning cyber security, you need to understand these devices because they are the infrastructure that carries, directs, and connects network traffic. In video two, we learned that
30:46
Speaker A
networks can have different sizes such as L, W, M, and PAN. In video three, we learned that devices can be arranged using different network topologies. Now we are going one level deeper. We know that devices are connected. But what
31:04
Speaker A
actually connects them and what controls where the traffic goes? That is where network devices come in. The simple idea.
31:15
Speaker A
Think of a network like a transportation system. A router is like a traffic director that connects different roads or networks. A switch is like a local traffic organizer that connects devices inside the same network. A hub is much
31:32
Speaker A
simpler. It receives traffic and sends it out through every connected port. And a wireless access point allows wireless devices to join a network. These devices can work together, but they do very different jobs. The real networking concept. Let's start with the switch. A
31:54
Speaker A
network switch connects devices on a local network. For example, imagine three computers and a printer in an office. Instead of connecting every computer directly to every other computer, they can connect to a central switch. The switch uses MAC addresses to
32:14
Speaker A
make forwarding decisions inside the local network. You will learn MAC addresses in the next video. So for now, remember this. A switch mainly helps devices communicate within a local network. Now the router. A router connects different networks. For
32:33
Speaker A
example, your home network is one network while the internet is made up of many other networks. Your router provides the path between your local network and other networks. How they work? Let's imagine your laptop wants to communicate with another computer on the
32:53
Speaker A
same local network. The traffic reaches the switch. The switch examines information associated with the local network and forwards the frame toward the appropriate destination port. Now imagine your laptop wants to reach a server somewhere on the internet. The
33:13
Speaker A
traffic needs to leave your local network. The router becomes important because it connects your local network to another network. Now what about the hub? A hub does not make intelligent forwarding decisions like a switch. If a hub receives traffic on one port, it
33:33
Speaker A
repeats that traffic to its other ports. That means devices connected to the hub can receive traffic that was not intended for them. This is one reason switches replaced hubs in modern Ethernet networks. Visualize the access point. Now let's look at the wireless
33:53
Speaker A
access point. An access point or AP provides wireless network access to devices such as smartphones, laptops, and tablets. Think about the Wi-Fi in your home. Your phone communicates wirelessly with the access point. The access point then connects that wireless
34:14
Speaker A
traffic into the wired network. In many home routters, the router, switch, and wireless access point are combined into one physical device. That is why people often simply call the whole box a Wi-Fi router. Technically, however, several networking functions can exist inside
34:35
Speaker A
that one device. Practical observation. Let's observe the network from a Linux machine. Run IP link. This command displays network interfaces on the system. You may see interfaces such as Ethernet or Wi-Fi. Now run IP adira.
34:55
Speaker A
This shows more information including IP addresses assigned to the interfaces. Remember what we learned earlier. An IP address identifies a device at the network layer. The important point here is that your computer needs a network interface to communicate with the
35:14
Speaker A
network. The physical network infrastructure around that interface may include a switch, access point, and router. The exact devices you see depend on how your network is built. Cyber security connection. Now, think like a cyber security professional. If you are
35:35
Speaker A
investigating suspicious network traffic, you need to understand where that traffic is traveling. A switch tells you about local connectivity. A router connects different networks and forwards traffic between them. An access point provides wireless entry into the network. And older hubs broadcast
35:57
Speaker A
traffic much more broadly. Understanding these devices helps you understand where monitoring, segmentation, filtering and security controls can exist. If you do not understand the network infrastructure, it becomes much harder to understand the traffic moving through it. Recap. A router connects different
36:21
Speaker A
networks and forwards traffic between them. A switch connects devices within a local network and makes forwarding decisions using local network information such as MAC addresses. A hub simply repeats incoming traffic to other ports and an access point provides
36:42
Speaker A
wireless access to a network. The most important idea is this. Different network devices have different jobs. Now we have learned how devices connect to and move traffic through a network. But there is another question. If a switch needs to decide which device should
37:03
Speaker A
receive local traffic, how does it identify that device? That brings us to one of the most important identifiers in networking, the MAC address. In the next video, we will break down exactly what a MAC address is, how it works, and why
37:21
Speaker A
cyber security professionals care about it. Imagine four computers connected to the same network. They all have IP addresses. But if a switch needs to deliver local network traffic to one specific device, how does it know which physical network interface should
37:43
Speaker A
receive that traffic? This is where the MAC address comes in. In video 4, we learned that switches connect devices inside a local network and make forwarding decisions using information such as MAC addresses.
37:59
Speaker A
Today we are going to understand exactly what a MAC address is. This is an important step because we are moving from understanding network devices to understanding how those devices identify each other on a local network. What you will learn. We will start with the
38:19
Speaker A
simple idea. Then we will look at the technical meaning of a MAC address. How switches use it. How to find one on Linux. And finally, why cyber security professionals care about MAC addresses.
38:33
Speaker A
The simple idea. Think about a large apartment building. The building has one general street address, but each apartment has its own number. A MAC address works somewhat like a local identifier for a network interface.
38:50
Speaker A
MAC stands for media access control. A MAC address is a hardware level addressed with a network interface. For example, a computer's Ethernet interface can have a MAC address. Its Wi-Fi interface can also have its own MAC address. So
39:09
Speaker A
instead of thinking only about the computer itself, think about the network interface that is participating in the network. The important idea is this. An IP address helps identify a device at the network layer while a MAC address is
39:28
Speaker A
used for local network communication at the data link layer. The real networking concept. A MAC address is commonly written as six pairs of hexadesimal characters separated by colons. For example, 3 C col 5 2 col 8 2 col
39:47
Speaker A
1 9 col f0. Each pair represents one bite, giving a total of 48 bits in a traditional Ethernet MAC address. You may also see MAC addresses written using hyphens or other formatting. Do not worry about memorizing the hexadesimal values. What
40:07
Speaker A
matters is understanding what the address is used for. A MAC address identifies a network interface on the local network. This is different from an IP address. An IP address can change depending on the network you connect to.
40:25
Speaker A
For example, your laptop may receive one private IP address at home and another at school. The MAC address belongs to the network interface and is generally intended to remain stable although modern operating systems can also use MAC address randomization for privacy.
40:46
Speaker A
How it works? Now let's see why MAC addresses are useful. Imagine laptop A wants to send data to laptop B on the same local network. The data is carried inside a network frame. That frame contains a source MAC address and a
41:04
Speaker A
destination MAC address. The switch receives the frame. The switch looks at the destination MAC address. It then uses its MAC address table to determine which port leads toward that device.
41:18
Speaker A
This is one of the reasons switches are more intelligent than the hubs we discussed in video 4. A hub simply repeats traffic. A switch can learn which MAC addresses are associated with which ports and forward traffic more selectively. This helps make local
41:36
Speaker A
network communication more efficient. Visualize the difference. Let's make the difference clear. An IP address is used for logical addressing. It helps networks identify where traffic needs to go. A MAC address is used for local network delivery. So imagine your laptop
41:58
Speaker A
wants to communicate with a server on the internet. Your laptop does not use the server's MAC address across the entire internet. MAC addresses are used on the local network segment. As traffic moves through routters, the local frame is replaced as it moves from one network
42:18
Speaker A
segment to another. We will explore this much more later when we study ARP routting packets and frames. For now remember IP helps with logical network communication.
42:35
Speaker A
MAC helps with local network communication. Practical observation. Let's find the MAC address of a Linux system. Run IP link. Now look for a line that begins with link/ ether. You may see something similar to 08 col 0 0 col
42:55
Speaker A
27 col 18 02 col47. That value is the MAC address of that network interface. Let's break down what we are seeing. The interface name tells us which network interface we are looking at. The word link tells us that
43:16
Speaker A
this information belongs to the link layer interface and the value after link/ ether is the Ethernet MAC address.
43:26
Speaker A
You may have more than one interface. For example, one interface may represent Ethernet while another represents Wi-Fi.
43:36
Speaker A
The important observation is that different network interfaces can have different MAC addresses. This is a simple but useful networking observation.
43:48
Speaker A
You are not just learning what a MAC address looks like. You are seeing one on a real operating system. Cyber security connection. Now think like a cyber security professional. MAC addresses can help you understand which network interfaces are participating in
44:08
Speaker A
a local network. During network troubleshooting or investigation, you may need to identify devices and understand how they are connected.
44:19
Speaker A
Security tools can also use MAC addresses as part of network visibility and monitoring. But remember something important. A MAC address should not be treated as a permanent unchangeable identity. Modern operating systems can randomize MAC addresses, especially on Wi-Fi, for privacy. MAC addresses can
44:43
Speaker A
also be changed or spoofed in some situations. That means a security professional should not rely on a MAC address alone to identify a person or device. Instead, MAC information can be combined with other evidence such as IP addresses, authentication records,
45:03
Speaker A
switch information, DHCP logs, and network traffic. This is an important cyber security mindset. One piece of information rarely tells the entire story. Recap. A MAC address is associated with a network interface. It is commonly represented as six hexadesimal pairs. Switches use MAC
45:27
Speaker A
addresses to help forward local network traffic. MAC addresses operate at the data link layer while IP addresses provide logical addressing at the network layer. And on Linux, you can inspect network interface MAC addresses using IP link. Now we know how devices
45:48
Speaker A
can be identified locally. But local identification is only part of the story. When devices need to communicate across different networks, we need another type of address. That brings us to IP addresses. In the next video, we will learn about IPv4 and IPv6.
46:10
Speaker A
how they work, why we need them, and why IP addressing is fundamental to understanding the internet and cyber security.
46:24
Speaker A
Imagine your laptop is connected to the internet right now. It can communicate with websites, servers, phones, and other computers around the world. But how does the network know where to send the data? In the previous video, we learned about MAC addresses and how they
46:43
Speaker A
identify network interfaces on a local network. Today we move one step further. We are going to learn about IP addresses and this time we are looking beyond the local network. An IP address is one of the most important concepts in
47:02
Speaker A
networking. You will see IP addresses everywhere on your computer, on your phone, on routers, on servers, inside network traffic and during cyber security investigations.
47:16
Speaker A
So if you want to understand how devices communicate across networks, you need to understand IP addressing. Today we will focus on two major versions, IPv4 and IPv6.
47:31
Speaker A
The simple idea, think of an IP address like a network address. If a MAC address helps identify a network interface on a local network, an IP address helps identify where a device or network interface can be reached at the IP
47:48
Speaker A
layer. For example, you might see an address such as 1 192.168.1.2. This tells us something about where that device exists within an IP network. The important idea is this. A device needs an IP address so that network communication can be addressed and
48:12
Speaker A
routed. For example, if your laptop wants to communicate with a web server, the network needs destination information. The IP address provides that information. Understand IPv4.
48:27
Speaker A
IPv4 means internet protocol version 4. IPv4 uses 32 bits to represent an address. Those 32 bits are normally written as four decimal numbers separated by dots. For example, 1 9 2.168.1.20.
48:46
Speaker A
Each section is called an octet. Each octet represents eight bits. Four octets give us 8 + 8 + 8 + 8 that equals 32 bits. This gives I PV4 about 4.3 billion possible addresses. That sounds like a huge number. But the internet eventually
49:08
Speaker A
needed far more addresses than IPv4 could provide. There are billions of devices connected to networks and many devices need IP connectivity. That is one of the major reasons IPv6 was created. How IPv4 works in a network.
49:28
Speaker A
Let's make this practical. Imagine your laptop has the IP address 1 192.168.1.20. You want to communicate with a server somewhere on the internet. Your system creates network traffic with a source IP address and a destination IP address.
49:51
Speaker A
The source tells the network where the traffic came from. The destination tells the network where the traffic is going.
49:59
Speaker A
Routers use destination IP information to make forwarding decisions. This is why IP addressing is closely connected to routting. You will learn much more about routting later in the course. For now, remember this relationship. IP addressing tells us where devices and
50:20
Speaker A
networks are logically located. Routing helps move traffic toward the destination. IPv6 and why it exists.
50:29
Speaker A
Now, let's look at IPv6. IPv6 means internet protocol version 6. Instead of 32-bit addresses, IPv6 uses 128 bit addresses that creates an enormous address space. An IPv6 address looks very different from IPv4.
50:49
Speaker A
For example, 2 0 1 col 8 1 2 3 4 5 6 7 8 col 2 instead of four decimal sections separated by dots. IPv6 uses hexadeimal values separated by colons. You do not need to memorize IPv6 formatting today.
51:11
Speaker A
The important point is why IPv6 exists. IPv6 provides a vastly larger address space and introduces improvements designed for modern IP networking. So remember the basic difference. IPv4 uses 32bit addresses. IPV6 uses 128 bit addresses. Both are versions of the internet protocol used
51:38
Speaker A
to address and route network traffic. Practical Linux observation. Let's now see IP addresses on a real Linux system.
51:47
Speaker A
Run IP add. The IP command is a standard Linux networking utility. The ADR part asks Linux to display address information for the network interfaces.
52:00
Speaker A
Now look for a line containing N that usually represents an IPv4 address. You may see something like 10.0.2.15/24.
52:15
Speaker A
The part before the slash is the IPv4 address. The slash24 is CID notation which tells us about the network prefix.
52:24
Speaker A
We will study subnet masks and CID in much more detail in video 8. You may also see a line containing N6 that represents an IPv6 address. Notice that the IPv6 address is much longer and uses hexadesimal characters and colons.
52:46
Speaker A
Your exact addresses will depend on your network and Linux environment. Do not worry if your output looks different from mine. What matters is learning how to recognize IPv4 and IPv6 cyber security connection. Now think like a cyber security professional.
53:08
Speaker A
IP addresses are extremely important during network investigation. When analyzing traffic, you may need to identify the source IP and destination IP. You might ask which device sent this traffic? Where was the traffic going?
53:27
Speaker A
Which system communicated with this server? Was the communication inside the local network or across the internet?
53:35
Speaker A
These questions depend heavily on understanding IP addressing. But remember one important limitation. An IP address is not automatically the same thing as a specific human being. devices can use shared connections, NAT, VPNs, proxies or other network infrastructure.
53:56
Speaker A
So in cyber security, an IP address is evidence that must be interpreted in context. It is a network level identifier, not automatically a person's identity. Recap. Let's quickly review.
54:13
Speaker A
First, an IP address provides logical addressing for network communication. Second, IPv4 uses 32-bit addresses such as 1 9 2.168.1.20.
54:28
Speaker A
Third, IPv6 uses 128 bit addresses such as 20001 col B81 234 col 5 678 col 2.
54:43
Speaker A
Fourth, routters use destination IP information when forwarding traffic. And finally, cyber security professionals use IP addresses when analyzing network communication and investigating suspicious traffic. Now you understand what IP addresses are and why IPv4 and IPv6 exist. But there is another
55:07
Speaker A
important question. Not every IP address on a network is reachable directly from the public internet. Some addresses are used inside private networks while others are publicly reachable. So in the next video we will learn the difference between public and private IP addresses.
55:31
Speaker A
Your laptop can have an IP address. Your phone can have another IP address. Your smart TV can have another one, but all of them can access the internet through the same connection. So, here's the question. How can many devices inside
55:49
Speaker A
one network use their own IP addresses while the outside internet sees a different address? The answer begins with understanding the difference between private IP addresses and public IP addresses.
56:05
Speaker A
In the previous video, we learned about IP addresses. We learned that an IP address is used to identify a device or network interface at the IP layer. We also looked at IPv4 and IPv6.
56:22
Speaker A
Now, we need to take that idea one step further because not every IP address is used in the same way. Some addresses are designed for use inside private networks. Others are used for communication across the public internet. This distinction is extremely
56:41
Speaker A
important in networking and cyber security. What you will learn by the end of this video, you will understand what a private IP address is, what a public IP address is, why private IP addresses exist, the common IPv4 private address ranges, how devices
57:02
Speaker A
inside a private network communicate, how a private network connects to the internet, why multiple devices can share one public IP, how NAT relates to public and private addressing. How to identify private IP addresses on Linux? Why this distinction matters in cyber security?
57:24
Speaker A
The simple idea. Let's start with a simple example. Imagine your home network. You might have a laptop, a smartphone, a smart TV, a printer. Each device needs an IP address so that network communication can happen. Your laptop might have 1 192.168.1.20.
57:47
Speaker A
Your phone might have 1 92.168.1.21. Your smart TV might have 1 92.168.1.22 and your printer might have 1 92.168.1.23.
58:07
Speaker A
These addresses work inside your local network. But these devices are not normally given four different public IPv4 addresses just to access the internet. Instead, your router connects the private network to the public internet. So we have private network
58:25
Speaker A
laptop 1 92.168.1.20 phone 1 9 and 2.168.1.21 21 TV 1 192.168.1.22 router public internet public IP address 203.01350.
58:49
Speaker A
The important idea is private IP addresses are used inside private networks. Public IP addresses are used to communicate across the public internet. What is a private IP address?
59:02
Speaker A
A private IP address is an IPv4 address reserved for use inside private networks. These addresses are not globally routable across the public internet. Three IPV4 ranges are commonly used for private networks. Private range 110.0.0.0 to 10.255.255.255.
59:29
Speaker A
This is 10.0.0. 0.0/8 private range to 172.16.0.0 to 172.31.255.255. This is 172.16.0.0/12. Private range 3192.168.0.0 0 to 1 192.168.255.255.
60:04
Speaker A
This is 1 192.168.0.0/16. You will see IP addresses starting with 1 192.168. very often in home networks. For example, 1 192.168.1.1 might be the router and 1 192.168.1.2 might be your laptop. Why do private IP addresses exist? The biggest reason is
60:36
Speaker A
efficient use of IPv4 addresses. IPv4 provides roughly 4.3 billion possible addresses. That sounds like a huge number, but there are billions of internet connected devices.
60:51
Speaker A
So, giving every device a unique public IPv4 address is not practical. Private addressing allows organizations and homes to reuse the same private address ranges internally.
61:05
Speaker A
For example, one company could have 1 192.168.1.20. Another company could also have 1 192.168.1.2.
61:20
Speaker A
And your home network could also have 1 192.168.1.20. There is no conflict because these devices exist in separate private networks. This is one of the important ideas behind private addressing the real networking concept. Now let's introduce the technical distinction. A private IP
61:44
Speaker A
address is intended for communication within private networks and is not directly routable across the public internet. A public IP address is an address that can be globally routed on the internet subject to normal routing and network policies. This means the
62:04
Speaker A
internet can use public addressing to identify reachable network end points. But there is an important detail. A public IP address does not automatically mean this specific computer is directly exposed to the internet. There can be routers, firewalls, NAT load balancers
62:27
Speaker A
and other network devices between the public internet and an internal system. That distinction becomes very important in cyber security. Public IP versus private IP. Let's compare them. Private IP, public IP used inside private networks. used on the public internet
62:50
Speaker A
can be reused in different private networks. Must be globally unique within the internet's routing system. Not directly routed across the public internet globally routable in normal internet operation. Common in homes, offices, labs assigned by internet service providers or organizations.
63:12
Speaker A
Often works together with NAT can represent the internet-facing side of a network. Real world analogy. Think about a large apartment building. Inside the building, every apartment can have an internal apartment number. For example, apartment 20. Another building somewhere
63:32
Speaker A
else can also have an apartment 20. The apartment number is useful inside that building. But if someone wants to send a physical package from another city, they need the building's public street address. The same basic idea applies to
63:49
Speaker A
networking. A private IP is useful inside a private network. A public IP identifies the internet-facing side of a network or service. But remember, this is an analogy, not a perfect technical representation.
64:07
Speaker A
In real networking, routers and NAT determine how traffic moves between private and public addressing. How private devices reach the internet. Now, let's connect this to something you already learned. Imagine your laptop has 1 92.1 68.1.2.
64:31
Speaker A
You open a website. Your laptop creates network traffic destined for the website. But the destination is somewhere outside your local network.
64:41
Speaker A
Your traffic needs to leave the private network. It reaches the router. The router can perform network address translation commonly called NAT.NAT translates between private and public addressing so that devices using private addresses can communicate through a public-f facing address. We will study
65:03
Speaker A
NAT and Patty in much more detail later in video 21. For now, remember only this private IP address, then the router or NAT, then the public internet. Do not worry about the full NAT process yet. We will build on this concept later.
65:25
Speaker A
Practical demonstration. Find your private IP on Linux. Now, let's make this practical. If you're using Linux, we can inspect the network interfaces on the system. Setup preparation. Use a Linux machine connected to your local network. This can be your physical Linux
65:45
Speaker A
computer, a virtual machine, another authorized Linux environment. We are only inspecting our own network configuration. Run the command. Run IP Adder. You may see something similar to ETH0 in 10.0.2.15/24.
66:06
Speaker A
Let's break this down. Eth is the network interface name in this example. In it indicates that the following address is an IPv4 address. 10.0.2.15 2.15 is the IPv4 address assigned to that interface and /24 is the prefix length.
66:28
Speaker A
We will study subnet masks and CID much more deeply in video 8. For now, just recognize that /24 tells us something about the network portion of the address. Final cyber security takeaway.
66:47
Speaker A
At the beginning of this course, an IP address was simply an address. Now, we're starting to ask better questions.
66:54
Speaker A
Is it private or public? Where does it exist? What network does it belong to?
67:01
Speaker A
How does traffic leave that network? What device connects it to the internet? What controls traffic between the networks? These questions become extremely important when analyzing real network environments. and we are going to build on them throughout this course.
67:19
Speaker A
So now you understand public and private IP addresses. But there is another question. If devices have IP addresses like 1 192.168.1.2192.168.1.21192.168.1.22 22. How does the device know which part of the address identifies the network and which part identifies the device?
67:49
Speaker A
That is where subnet masks and CIR come in. In the next video, we're going to break down subnet masks and CIR and we'll make it practical.
68:06
Speaker A
Imagine you are managing a company with 500 computers. You do not want every computer to behave as if it belongs to one giant network. You want to organize them. You might have 100 computers for employees, 50 computers for servers, 30
68:25
Speaker A
computers for security systems, 20 computers for management, and other devices for guests and infrastructure.
68:33
Speaker A
But how does a computer know which devices are part of my local network? And how does it know which addresses are outside my network? This is where subnet masks come in. And later when you see something like 1 192.168.1.0/24
68:55
Speaker A
that/24 is called CIR notation. If you understand this lesson, IP addresses will start making much more sense. In video six, we learned about IPv4 and IPv6.
69:11
Speaker A
We learned that an IP address identifies a device at the network layer. In video 7, we learned that IP addresses can be public or private depending on where and how they are used. Now, we are going one level deeper. An IP address tells us
69:30
Speaker A
which address a device has, but an IP address alone does not tell the device exactly where its network ends. That is the job of the subnet mask. And CIDR gives us a shorter way to represent that network boundary. What you will learn by
69:49
Speaker A
the end of this lesson, you will understand what a subnet mask is, why subnet masks exist, how a subnet mask separates the network portion from the host portion, what/2416 and /8 mean, how CID notation works, how to identify the network and host
70:10
Speaker A
portions of an IPv4 address, how to inspect subnet information on Linux, and Why subnetting matters in cyber security? The simple idea. Let's start without complicated mathematics. Imagine an apartment building. The building has an address. Inside the building, there
70:31
Speaker A
are many apartments. The building address helps identify the overall location. The apartment number identifies a specific unit inside that building. An IPv4 network works in a similar way. The network portion tells us which network the device belongs to.
70:51
Speaker A
The host portion identifies the particular device inside that network. For example, 1 192.168.1.25. The entire address identifies one device. But we also need to know which part represents the network and which part represents the device. That is where the subnet mask helps. Think of
71:16
Speaker A
the subnet mask as a boundary marker. It tells the device this part belongs to the network and this part identifies the host. The real networking concept. Now let's introduce the technical definition. A subnet mask is a 32bit value used with an IPv4 address to
71:38
Speaker A
determine which bits represent the network portion and which bits represent the host portion. That sounds complicated. So let's use a common example. We have IP address 1 92.168.1.25 and subnet mask 255.255.255.0.
72:02
Speaker A
The subnet mask tells us that the first three octets represent the network portion. So 1 92.168.1 is the network portion and 25 is the host portion. That means 1 192.168.1.25 belongs to the network 1 192.168.1.0 with the subnet mask 255.255.255.0.
72:34
Speaker A
The important idea is this. IP address plus subnet mask equals network information. The subnet mask gives meaning to the IP address. How it works?
72:47
Speaker A
Now let's understand what is actually happening. An IPv4 address contains 32 bits. Those 32 bits are divided into four groups called octets. For example, 1 92.168.1.2 25. Each octet contains 8 bits. So 8 + 8 + 8 + 8 equals 32 bits. The subnet mask
73:13
Speaker A
also contains 32 bits. 4 255.255.255.0. Its binary representation can be understood as four groups. The first group is 8 1's. The second group is 8 1's. The third group is 8 1's. And the fourth group is 8 zeros. So in binary we
73:39
Speaker A
have 8 1's followed by 8 1's followed by 8 1's followed by 8 zeros. The ones represent the network portion. The zeros represent the host portion. So the first three groups are used for the network and the last group is used for the host.
73:58
Speaker A
That gives us 24 network bits and eight host bits. This is why the same subnet mask can also be written as /24.
74:11
Speaker A
And this brings us to CI R. CI R notation. CI R stands for classless interdomain routting. You do not need to memorize the full name yet. The important thing is understanding the notation. When you see 1 192.168.1.25/24, the /24 means the first 24 bits are the
74:41
Speaker A
network portion. So 1 192.168.1.25/24 and 1 192.168.1.25 with 255.2 255.255.0 represent the same network boundary. Now consider 1 192.168.1.25/16.
75:08
Speaker A
This means 16 bits are used for the network portion. The subnet mask would be 255.255.0.0 0 and 192.168.1.25/8 means 8 bits are used for the network portion. The subnet mask would be 255.0.0.0.
75:37
Speaker A
So CID gives us a compact way to describe the network boundary. Visualize it. Let's make this easier to see.
75:46
Speaker A
Consider 1 192.168.1.25/24. We can visualize it like this. 1 92.168.125. The first three octets represent the network portion. The final octet represents the host portion. So devices such as 1 92.168.1.192.168.1.2192.168.1.25 1 192.168.1.5 can all belong to the same/24
76:30
Speaker A
network. Their host numbers are different but their network portion is the same 1 192.168.1.
76:39
Speaker A
Now imagine another device 1 192.168.2.10/24. Its network portion is different. It belongs to 1 192.168.2.0/24 not 1 192.168.1.0.
77:01
Speaker A
0/24. This distinction becomes extremely important when routers decide where traffic should go. A device needs to know is the destination on my local network or is the destination on another network? The subnet mask helps answer that question. Practical observation.
77:22
Speaker A
Now let's look at this on Linux. We want to inspect the IP address and subnet information assigned to our network interface. Run IP address. You may see something similar to ETH0 ne 10.0.2.15/24.
77:42
Speaker A
The exact interface name and IP address will be different on your machine. The important part is 10.0.2.15/24 2.15/24 each break it down. 10.0.2.15/24 is the IPv4 address. /24 tells us that the first 24 bits represent the network portion.
78:09
Speaker A
Therefore, the corresponding subnet mask is 255.255.255.0. zero. We can also ask Linux for more detailed information about the interface. Run IP-4 out of the dash4 option tells IP to show ipv4 information. Now let's inspect the routing information as well. Run IP
78:37
Speaker A
route. You may see something similar to 10.0.2.0/24 dev0 default via 10.0.2.2 to dev0. The first line tells us that 10.0.2.0/24 is directly connected to the interface.
78:58
Speaker A
The second line shows a default route through 10.0.2.2. We will study default gateways and routing much more deeply later in the course. For now, focus on the subnet information. The important observation is that Linux is not simply storing
79:19
Speaker A
10.0.2.0. It is also working with the network boundary /24. That boundary helps the operating system understand the local network. Cyber security connection. Now let's connect this to cyber security. Subnetting is not just about making IP addresses look organized. It is extremely important for
79:45
Speaker A
security. Imagine an organization with employee computers, servers, security systems, guest devices. If everything is placed into one large network without proper organization, devices may have more direct access to one another than necessary. Subnetting can help divide a larger network into
80:08
Speaker A
smaller logical networks. For example, employees 1 192.168.10.0/24. Servers 1 192.168.2 0.0/24. Security 1 192.168.3.0/24.
80:30
Speaker A
Guests 1 192.168.4.0/24. This can support network segmentation and access control. Later in this course when we reach routing, VLANs, firewalls, network segmentation, network scanning, incident investigation, you will repeatedly see subnet information. For a cyber security professional, knowing that 1010.20.0/24
81:02
Speaker A
is not just a random string of numbers is important. It tells you something about the structure of the network. If you are analyzing network traffic, investigating an incident, or examining a network configuration, subnet information can help you understand which devices belong
81:22
Speaker A
together, which network is the traffic coming from, is this destination local or remote, how is the network divided?
81:31
Speaker A
This is why subnet masks and CID are foundational networking skills for cyber security. Practical demo quick recap.
81:41
Speaker A
Let's summarize what we observed. We started with IP adder to inspect the IP address and CID information. Then IP-4 adder to focus on IPv4 addresses and IP route to see the networks and routes known to the system. If you saw
82:01
Speaker A
10.0.2.0/24 remember 10.0.2.0 this is the host's IPv4 address / 24 this means there are 24 network bits 255.255.255.0 this is the equivalent subnet mask 10.0.2 2.0/24.
82:32
Speaker A
This represents the network. The exact values on your machine may be different. That is completely normal. Recap. Before moving on, remember these five ideas.
82:44
Speaker A
One, a subnet mask defines the boundary between the network and host portions of an IPv4 address. One, 255.25.255.0 0 is equivalent to /24.
83:02
Speaker A
1 /24 means the first 24 bits are used for the network portion. One CID gives us a compact way to represent network boundaries. One subnet information helps systems and security professionals understand how networks are organized and remember the bigger picture. In
83:25
Speaker A
video six, you learned what an IP address is. In video 7, you learned that IP addresses can be public or private.
83:36
Speaker A
Now you have learned something deeper. An IP address also exists within a network boundary. That boundary is described by the subnet mask or CIR prefix.
83:49
Speaker A
But there is still another important question. We now know how an IP address identifies a device. We know how a subnet tells us which network that device belongs to. But when a device communicates with a service, how does it
84:06
Speaker A
identify which application or service should receive the traffic? For example, how can one computer use a web server, an SSH server, and another service at the same time? They all use the same IP address. So what identifies the specific
84:24
Speaker A
service? That brings us to the next lesson, video nine, ports and protocols. And this is where we move from which device to which service on that device.
84:42
Speaker A
Imagine your computer has one IP address 1 92.168.1.25. Now imagine that computer is doing several things at the same time. You are browsing a website. You are connected to an SSH server. Your DNS resolver is handling domain name requests. Maybe
85:05
Speaker A
another application is communicating with a remote server. All of these connections are using the same IP address. So here is the question. How does your computer know which application should receive each piece of network traffic? The IP address tells us
85:25
Speaker A
which device. But something else needs to identify which service on that device. That is where ports come in. And to understand what those services actually communicate with, we also need to understand protocols. In the previous lessons, we built the foundation step by
85:44
Speaker A
step. In video five, we learned about MAC addresses and how devices are identified on a local network. In video six, we learned about IP addresses and how they identify devices at the network layer. In video 7, we learned about
86:02
Speaker A
public and private IP addresses. In video 8, we learned about subnet masks and CIR, which help define network boundaries.
86:13
Speaker A
Now we are going one level deeper. We know which device we are communicating with. But we still need to answer which service on that device are we communicating with that is the job of a port and the rules that define how that
86:29
Speaker A
communication happens are called protocols. What you will learn in this lesson, you will understand what a network port is, why ports exist, how ports work with IP addresses, the difference between a port and a protocol, what a socket is at a basic
86:49
Speaker A
level, common port numbers such as 22, 53, 80, and 443. How Linux shows listening network services. How ports become important during cyber security investigations and why knowing a port number does not automatically tell you exactly what software is running there. The simple
87:12
Speaker A
idea. Let's start with a simple analogy. Imagine an apartment building. The building address tells you which building you want to reach. But inside that building there are many apartments.
87:27
Speaker A
You need another identifier to tell you which apartment you want. In networking, the IP address is similar to the building address. A port number helps identify the particular network service you want to reach on that device. For example, 1 192.168.1.25
87:48
Speaker A
identifies a device. But 1 92.168.1.25 2522 contains additional information. The 1 192.168.1.25 is the IP address. The 22 is the port number. The colon separates them. So we can think of it like this. IP address, which device, port, which service. This
88:18
Speaker A
is why a single computer can provide multiple network services at the same time. The real networking concept. Now let's introduce the technical meaning. A port number is a numerical identifier used by network communication to identify a particular endpoint or
88:37
Speaker A
service associated with a host. For TCP and UDP, port numbers range from 0 to 65,535.
88:49
Speaker A
They are represented using 16 bits. You do not need to memorize that number immediately. What matters right now is understanding the purpose. There are three broad port number ranges you will hear about. Well-known ports 0 to 1,023.
89:08
Speaker A
These are commonly associated with widely used network services. Examples include 22, SSH 53, DNS80, http 443 https.
89:24
Speaker A
Registered ports 1,024 to 49,151. These are commonly associated with applications and services registered for particular uses. dynamic or private ports 49,152 to 65,535.
89:46
Speaker A
These are commonly used dynamically especially for temporary client side connections. There are important details and exceptions around how ports are assigned and used. So do not think of a port number as a permanent guarantee of a particular application. That point is
90:05
Speaker A
important for cyber security. For example, port 443 is commonly associated with HTTPS. But seeing port 443 does not prove that the service is actually HTTPS.
90:23
Speaker A
A service can be configured differently. Later in the course when we study network scanning and service discovery this distinction will become very important. Ports and IP addresses. Let's combine what we already know. Suppose we have 1 192.168.1.25 that identifies a device. Now 1
90:48
Speaker A
192.168.1.25 2 5 col 443 identifies a network endpoint involving that device and port 443.
91:00
Speaker A
We can visualize this as IP address which host port which network service. This gives us an important mental model.
91:10
Speaker A
M address identifies a device on the local network. IP address identifies a host at the network layer. port identifies a specific service or application endpoint. We will later connect these ideas to the OSI model and T CPIP model how it works. [snorts]
91:34
Speaker A
Now let's see what happens when a client connects to a service. Imagine your computer wants to communicate with a web server. The server has an IP address 203.013 0.113.10 and the web service is listening on port 443.
91:56
Speaker A
The destination can therefore be represented as 203.013.10 port 443. Your computer sends network traffic toward that destination. The IP address helps the network deliver the traffic to the correct host. The transport layer uses the destination port to identify
92:21
Speaker A
the service end point. There is also a source port. For example, a connection might conceptually look like this.
92:30
Speaker A
192.168.1.25 port 51544 to 203.0.13.10 port 443. Here 192.168.1.25 is the source IP address. 51544 is the source port. 203.013.10 is the destination IP address and 443 is the destination port. The source port can be dynamically selected by the
93:11
Speaker A
operating system. This allows multiple connections from the same computer to exist at the same time. This combination of IP addresses and ports is part of what allows the operating system to keep different network conversations separate.
93:29
Speaker A
What is a socket? You may also hear the word socket. At a beginner level, you can think of a socket as an end point used by an application for network communication.
93:42
Speaker A
For example, IP address plus port gives us an end point. When communication occurs, we also need to consider the transport protocol being used such as T, CP, or UDP.
93:57
Speaker A
A connection can therefore be described using information such as source, IP, source port destination IP destination, port, protocol. This combination helps the operating system distinguish one network flow from another. Do not worry about memorizing every detail yet. The important idea is
94:18
Speaker A
ports help the operating system and network stack distinguish different services and conversations. Protocols. Now let's introduce the second major concept in today's lesson. A protocol is a set of rules that defines how devices communicate. Think about two people
94:39
Speaker A
trying to communicate. If one person speaks English and the other person understands only another language, communication may fail. Computers have a similar problem. They need agreed upon rules. Those rules are defined by protocols. For example, HTTP defines rules for web communication. DNS defines
95:02
Speaker A
rules for domain name resolution. S SSH defines rules for secure remote terminal access. ICMP is used for network control and diagnostic messaging and protocols can operate at different layers of the networking stack. This is an important distinction. Port equals number
95:25
Speaker A
identifying a communication endpoint. Protocol equals rules governing how communication happens. They are related but they are not the same thing. Common port examples. Let's look at some common examples. Port 22 ssh stands for secure shell. It is commonly
95:46
Speaker A
used for secure remote access to systems. So you might see server.ample22. This commonly suggests an SSH service.
95:56
Speaker A
Port 53 DNS. Port 53 is commonly associated with DNS. DNS translates domain names into information such as IP addresses. We will study DNS in much greater depth in video 13. For now, simply remember 53. Commonly DNS port 80, HTTP port 80 is commonly associated
96:21
Speaker A
with HTTP. HTTP is used for web communication. We will study HTTP and HTTPS later in the course. Port 443 HTTPS.
96:35
Speaker A
Port 443 is commonly associated with HTTPS. HTTPS is HTTP protected using TLS. We will study this in detail later. for now. 443 commonly HTTPS.
96:57
Speaker A
Important cyber security note. Here is something very important. Do not think port 22 means SSH.
97:07
Speaker A
A better way to think is port 22 is commonly associated with SSH. Why? Because port numbers do not magically force an application to use a particular service. A system administrator can configure services differently. For example, an SSH server
97:26
Speaker A
can listen on another port. Similarly, another service could technically listen on port 22. Therefore, a port number does not guarantee the identity of a service. This distinction becomes extremely important later when we discuss network scanning and service discovery. A cyber security professional
97:50
Speaker A
does not simply look at a port number and blindly assume what is running. They gather evidence. Step four, visualize it. Let's put everything together.
98:02
Speaker A
Imagine a server with this address 1.0.0.10. The server might provide several services. We can represent them as 10.0.0.10 col22 10.0. 0.0.10 col 53 to10.0.010 col 810.0.010 col 443 same IP address different ports different services or service endpoints.
98:37
Speaker A
Now imagine a cyber security analyst examining this server. They might discover 228443 are reachable. That immediately gives them useful information about the network's exposed attack surface. But the analyst should not stop there. They need to determine what is actually
98:59
Speaker A
running. Is it expected? Is it securely configured? Is the software up to date? Should that service be exposed? This is where ports become much more than numbers. they become evidence about network exposure. Practical observation.
99:16
Speaker A
Now let's inspect ports directly on Linux. We can use SS- TULN. The SS command is used to inspect network sockets. Let's break down the options. - T show TCP sockets. Dash U show UDP sockets. Dash L show listening
99:35
Speaker A
sockets. Dash N show numerical addresses and port numbers. instead of trying to resolve names. So SS-TN roughly means show TCP and UDP listening sockets using numerical addresses and ports. You might see something conceptually similar to this. Your output may be completely different. That
100:00
Speaker A
is normal. Now let's understand what we are seeing. 0.0.0.0 0 col 22. This indicates a socket associated with port 22 on all IPv4.
100:16
Speaker A
Local addresses depending on the services binding configuration 0.0.0.0 col 80. This indicates port 80 is bound to all IPv4 local addresses. UDP entries UDP does not establish connections in the same way TCP does. So its displayed state can differ from TCP's listen. The
100:41
Speaker A
exact output depends on your operating system installed services configuration and whether you are running the command with sufficient privileges. Another useful command. We can also use s-tp.
100:57
Speaker A
The additional -p asks SS to show the process information associated with the socket when permitted. You may see information indicating which process owns a listening socket. The exact output will vary. This is useful because now we are moving from a port is open or
101:19
Speaker A
listening to which local process is associated with this socket. that is much more useful during system administration and security investigation. Cyber security connection. Now let's connect everything to cyber security. Ports are important because they help reveal a systems
101:39
Speaker A
network exposure. Imagine a server where you expect only a web service to be publicly accessible.
101:47
Speaker A
You expect something like 44 43 https, but an investigation reveals 22 ssh 80http 443 https 336 myql.
102:05
Speaker A
That does not automatically mean the system is compromised. But it raises important questions. Why is ssh exposed?
102:14
Speaker A
Why is HTTP exposed? Why is a database service exposed? Should these services be reachable from that network? Are they properly authenticated? Are they patched? Are firewall rules configured correctly? This is how a cyber security professional thinks. Do not treat every
102:34
Speaker A
open port as a vulnerability. An open port means a service or endpoint may be reachable. The security question is, is this exposure expected, necessary, and properly secured? Later in the course, video 33 will introduce network scanning concepts, and much later, video 47 will
102:58
Speaker A
cover port scanning and service discovery. At that point, everything you are learning now will become much more useful. You will understand why a scanner reports something like 22 / T CP 80/ T CP 443 /t CP and you will
103:20
Speaker A
understand that the numbers are not just random values. They represent communication endpoints that can reveal information about a system. Recap. Let's bring the lesson together. An IP address identifies a host at the network layer.
103:39
Speaker A
A port helps identify a network service or communication endpoint on that host. A protocol defines the rules used for communication. Common ports include 22 for SSH, 53 for DNS, 80 for HTTP, and 443 for HTTPS.
104:02
Speaker A
But port numbers do not guarantee which service is actually running. Linux tools such as SS allow us to observe listening sockets and investigate network services on our own systems. And most importantly, when you see 192.168.1.25 port 443, do not see it as one random string.
104:28
Speaker A
Break it down. 192.168.1.25 host 443 port. The port helps us move from which device to which service or endpoint. Now we know that different services can communicate through different ports. But there is another major question. If two devices
104:51
Speaker A
communicate, how exactly should that communication behave? Should the connection guarantee delivery? Should it establish a connection first? Should it prioritize speed? Should it retransmit loss data? Should it care about ordering? These questions lead us directly into the next lesson. Video 10,
105:12
Speaker A
TCP versus UDP. And this time we are going to look at two of the most important transport protocols in networking, TCP and UDP.
105:26
Speaker A
Imagine you are sending information across a network. You have already learned that an IP address helps identify the destination. You have also learned that a port helps identify the service you want to communicate with. But there is still an important question. How should
105:49
Speaker A
that data actually be transported? Should the network make sure every piece arrives? Should it make sure everything arrives in the correct order or should it simply send the data as quickly as possible and let the application handle the rest? This is where two of the most
106:09
Speaker A
important transport protocols come in TCP and UDP. They both move data between applications, but they do it very differently. And as a cyber security professional, understanding that difference is extremely important. In video 9, we learned about ports and
106:30
Speaker A
protocols. We saw that a port helps identify a particular service on a device. For example, port 443 commonly associated with HTTPS.
106:44
Speaker A
Port 22 commonly associated with SSH. But today we are going one layer deeper. We are going to understand two major transport layer protocols. TCP transmission control protocol and UDP user datagramgram protocol. We will learn what TCP is, what UDP is, why both
107:07
Speaker A
exist, how they communicate, the major differences between them, where we see them in real networks, how to observe them on Linux, and why cyber security professionals care about both the simple idea. Let's start with the simplest possible idea. Both TCP and UDP are used
107:27
Speaker A
to move data between applications across a network, but they have different priorities. TCP prioritizes reliable delivery. UDP prioritizes simplicity and low overhead. Think about sending something important through a delivery service. With TCP, imagine a delivery system that carefully tracks your
107:51
Speaker A
package. It wants to know did it arrive? Did something go missing? Did the packages arrive in the correct order? If something is missing, it can be sent again. UDP works differently. Imagine sending individual messages without creating that same tracking system. The
108:12
Speaker A
message is sent, but the protocol itself does not provide the same guarantees that TCP provides. That does not mean UDP is bad and it does not mean TCP is always better. They are designed for different requirements. The key idea is
108:32
Speaker A
TCP focuses on reliable communication. UDP focuses on lightweight communication with less protocol overhead. Now let's understand what that actually means technically. The real networking concept TCP transmission control protocol. TCP is a connectionoriented transport protocol. Before TCP normally transfers
108:59
Speaker A
application data, the two endpoints establish a connection. This is commonly associated with the TCP 3-way handshake.
109:08
Speaker A
We will study that handshake in much more detail later in video 30. For now, you only need the basic idea. The endpoints establish communication and then TCP can provide mechanisms such as sequencing acknowledgements retransmission, flow control, congestion control. This allows TCP to provide
109:31
Speaker A
reliable ordered delivery of a bite stream. Now let's look at UDP. UDP user datagramgram protocol. UDP is a connectionless transport protocol. It does not establish a TCP style connection before sending application data. UDP sends independent datagramgrams.
109:52
Speaker A
UDP does not provide TCP's built-in guarantees for reliable delivery, ordered delivery, retransmission. This makes UDP much simpler and because it has less protocol overhead, applications can use it when they prefer speed, low latency or direct control over how communication is handled. So
110:15
Speaker A
remember, TCP gives applications a reliable ordered byte stream. UDP gives applications a lightweight datagramgrambased transport. how TCP and UDP work. Now let's follow the communication process. Suppose a client wants to communicate with a server. The destination has an IP address. And as we
110:41
Speaker A
learned in video 9, the application is associated with a port, but TCP and UDP handle the transport differently. TCP.
110:51
Speaker A
With TCP, the communication begins by establishing a connection. The client sends a s yn. The server responds with a sy- the client responds with an AC. This establishes the TCP connection. Again, we will study this process deeply in
111:11
Speaker A
video 30. After the connection is established, data can flow. TCP keeps track of the data using sequence numbers and acknowledgements. If data is lost, TCP can retransmit it. If data arrives out of order, TCP can use sequence information to reconstruct the correct
111:32
Speaker A
byte stream for the application. UDP UDP does not perform that TCP style connection establishment. The application gives data to UDP. UDP places that data into a datagramgram.
111:49
Speaker A
The datagramgram is sent toward the destination. There is no TCP style handshake. There is no built-in TCP style retransmission mechanism. There is no guarantee from UDP itself that every datagramgram will arrive and there is no guarantee from UDP itself that
112:09
Speaker A
datagramgrams will arrive in the same order they were sent. That can sound like a weakness, but sometimes it is exactly what an application wants. For example, imagine a live voice conversation.
112:24
Speaker A
If one small piece of audio is lost, waiting too long to retransmit that old piece may be worse than simply continuing with the conversation. The application may prefer low delay over perfect delivery. This is one reason UDP can be useful. Visualize the difference.
112:45
Speaker A
Let's put TCP and UDP side by side. TCP connection oriented reliable delivery, ordered by bite stream, acknowledgements retransmission flow control, congestion control, TCP carries more protocol mechanisms because it is responsible for providing those guarantees.
113:07
Speaker A
UDP connectionless, datagramgram based, no built-in reliable delivery, no built-in ordering guarantee, no TCP style handshake, lower protocol overhead. This does not mean UDP automatically has lower latency in every situation. And it does not mean TCP is always slow. Real world performance
113:30
Speaker A
depends on the network, application, congestion, implementation and many other factors. The important difference is the services provided by the transport protocol. Now let's look at where these protocols appear in the real world. Common TCP examples. TCP is commonly used by applications that need
113:52
Speaker A
reliable communication. Examples include https and many other application protocols. Common UDP examples. UDP is commonly used when applications can benefit from lightweight datagramgrams and may handle timing loss or reliability at the application level. Examples include DNS, DH CPNTP
114:20
Speaker A
real-time voice and video applications and other protocols and applications. Modern protocols such as quick are also built on UDP while implementing reliability and other transport features above UDP. That is an important lesson.
114:38
Speaker A
UDP itself does not provide TCP's reliability mechanisms but an application or higher level protocol can build additional mechanisms on top of UDP. Practical observation on Linux. Now let's see TCP and UDP on a real Linux system. We are not going to attack
114:59
Speaker A
anything. We are simply observing our own machine's network sockets. The tool we will use is SS. SS is a Linux utility used to inspect sockets and network connections. This is useful because a socket can show us information about
115:17
Speaker A
communication endpoints including whether TCP or UDP is being used. First run SS- TULN. Now let's break down the options. - T means show TCP sockets. - U means show UDP sockets, dash L means show listening sockets and -ash N means
115:40
Speaker A
show addresses and port numbers numerically instead of trying to resolve names. You may see outputs similar to this. Your actual output will depend on your Linux system. [clears throat] The important part is the first column. TCP means the socket is using TCP. UDP means
116:00
Speaker A
the socket is using UDP. Now look at the port for example TCP. Listen 0.0.0.0 col2.
116:10
Speaker A
The 22 is the port. You already learned about ports in video 9. So we are now connecting the concepts together. IP address identifies the host port identifies the service endpoint. TCP or UDP identifies the transport protocol being used. We can also inspect TCP
116:33
Speaker A
sockets specifically SS-TN and UDP sockets specifically SS- notice what we are doing here. We are not just running commands. We are using the operating system to observe networking concepts that we have been learning theoretically. That is exactly how networking knowledge becomes
116:55
Speaker A
practical. Cyber security connection. Now let's connect TCP and UDP to cyber security. This difference matters because security professionals constantly analyze network communication.
117:11
Speaker A
Imagine you are investigating a server. You discover that it has several listening services. The protocol matters. A TCP service behaves differently from a UDP service. The traffic patterns are different. The connection behavior is different and the security controls may need to account
117:33
Speaker A
for those differences. For example, when analyzing TCP traffic, a security professional may examine SY N- A C KR SF I N. These TCP flags can help reveal connection behavior. Later in the course when we study TCP handshakes, Wireshark
117:56
Speaker A
network scanning firewalls, packet analysis, and network attacks, your understanding of TCP and UDP will become extremely important. UDP also matters. A security analyst may encounter UDP traffic associated with services such as DNS DHCP or other applications. Unexpected UDP
118:20
Speaker A
traffic can become an investigation point depending on the environment. And this is where networking becomes cyber security. A security professional does not simply ask what IP address is this.
118:34
Speaker A
They may also ask what port is being used, which transport protocol is being used, what kind of traffic is flowing, is this behavior expected? Does the traffic match the service? Is anything unusual happening? This is why learning TCP and UDP is not just about passing a
118:58
Speaker A
networking exam. It gives you another piece of the mental model you will use when analyzing real network traffic.
119:06
Speaker A
Recap. Before we finish, remember these key ideas. First, TCP and UDP are transport layer protocols. Second, TCP is connectionoriented and provides reliable ordered delivery mechanisms.
119:23
Speaker A
Third, UDP is connectionless and provides lightweight datagramgram based communication without TCPs built-in reliability and ordering guarantees.
119:34
Speaker A
Fourth, TCP and UDP are both useful. Neither is simply better. Fifth, as a cyber security professional, understanding the transport protocol helps you interpret network connections, services, traffic, and suspicious behavior. TCP connection oriented, reliable ordered uses acknowledgements supports retransmission, and has more protocol
120:00
Speaker A
overhead. UDP connectionless, datagramgram based, no built-in reliability, no built-in ordering, lightweight, and has less protocol overhead. And remember the bigger picture. In video six, we learned about IP addresses. In video 7, we learned about public and private IP addresses.
120:23
Speaker A
In video 8, we learned about subnet masks and CIR. In video 9, we learned about ports and protocols. And now we have added another important piece T CP and UDP.
120:39
Speaker A
We are slowly building a complete communication model. But there is still a problem. We have talked about applications. We have talked about IP addresses. We have talked about ports.
120:51
Speaker A
We have talked about TCP and UDP. But when data actually travels through a network, how do all these different pieces fit together? How does data move through the different layers of networking? And why do networking professionals use a model with seven
121:11
Speaker A
layers to understand communication? That's what we will explore in the next video. The OSI model.
121:24
Speaker A
When you open a website, something much more complicated happens than simply typing a URL and pressing enter. Your computer has to communicate with another system. Data has to move through different networking functions.
121:41
Speaker A
Addresses have to be used. A connection may need to be established. Data has to be transported and eventually the information has to reach an application such as a web browser. But how do we organize all of these different
121:58
Speaker A
responsibilities? This is where the OSI model comes in. The OSI model gives us a way to break network communication into seven different layers. And once you understand these layers, troubleshooting and cyber security become much easier.
122:16
Speaker A
Welcome back. So far in this course, we have built several important pieces of the networking puzzle. We learned what networks are. We learned about different network types and topologies.
122:29
Speaker A
We learned about network devices. We learned how MAC addresses identify devices on a local network. We learned about IPv4 and IPv6.
122:40
Speaker A
We learned about public and private IP addresses. We learned about subnet MASKS and CID.
122:49
Speaker A
We also learned about ports and protocols. And in the previous lesson, we compared TCP and UDP. Now, we are going to step back and organize many of these concepts into one structured model. That model is called the OSI
123:06
Speaker A
model. OSI stands for open systems interconnection. It is not a device. It is not a protocol and it is not something your computer has to turn on.
123:18
Speaker A
It is a conceptual framework that helps us understand how network communication is organized. What you will learn in this lesson. You will learn what the OSI model is, why it was created, the seven OSI layers, what each layer is
123:36
Speaker A
responsible for, how data moves through the layers, examples of technologies associated with different layers, how the OSI model helps with troubleshooting, why cyber security professionals care about the OSI model, and most importantly, you will learn how to look at network communication. ation
123:58
Speaker A
as a complete process instead of a collection of unrelated terms. The simple idea. Imagine you want to send a package to someone in another city. Many different things have to happen. First, you need to know what you are sending.
124:15
Speaker A
Then the package needs to be prepared. It needs an address. A transportation method needs to be selected. The package may pass through multiple locations.
124:26
Speaker A
Eventually, it reaches the destination. You could describe the entire delivery process as one giant operation, but that would make it difficult to understand.
124:38
Speaker A
Instead, we can divide the process into different responsibilities. Networking works in a similar way. When two devices communicate, different networking functions are responsible for different parts of the process. The OSI model organizes those responsibilities into seven layers. The seven layers are
125:01
Speaker A
layer 7 application, layer six presentation, layer five session, layer four transport, layer three network, layer two data link, layer 1 physical. A useful way to remember the order from top to bottom is application, presentation session transport network, data, link, physical. You may
125:27
Speaker A
see the abbreviation A S N DP, but don't worry too much about memorizing a pneummonic. Understanding what each layer does is much more important. The real networking concept. Now, let's examine the seven layers. The important idea is this. Each layer has a specific
125:48
Speaker A
responsibility. The layers work together. They are not seven completely separate networks. They are different ways of organizing the functions involved in communication. Let's start at the bottom and work our way upward.
126:04
Speaker A
Layer one, physical. The physical layer is layer 1. This is the lowest layer of the OSI model. It deals with the actual transmission of bits through a physical or radio medium. Think about Ethernet cables, fiber optic cables, radio
126:23
Speaker A
signals, electrical signals, physical connectors, network interfaces, wireless transmission. At this level, we are concerned with how raw bits are represented and transmitted. For example, a computer ultimately sends information as bits. Those bits must somehow travel from one place to
126:46
Speaker A
another. That could happen through electrical signals in copper. It could happen through pulses of light in fiber or it could happen through radio waves in a wireless network. The physical layer does not understand a website. It does not understand usernames. It does
127:04
Speaker A
not understand HTTP. It simply deals with the physical transmission of bits. Layer two, data link. Above the physical layer is layer 2, data link. This layer is concerned with communication across a local network. This is where our previous
127:24
Speaker A
lesson about MAC addresses becomes useful. Remember that a MAC address is associated with a network interface and is used for communication on the local network. Layer 2 deals with concepts such as frames, MAC addresses, local network delivery, Ethernet switching. A
127:46
Speaker A
frame is a layer 2 data unit. We will study packets and frames in much greater detail later in the course. For now, the important idea is layer 2 helps move data across a local network. This is also where switches become especially
128:04
Speaker A
relevant. A network switch primarily operates at layer 2. It examines information such as destination MAC addresses and uses that information to forward Ethernet frames through the appropriate port. So when you see MAC address to Ethernet to frame to switch,
128:25
Speaker A
you should immediately think data link layer. Layer three network. Now we reach layer three network. This is where IP addressing becomes important. We already learned about IPv4 and IPv6.
128:42
Speaker A
Now we can place that knowledge into the OSI model. The network layer is responsible for things such as logical addressing, IP routting, moving packets between networks. This is also where routters become especially important.
128:59
Speaker A
Remember our earlier idea of a router as a device that helps move traffic between networks. A router operates primarily at layer 3. Suppose your computer has 1 192.168.1.10 and the destination is on another network. The router can examine the
129:21
Speaker A
destination IP address and make a forwarding decision. This is different from layer 2. Layer 2 focuses on local delivery using technologies such as Ethernet and MAC addresses. Layer 3 focuses on logical addressing and moving traffic between networks using IP. So
129:42
Speaker A
remember MAC, layer 2 IP, layer 3. Layer 4 transport. Now we reach layer 4 transport. This is where our previous lesson about TCP and UDP becomes directly useful.
129:58
Speaker A
The transport layer is responsible for end-to-end transport functions such as TCP, UDP, segmentation, and reassembly reliability mechanisms in protocols such as TCP flow control port numbers. We already learned that TCP and UDP have different characteristics. TCP provides mechanisms for reliable ordered
130:23
Speaker A
communication. UDP is lightweight and does not provide TCP's built-in reliability and ordering mechanisms. Now we can place them into the larger picture. This is also where the ports we learned earlier become useful. A port helps identify a particular service or application
130:45
Speaker A
endpoint on a device. For example, 443 HTTPS 53DNS. The exact protocol behavior can involve other layers too. But ports are fundamentally associated with the transport layer. So when you hear TCP UDP port, think layer four transport.
131:09
Speaker A
Layer five session. Next is layer five session. The session layer is concerned with establishing, managing, and ending communication sessions between applications. The idea of a session is simple. Imagine two applications communicating.
131:27
Speaker A
There may be a need to establish a logical conversation, keep track of it, and eventually terminate it. The session layer provides a conceptual place for these responsibilities.
131:40
Speaker A
However, there is an important detail. Modern networking protocols do not always map neatly to one OSI layer. Many real world protocols combine responsibilities that the OSI model describes separately. So don't assume that every modern protocol has one perfect OSI layer box. The OSI model is
132:04
Speaker A
primarily a framework for understanding networking functions. For beginners, the key idea is layer 5 helps organize communication sessions between applications. Layer six, presentation.
132:19
Speaker A
Above the session layer is layer six, presentation. This layer focuses on how data is represented. That can include concepts such as data formatting, encoding, character representation serialization encryption and decryption concepts.
132:40
Speaker A
Think about the difference between the information itself and the way that information is represented.
132:46
Speaker A
two systems may need to agree on how data should be represented so that the receiving system can correctly interpret it. The presentation layer is therefore concerned with making sure data can be represented and interpreted appropriately between systems. Again, in
133:06
Speaker A
modern networking, these responsibilities may be implemented by protocols or applications that do not fit perfectly into one OSI layer. The model is a conceptual tool. Layer 7, application. Finally, we reach layer 7, application. This is the layer closest
133:25
Speaker A
to the applications that users interact with. Examples include network services and protocols such as http htps dn ss ss m tpftp.
133:41
Speaker A
When you open a website, your browser is using application layer protocols to communicate with a web server. This does not mean that the browser itself is simply layer 7. Rather application layer protocols provide network functionality to applications and this is an important distinction.
134:01
Speaker A
The OSI model describes networking functions. It does not mean that every physical component or software application belongs exclusively to exactly one layer. How the layers work together. Now that we understand the seven layers individually, let's put them together. Imagine that you open a
134:24
Speaker A
website. Your browser needs to communicate with a remote server. At the top, the application needs to create or process the information. That information moves down through the networking stack. Different layers add their own information or perform their own functions.
134:44
Speaker A
Eventually, the information reaches the physical layer and is transmitted across the network. At the destination, the process happens in the opposite direction. The received information moves upward through the layers until the destination application can use it.
135:02
Speaker A
This gives us a powerful concept, encapsulation and decapsulation. We will study these concepts properly later in video 19. For now, you only need the basic idea. As data moves down the networking stack, each layer can add information relevant to its
135:23
Speaker A
responsibility. At the destination, that information is processed as the data moves back upward. So, communication can be visualized like this. Starting at the application layer, then moving down to the presentation layer, then the session layer, then the transport layer, then the network layer,
135:46
Speaker A
then the data link layer, and finally the physical layer. The data then travels across the network. At the destination, it moves back upward from the physical layer to the data link layer to the network layer to the transport layer to the session layer to
136:06
Speaker A
the presentation layer and finally to the application layer. Visualize it. Let's create one complete mental picture. Imagine this simple network.
136:17
Speaker A
your computer to a switch to a router to the internet and finally to a web server. Now connect the layers to what we already know. At layer 1, bits travel through a physical or wireless medium.
136:32
Speaker A
At layer 2, local delivery uses technology such as Ethernet and MAC addresses. At layer 3, IP addresses identify logical destinations and routers help move packets between networks. At layer 4, TCP or UDP provides transport functions and ports help identify services. At layers 5
136:57
Speaker A
through 7, we deal with higher level communication functions including sessions, data representation, and application protocols. This is why the OSI model is so useful. Instead of seeing networking as one giant complicated process, we can divide it into smaller responsibilities.
137:18
Speaker A
Practical observation. The OSI model itself is conceptual. So we should not force a fake terminal demonstration just to say we use Linux.
137:30
Speaker A
Instead, we can make a simple observation using information we already know from previous lessons. For example, on a Linux system, we can run ip add to this command displays information about the systems network interfaces and IP addresses. Now let's interpret what we
137:51
Speaker A
are seeing. The IP address shown here belongs to the network layer concept we discussed earlier. We are not saying that the IP command itself is the OSI model. We are simply using the command to observe a real networking concept
138:07
Speaker A
that maps naturally to layer 3. We can also use ss-tn. This shows listening TCP and UDP sockets and their associated local ports. This gives us another real world observation.
138:23
Speaker A
TCP and UDP are associated with the transport layer and the port numbers help identify service endpoints. So even though the OSI model is conceptual, we can use real Linux networking information to connect the model to an actual system. The goal is not to force
138:43
Speaker A
every command into one layer. The goal is to understand what the system is actually doing. Cyber security connection. Now we reach the most important question for this course. Why should a cyber security professional care about the OSI model? Because
139:03
Speaker A
security problems happen at different layers. Consider a few examples. At layer 2, you may investigate suspicious MAC address behavior, ARP related activity or unusual local network traffic. At layer three, you may investigate IP addresses, routting behavior, or suspicious traffic between
139:27
Speaker A
networks. At layer 4, you may investigate unexpected ports, TCP connections, UDP traffic, or unusual connection patterns. At higher layers, you may investigate protocols such as HTTP, HTTPS, DNS, or other application traffic. This gives security professionals an important habit. Don't just ask what is
139:53
Speaker A
wrong. Ask at which layer is the problem happening. For example, a device cannot communicate with anything. Is the cable disconnected that points toward a lower layer problem. Is the local Ethernet connection working? That takes us toward layer two. Is the IP configuration
140:15
Speaker A
incorrect? Now layer 3 becomes important. Is the destination port reachable? Now layer 4 becomes relevant.
140:25
Speaker A
Is the application service actually responding? Now we may need to investigate higher layers. This layered thinking makes troubleshooting much more systematic. And later in this course when we begin analyzing packets, traffic, attacks, and security events, the OSI model will give you a framework
140:46
Speaker A
for understanding what you are seeing. A very important point. The OSI model is not the internet. There is one common mistake beginners make. They learn the seven layers and assume that real world networking always follows the OSI model
141:05
Speaker A
exactly. It doesn't. The OSI model is a reference model. It was designed to provide a structured way of thinking about network communication.
141:17
Speaker A
Real world networking protocols often combine responsibilities from multiple OSI layers. So don't try to force every protocol, device or technology into a perfect seven layer box. Use the model as a tool for understanding. That is what makes it valuable. Quick OSI model
141:39
Speaker A
summary. Let's bring everything together. Layer 7 application network services and application protocols. Examples HTTP, HTTPS, DNS, SMTP. Layer six, presentation, data representation formatting encoding and related transformations. Layer five, session, managing communication sessions between applications. Layer four, transport, end-to-end transport
142:06
Speaker A
functions. Examples, TCP, UDP, ports. Layer three, network, logical addressing, and routing. Examples: IP routers. Layer two, data link, local network communication. Examples: Ethernet, MAC addresses, frames, switches. Layer one, physical, transmission of bits through physical or wireless media. Examples: cables, fiber,
142:35
Speaker A
radio signals. Here is the mental model I want you to keep. When you investigate network behavior, think from the bottom upward. Layer one, can the systems physically or wirelessly communicate?
142:49
Speaker A
Layer two, can they communicate on the local network? Layer three, can traffic reach the correct network and IP destination? Layer four, is the required transport protocol and port working?
143:05
Speaker A
Layers 5 to 7 is the higher level communication and application behavior working correctly. This does not mean every investigation must always follow exactly this order.
143:19
Speaker A
It means you now have a structured way to reason about the problem. Recap. Before we finish, remember these five points. Number one, the OSI model is a conceptual framework for understanding network communication.
143:35
Speaker A
Number two, it contains seven layers. Application presentation session transport, network, data link, and physical. Number three, layer four is where TCP, UDP, and ports fit. Layer three is where IP and routting fit.
143:54
Speaker A
Layer two is where technologies such as Ethernet and MAC addressing fit. Layer 1 deals with the actual transmission of bits. Number four, the OSI model helps us break a complicated networking problem into smaller responsibilities.
144:12
Speaker A
And number five, for cyber security, this layered thinking helps us understand where suspicious behavior, communication failures, and security problems may occur. So now we have a seven layer model for understanding network communication. But there is still an important question. If the OSI
144:35
Speaker A
model has seven layers, how do realworld internet protocols actually fit together? Because the internet does not simply operate as a perfect seven layer OSI stack. There is another model that is extremely important in practical networking. That's video 12, the TCPIP
144:59
Speaker A
model. You have already learned the OSI model. Seven layers application, presentation, session, transport, network, data link, physical. But there is an important question. If the OSI model has seven layers, is that exactly how modern networks are organized? Not quite. When
145:26
Speaker A
you work with real operating systems, real protocols, and real internet communication, you will often encounter another model, the TCPIP model. The TCPIP model gives us a simpler way to understand how the protocols behind modern network communication work together. And for cyber security, this
145:50
Speaker A
is especially useful because many of the technologies you will eventually analyze such as HTTP, TCP, IP, and Ethernet fit naturally into this model. So let's start with the basic idea. Imagine your computer wants to communicate with a web server.
146:10
Speaker A
Several things need to happen. An application needs to create the communication. A transport protocol needs to handle the communication.
146:21
Speaker A
IP needs to help move the data toward its destination and the local network needs to physically or wirelessly carry the data. Instead of treating all of this as one giant process, networking can be divided into layers. Each layer
146:39
Speaker A
has a different responsibility. The TCPIP model is commonly represented using four layers. Application, transport, internet, network access. The important idea is simple. Different layers handle different parts of network communication. The real networking concept. Now let's look at what each
147:02
Speaker A
layer actually means. Application layer. The top layer is the application layer. This is where application level network protocols operate. Examples include http htpsd n ss ss s h smtp.
147:22
Speaker A
The application layer is not simply the browser. It represents the protocols and services that allow applications to communicate over a network. Transport layer. Below it is the transport layer.
147:34
Speaker A
This is where you find the two protocols you learned in video 10. TCP and UDP.
147:42
Speaker A
TCP provides mechanisms for reliable ordered communication. UDP provides a simpler connectionless transport mechanism with less overhead.
147:52
Speaker A
The transport layer also uses port numbers. For example, HTTPS commonly uses TCP port 443.
148:02
Speaker A
DNS commonly uses UDP port 53 for many queries. So the ports you learned about in video 9 and the TCP/ UDP concepts from video 10 now have a place in the model internet layer. Next is the internet layer. This is where IP
148:22
Speaker A
operates. You already learned about IPv4 and IPv6 in video 6. The internet layer deals with logical addressing and moving packets between networks. This is closely connected to what routters do. A router examines IP information and makes forwarding decisions to move packets
148:45
Speaker A
toward their destination. Network access layer. Finally, we have the network access layer. This layer deals with communication across the local network.
148:57
Speaker A
It includes technologies and concepts such as Ethernet, Wi-Fi, MAC addresses, frames, and the physical transmission of data. This connects directly to video 5 where you learned about MAC addresses.
149:12
Speaker A
So, the four layers give us a simple mental model. Application, transport, internet, and network access. Step three, how it works. Now, let's connect these layers together. Imagine that you open a secure website. Your browser needs to communicate with a web server.
149:34
Speaker A
At the application layer, the communication uses an application protocol such as HTTPS. At the transport layer, the communication may use TCP.
149:46
Speaker A
TCP uses source and destination port numbers. At the internet layer, IP provides logical addressing and helps move the packet toward the destination.
149:58
Speaker A
At the network access layer, Ethernet or Wi-Fi carries the data across the local network. The layers work together. They are not four separate systems that operate independently. Each layer provides functionality that supports the layer above it. This also introduces an
150:16
Speaker A
important concept called encapsulation. For example, application data can be passed to TCP. TCP adds transport information. IP then adds IP information. The local network technology then prepares the information for transmission. At the destination, the receiving system processes the
150:39
Speaker A
information through the layers until the application receives the data. You will study encapsulation properly later in the course. For now, remember each layer processes information according to its responsibility. Visualize the TCP IP model. Now, let's compare the TCP IP
151:01
Speaker A
model with the OSI model. You learned in video 11. The OSI model has seven layers. The TCP/IP model is commonly represented with four. OSI model, application presentation session transport, network, data link, physical, TCPIP model, application, transport, internet, network access. The mapping is
151:27
Speaker A
approximately OSI application presentation and session layers map to the TCPIP application layer. OSI transport maps to the TCPIP transport layer. OSI network maps to the TCP IP internet layer. OSI data link and physical layers map to the TCP IP
151:50
Speaker A
network access layer. Notice that the two models are describing the same general communication process from different perspectives. You do not need to ask which model is correct. Instead, think which model helps me understand the problem. The OSI model is very
152:08
Speaker A
useful for learning, troubleshooting, and discussing network layers. The TCPIP model gives us a practical framework closely connected to the protocols used in real internet communication.
152:23
Speaker A
As a cyber security professional, you should understand both the big picture and what comes next. Let's put everything together. The TCP IP model gives us four main layers. Application network applications and application protocols such as HTTP, HTTPS and DNS.
152:45
Speaker A
Transport TCP, UDP and port numbers. Internet IP addressing and packet forwarding between networks. Network access Ethernet, Wi-Fi, MAC addresses, frames, and local network transmission.
153:00
Speaker A
You have now completed level one, networking foundations. Think about how far you've come. You started by learning what a network is. Then you learned network types and topologies. You learned about routters, switches, hubs, and access points. You learned MAC
153:20
Speaker A
addresses. You learned IPv4 and IPv6. You learned public and private IP addresses. You learned subnet masks and CID.
153:30
Speaker A
You learned ports and protocols. You learned TCP and UDP. You learned the OSI model. And now you understand the TCPIP model. These concepts are no longer isolated topics. They are beginning to form one complete mental model of networking. Think of the progression
153:50
Speaker A
like this. network devices, MAC addresses, IP addresses, subnets, ports, TCP and UDP, OSI and TCP IP. And this is where the course changes direction. So far we have focused mainly on the building blocks. Now we are going to use
154:11
Speaker A
those building blocks to understand what actually happens when devices communicate across the internet. Imagine typing example.com into your browser.
154:23
Speaker A
Your computer cannot simply send an internet packet to that name. It needs to discover the IP address associated with the domain name. So how does that happen? That is where level two, how the internet actually works, begins. In
154:41
Speaker A
video 13, we will start with one of the most important systems on the internet, DNS, the domain name system. You will learn how a domain name such as example.com can be translated into an IP address before communication with the
154:59
Speaker A
destination begins. And from there, we will start following the actual journey of network communication.
155:07
Speaker A
I'll see you in video 13. Every day, millions of people type names like google.com, youtube.com, facebook.com into their browsers. But here is something important. The internet does not communicate using names like these. Networks communicate using IP addresses. So when you type
155:31
Speaker A
google.com, your computer cannot simply send a packet to the word Google. It needs an IP address. But where does that IP address come from? How does your computer know which server belongs to a domain name? And how can a simple name
155:50
Speaker A
typed into a browser become the beginning of a real network connection. The answer is DNS, the domain name system. And this is where level two begins. So far you have learned the building blocks of networking. you understand IP addresses,
156:09
Speaker A
ports, protocols, TCP and UDP, the OSI model and the TCPIP model. Now, we are going to start using those concepts to understand what actually happens when devices communicate across networks and across the internet. Because before your browser can connect to a website, it
156:31
Speaker A
usually needs to answer one important question. What is the IP address of this domain? Welcome to video 13. This is the beginning of level two. How the internet actually works. In level one, we built the foundation.
156:48
Speaker A
Now we are going to follow the actual communication process and DNS is the perfect place to begin. You already know that an IP address is used to identify a device or network destination. But humans are much better at remembering
157:05
Speaker A
names than long IP addresses. For example, which one is easier to remember? 142.25 o or google.com.
157:17
Speaker A
Clearly, the domain name is easier. But computers still need IP addresses to know where network traffic should go.
157:25
Speaker A
DNS connects these two worlds, human readable names and machine usable IP addresses. By the end of this lesson, you should understand what DNS is, why DNS exists, how a domain name becomes an IP address, the role of DNS servers, the
157:45
Speaker A
difference between recursive resolvers and authoritative DNS servers, how DNS caching works, how to observe DNS using Linux, and why DNS is extremely important in cyber security. The simple idea. Let's begin with the simplest possible explanation. DNS is like the
158:06
Speaker A
internet's phone book. Imagine you want to call someone. You know their name, but the phone system needs their phone number. So, you search for the person's name and find the number. DNS works in a similar way. Humans use names such as
158:23
Speaker A
google.com youtube.com github.com but computers need IP addresses. So DNS helps translate a domain name into an IP address. For example, example.com DNS93.184.216.34.
158:42
Speaker A
This process is called DNS resolution. DNS resolution simply means finding the IP address associated with a domain name. Without DNS, people would need to remember IP addresses for websites and online services. Imagine trying to remember hundreds or thousands
159:02
Speaker A
of IP addresses. Instead of typing YouTube.com, you would need to know the numerical IP address of the server. That would be extremely difficult. DNS makes the internet easier for humans to use.
159:19
Speaker A
But technically DNS does much more than simply translate names into IP addresses. It is a distributed system containing information about domains across the internet. And understanding how that system works is essential for networking and cyber security. The real
159:39
Speaker A
networking concept DNS stands for domain name system. The domain name system is a distributed system used to translate domain names into IP addresses and provide other information about internet domains. Let's connect this to what you already learned. Remember video six, you
160:02
Speaker A
learned that IP addresses are used for network communication. And in video 9, you learned about ports and protocols.
160:11
Speaker A
DNS is an application layer protocol. In the TCP IP model, DNS belongs to the application layer. DNS commonly uses port 53 and DNS queries often use UDP, although DNS can also use TCP in certain situations.
160:31
Speaker A
You already know what these concepts mean. Now you are seeing how they work together in a real internet process.
160:40
Speaker A
This is exactly why level one was necessary. You are no longer learning these concepts separately. Now they are starting to work together. Let's look at a simple example. You type example.com.
160:54
Speaker A
Your computer needs to find an IP address. So it sends a DNS query. A DNS server responds with the information needed to locate the destination. Then your computer can begin communicating with that destination.
161:12
Speaker A
But this process can involve several different DNS servers and that is where DNS becomes more interesting. How DNS resolution works. Let's follow the journey step by step. Imagine you type example.com into your browser. Your computer needs to find the IP address. The first place
161:35
Speaker A
it may look is its local cache. A cache is stored information that can be reused later. If your computer recently visited the same website, it may already know the IP address. In that case, it may not need to perform a complete DNS lookup.
161:54
Speaker A
But what happens if the information is not available locally? Your computer sends a DNS request to a DNS resolver.
162:04
Speaker A
This is often called a recursive DNS resolver. A recursive resolver is responsible for finding the answer on behalf of the client. The resolver may be provided by your internet service provider, your organization, a public DNS service or another
162:23
Speaker A
configured DNS service. Now imagine the recursive resolver does not already have the answer cached. It may need to search through the DNS hierarchy. The DNS system is organized in a hierarchy. The resolver may communicate with root DNS servers, then top level domain servers,
162:45
Speaker A
then authoritative DNS servers. Let's understand what each one does. Root DNS servers. At the top of the DNS hierarchy are the root DNS servers. They do not normally provide the final IP address for every website. Instead, they help
163:05
Speaker A
direct the resolver toward the correct part of the DNS hierarchy. For example, if the domain ends with com, the root system can point the resolver toward the DNS servers responsible for the com top level domain. Tople domain servers. The
163:24
Speaker A
next part is the top level domain or TLD. Examples include com.org.net.edu. The TLD servers help direct the resolver toward the authoritative DNS servers for a specific domain. For example, example.com.
163:43
Speaker A
The dot DNS infrastructure can help identify which authoritative DNS servers hold information about example.com.
163:54
Speaker A
Authoritative DNS servers. Finally, the resolver reaches an authoritative DNS server. This server holds the official DNS information for the domain. It can provide the DNS record containing the answer. For example, example.com IP address. The recursive resolver receives the answer. It may store the
164:19
Speaker A
result temporarily in its cache. Then it returns the IP address to your computer. Then the result travels back authoritative server recursive resolver.
164:32
Speaker A
Your computer browser. Now the browser knows the IP address and communication with the destination can begin. This is one of the most important transitions in the entire course. A human readable name has now become a network destination.
164:49
Speaker A
Visualize DNS records and caching. DNS does not only store one type of information. DNS uses different types of records. You do not need to memorize every record right now, but you should understand some important examples. A record. An A record maps a domain name
165:11
Speaker A
to an IPv4 address. Example example.com 93.184.216. 216.34 AAA record. An AAA record maps a domain name to an IPv6 address. This connects directly to what you learned in video 6 about IPv6.
165:32
Speaker A
MX record. An MX record is used to provide information about mail servers. NS record. An NS record identifies the authoritative name servers associated with a domain. Again, the important idea is that DNS is more than a simple phone
165:51
Speaker A
book. It is a distributed information system for internet domains. Now, let's talk about caching. Imagine millions of users visiting the same website. It would be inefficient if every DNS request had to start from the root of the DNS hierarchy. That is why caching
166:11
Speaker A
is important. When a recursive resolver receives a DNS answer, it can temporarily store that information.
166:20
Speaker A
The next user asking for the same domain may receive the answer much faster. DNS records often contain something called TTL, time to live. TTL tells systems how long DNS information may be cached before it should be refreshed. For
166:39
Speaker A
example, if a DNS record has a TTL of 300 seconds, the information may be cached for approximately 5 minutes.
166:48
Speaker A
After that period, a new lookup may be required. Caching improves speed efficiency and reduces unnecessary DNS traffic. But caching can also become important in cyber security because if DNS information is manipulated or incorrect, systems may receive the wrong
167:09
Speaker A
destination information. We will explore DNS security attacks later in this course. For now, understand the normal process first. Correct domain, correct DNS answer, correct destination. Step five, practical DNS observation on Linux. Now let's observe DNS on a real Linux
167:34
Speaker A
system. We are going to use a tool called DIG. The name stands for domain information groper. It is a command line utility used to query DNS servers and inspect DNS information. If DIG is not installed on your system, you may need
167:52
Speaker A
to install the package that provides it. On many DBNbased systems, it is available through the dnutils package.
167:59
Speaker A
Now run digg google.com. This command asks DNS for information about google.com. You may see output similar to this. Let's break this down.
168:11
Speaker A
Google.com. This is the domain being queried. 66. This is the TT TL value. It indicates how long the result may be cached. I N. This refers to the internet class A. This is the DNS record type. An A record maps a domain
168:30
Speaker A
name to an I PV4 address. And finally 142.2501.138. This is the IPv4 address returned by DNS. Now let's specifically request an IPv6 record. run dig a aample.com.
168:53
Speaker A
This asks for an a aaa record. Remember a aaa records are used for IPv6 addresses. This connects directly to your earlier knowledge of IPv4 and IPv6.
169:06
Speaker A
Now let's inspect the DNS servers configured on your Linux system. You can try resolve ctl status. On many modern Linux systems, this displays DNS configuration information. Depending on your system, you may see network interfaces, configured DNS servers, search domains, other resolver
169:29
Speaker A
information. Your output may be different depending on your Linux distribution and network configuration. The important thing is to identify which DNS server your system is using. Now think about what you just observed. When you visit a domain, your computer needs
169:49
Speaker A
a DNS server to help resolve that name. Your system has DNS configuration. The DNS server receives or forwards queries and eventually DNS information is returned. You can also compare answers from different DNS resolvers.
170:08
Speaker A
For example, dig at 8.8.8.8. google.com. The at 8.8.8.8 part tells DIG to send the query to that specific DNS server instead of using the default resolver. And google.com is the domain we are querying. This is useful because it shows that DNS queries can be
170:34
Speaker A
sent to different resolvers. However, the exact answer and behavior can sometimes vary depending on caching configuration or the DNS infrastructure being used. The practical lesson here is simple. DNS is not an abstract concept.
170:53
Speaker A
It is an active network service that your computer uses to discover information about domains. Step six, cyber security connection and the big picture. DNS is extremely important in cyber security. Why? Because almost every normal internet user depends on
171:13
Speaker A
DNS. Before connecting to many websites and services, systems need to resolve names. That means DNS traffic can reveal important information. A security professional may investigate questions such as what domains is this device trying to contact? Are there unusual DNS
171:34
Speaker A
requests? Is a device communicating with suspicious domains? Are DNS responses pointing to unexpected IP addresses? Is a system generating an unusually large number of DNS queries? DNS can become valuable during network monitoring, threat detection, incident investigation, malware analysis, and
171:59
Speaker A
traffic analysis. For example, imagine a security analyst sees a computer making repeated DNS requests to an unknown domain. That may become an important clue. The DNS request itself does not automatically mean the activity is malicious, but it gives the analyst
172:19
Speaker A
something to investigate. Later in this course, you will learn more about DNS traffic analysis, DNS spoofing, packet captures, Wireshark, and how security professionals investigate network communication. But all of those future lessons depend on understanding what DNS normally does
172:42
Speaker A
first. So, let's recap the most important points. First, DNS stands for domain name system. Second, DNS helps translate human readable domain names into IP addresses. Third, DNS resolution may involve recursive resolvers, root servers, TLDD servers, and authoritative DNS servers. Fourth, DNS caching
173:09
Speaker A
improves speed and efficiency by temporarily storing previous answers. And fifth, DNS is an important source of information for cyber security monitoring and investigation.
173:22
Speaker A
Now notice what just happened in the course. At the end of level one, you understood IP addresses, ports, protocols, TCP and UDP, the TCPIP model. Now those concepts are starting to become part of a real communication process. A user types a domain name. DNS
173:44
Speaker A
finds the IP address. The system can now begin communicating with the destination. But there is another important question.
173:53
Speaker A
Before a device can even communicate properly on a network, how does it receive information such as its IP address, subnet mask, default gateway, DNS server? Does every user manually configure these settings? usually no. So where does this network configuration
174:12
Speaker A
come from? That is what we will explore next. In video 14, we will learn about DHCP, dynamic host configuration protocol. You will see how devices automatically receive the network configuration they need to communicate and step by step the
174:33
Speaker A
internet communication journey will continue. I'll see you in video 14. Imagine connecting your laptop to a Wi-Fi network. A few seconds later, everything works. You can access websites. You can communicate with other devices. You can reach the internet. But
174:56
Speaker A
there is an important question. How did your computer know what IP address to use? How did it know which router to use? How did it know where to find DNS?
175:09
Speaker A
You probably did not manually configure all of that information. So, where did it come from? The answer is one of the most important services in modern networking. DHCP, the dynamic host configuration protocol.
175:26
Speaker A
DHCP automatically provides devices with the network configuration they need to communicate and without it managing modern networks would be much more difficult. In the previous video, we learned how DNS helps convert names into IP addresses. But before a device can
175:47
Speaker A
start communicating properly, it usually needs its own network configuration first. So, in this lesson, we're going to answer an important question. How does a device automatically receive the information it needs to join a network?
176:05
Speaker A
Welcome to video 14. In video 13, we began level two and started looking at how the internet actually works. We learned about DNS. We saw how a domain name can be translated into an IP address. Now, we're taking one step
176:23
Speaker A
earlier in the communication journey. Before your computer can successfully communicate across a network, it needs some important information, it needs to know things such as its IP address, its subnet information, its default gateway, and often the address of a DNS server.
176:44
Speaker A
You could configure all of this manually, but imagine doing that for hundreds or thousands of devices. that would be slow, difficult and easy to misconfigure.
176:56
Speaker A
This is why DHCP exists. DHCP automatically provides network configuration to devices and it is something you encounter almost every day. When you connect your phone to Wi-Fi, when your laptop joins a network, when a new device appears on an office
177:15
Speaker A
network. DHCP is often involved in the background. What you will learn by the end of this lesson, you should understand what DHCP is, why DHCP exists, what information DHCP can provide to a device, how the DHCP process works, the four major
177:36
Speaker A
stages of DHCP communication, what a DHCP lease is, and why DHCP matters in cyber security. The simple idea. Let's start with a simple situation.
177:51
Speaker A
Imagine you arrive in a new neighborhood. You want to live there. But before you can participate properly, you need some information. You need an address. You need to know which road leads outside the neighborhood. And you may need information about important
178:07
Speaker A
services. A new device joining a network has a similar problem. It needs network configuration.
178:14
Speaker A
for example, an IP address, a subnet mask or network prefix, a default gateway, a DNS server. Without this information, the device may not know how to communicate properly. One option would be to configure everything manually. This is called static
178:34
Speaker A
configuration. But on many networks, devices receive this information automatically. That automatic process is commonly handled by DHCP.
178:46
Speaker A
DHCP stands for dynamic host configuration protocol. In simple terms, DHCP automatically gives devices the network information they need to communicate.
178:58
Speaker A
Think of DHCP as a network configuration service. A device joins the network. It asks for configuration. A DHCP server responds and the device receives the information it needs. This makes networking much easier to manage. The real networking concept. Now let's
179:18
Speaker A
understand why DHCP exists and what it actually provides. Imagine an organization with 50 computers, 100 phones, 20 printers, several servers, and many temporary devices. If every device required manual configuration, an administrator would need to configure network settings individually. For every
179:42
Speaker A
device, someone might need to configure an IP address, a subnet mask or network prefix, a default gateway, DNS servers, and possibly other settings. This creates several problems. First, it takes time. Second, humans can make mistakes. Third, two devices could
180:05
Speaker A
accidentally receive the same IP address that can create an IP address conflict. Fourth, managing large networks becomes much more difficult. DHCP solves much of this problem by automatically assigning network configuration.
180:23
Speaker A
DHCP can provide several important pieces of information. The most obvious one is an IP address. Remember from video six, an IP address helps identify a device for communication across networks. A DHCP can provide more than just an IP
180:43
Speaker A
address. A device may also receive a network prefix or subnet mask, a default gateway, DNS server addresses, and other configuration options depending on the network. Let's briefly connect these to what you've already learned. IP address.
181:03
Speaker A
The device needs an address for network communication. For example, 1 92.168.1.25. Network prefix. The device also needs to understand which part of the network is local. For example, 1 192.168.1.25/24.
181:26
Speaker A
You learned about CIR in video 8. Now that knowledge is becoming useful again. Default gateway. The default gateway is usually used when traffic needs to leave the local network. We will study the default gateway in much more detail in
181:44
Speaker A
video 23. For now, remember that DHCP can provide this information automatically. DNS server. In video 13, we learned that DNS helps convert domain names into IP addresses. A device needs to know where it can send DNS queries.
182:05
Speaker A
DHCP can automatically provide DNS server information. This is an important connection. DHCP helps configure the device. DNS helps the device resolve names. The default gateway helps traffic leave the local network. And as level two continues, we will connect all of
182:25
Speaker A
these parts into one communication journey. how DHCP works. Now, let's look at the actual DHCP process. When a new device joins a network, it may not yet have an IP address. So, how can it communicate with a DHCP server? The answer involves a
182:45
Speaker A
discovery process. The classic DHCP process is commonly remembered using four words: discover, offer, request, acknowledge, or simply Dora. Let's go through the process. DHCP discover. The device first needs to find a DHCP server. So, it sends a DHCP discover
183:07
Speaker A
message. In simple terms, the device is asking, "Is there a DHCP server on this network?" Because the device may not yet know the DHCP server's address. This initial discovery is commonly sent as a broadcast on the local network. DHCP
183:26
Speaker A
offer. If a DHCP server receives the request, it can respond with an offer. The server may offer an available IP address, network configuration, and other DHCP options. In simple terms, the server is saying, I have network configuration available for you. DHCP
183:48
Speaker A
request. The device then responds with a DHCP request. The device is essentially saying I would like to use this offered configuration.
183:59
Speaker A
This helps confirm the configuration the client wants to use. DHCP acknowledge. Finally, the DHCP server sends a DHCP acknowledgement. This is commonly called DHCPK.
184:15
Speaker A
The server confirms the configuration. The device can now use the assigned network settings. So the full process is discover, offer, request, acknowledge or dora. This is one of the most important DHCP concepts to remember. But there is another important concept. The IP
184:37
Speaker A
address is usually not assigned permanently. It is often assigned for a limited period. This is called a DHCP lease. A lease means the device is allowed to use an IP address for a certain amount of time. For example, a
184:55
Speaker A
device might receive an address for several hours or several days. The exact lease time depends on how the network is configured. Why use leases? Because devices come and go. Imagine a public Wi-Fi network. People connect, then leave. New people arrive. DHCP leases
185:17
Speaker A
allow addresses to eventually become available again when they are no longer being used. Before a lease expires, a device may attempt to renew it. If the DHCP server approves the renewal, the device can continue using the address.
185:35
Speaker A
This makes dynamic networks much easier to manage. Visualize it. Now, let's put the entire process together. Imagine you turn on your laptop and connect to Wi-Fi. At first, the laptop needs network configuration. The process looks like this. The device joins the local
185:54
Speaker A
network. Then it sends a DHCP discover. A DHCP server responds with DHCP offer. The device responds with DHCP request.
186:07
Speaker A
Then the server confirms the configuration with DHCP. The device is now configured. It may now know its IP address, its network prefix, its default gateway, its DNS server.
186:22
Speaker A
Then normal communication can begin. For example, the device can send DNS queries. It can communicate with devices on the local network and it can send traffic toward the internet through its default gateway. This is an important part of the bigger communication
186:41
Speaker A
journey. The device needs configuration first, then it can begin normal network communication. And notice how the previous lessons are now connecting. Video 6 gave us IP addresses. Video 8 gave us CID.
187:00
Speaker A
Video 13 gave us DNS. Now, DHCP helps deliver some of this configuration automatically. The pieces are starting to connect. Cyber security connection.
187:13
Speaker A
Why does DHCP matter in cyber security? At first, DHCP may seem like a simple convenient service, but DHCP is important network infrastructure.
187:26
Speaker A
Think about the information it can provide. IP addresses, default gateways, DNS servers, other network configuration.
187:36
Speaker A
A security professional may need to investigate questions such as which IP address is this device using, which network does it belong to? Which gateway is it using? Which DNS server was configured, does the configuration look normal? Unexpected DHCP behavior can
187:57
Speaker A
sometimes indicate a network problem or a security issue. For example, security professionals may investigate unexpected DHCP servers, devices receiving unusual network configuration, unexpected DNS settings, unexpected gateway information, or sudden changes in a devices network configuration. Later in the course, we will study DHCP attacks
188:25
Speaker A
and DHCP security in video 44. But before you can understand abnormal DHCP behavior, you must understand normal DHCP behavior. This is an important cyber security principle. Understand how a system is supposed to work before trying to recognize when something is
188:47
Speaker A
wrong. DHCP is also useful during network troubleshooting, incident investigation, network monitoring, device identification, and understanding how devices join a network. Security does not begin with attacking a network. It begins with understanding how the network is supposed to work. Recap.
189:11
Speaker A
Let's review the most important points first. DHCP stands for dynamic host configuration protocol. It automatically provides network configuration to devices. Second, DHCP can provide information such as an IP address, network prefix information, a default gateway, and DNS server addresses.
189:34
Speaker A
Third, the classic DHCP process follows four major stages. Discover, offer, request, acknowledge or DORA. Fourth, DHCP assignments are often temporary.
189:48
Speaker A
These temporary assignments are called DHCP leases. Fifth, DHCP matters in cyber security because network configuration is important for monitoring troubleshooting and detecting unusual network behavior. Now, we understand how a device can automatically receive an IP address and other network configuration. But another
190:13
Speaker A
important question remains. Imagine two devices are on the same local network. One device knows the IP address of the other. But on a local Ethernet or Wi-Fi network, communication also involves something we learned earlier, MAC addresses. So how does a device discover
190:35
Speaker A
which MAC address belongs to a particular IP address on the local network? That's where the next protocol comes in. In video 15, we're going to learn about ARP, address resolution protocol. And this is where the connection between IP addresses and MAC
190:56
Speaker A
addresses becomes much more practical. I'll see you in video 15. Imagine your computer wants to send data to another device on the same local network. It already knows the destination IP address. For example, 1 92.168.1.
191:23
Speaker A
But there is a problem. Knowing the IP address is not always enough. On a local network, your computer also needs to know which physical network interface should receive the data. That brings us back to something you learned earlier,
191:38
Speaker A
MAC addresses. So, now we have an important question. If a device knows an IP address, how does it discover the MAC address associated with that IP address?
191:51
Speaker A
The answer is ARP, the address resolution protocol. ARP helps devices connect an IPv4 address to a MAC address on a local network. And this small process is happening constantly in the background. Without it, devices on a local network would have a much harder
192:12
Speaker A
time communicating with each other. But ARP is also extremely important in cyber security because if a device receives false ARP information, network traffic can potentially be redirected or intercepted. So in this lesson, we're going to understand ARP from the
192:33
Speaker A
beginning. what it is, why it exists, how it works, how devices store ARP information, how to observe it on Linux, and why cyber security professionals need to understand it. Welcome to video 15. In the previous lesson, we learned
192:51
Speaker A
about DHCP. We saw how a device can automatically receive important network configuration, an IP address, a network prefix, a default gateway, and DNS server information. Now the device is configured and ready to communicate. But another important problem appears.
193:13
Speaker A
Imagine your computer wants to communicate with another device on the same local network. It may know the destination IP address, but local network communication also depends on MAC addresses. You learned about MAC addresses in video 5, and you learned
193:31
Speaker A
about IP addresses in video 6. Until now, we have mostly discussed them as separate concepts. ARP connects them. It helps a device answer a simple but important question. I know the IP address. which MAC address belongs to it. This is another major step in
193:52
Speaker A
understanding how real network communication actually works. What you will learn by the end of this lesson, you should understand what ARP is, why ARP exists, the relationship between IP addresses and MAC addresses, how an ARP request works, how an RP reply works,
194:13
Speaker A
what an ARP table or neighbor table is, how to observe ARP information on Linux, and why ARP matters in cyber security.
194:22
Speaker A
The simple idea. Let's start with a simple example. Imagine you live in a neighborhood. You know the house number of someone you want to visit. For example, house 50. But imagine that the neighborhood also requires you to know
194:37
Speaker A
the exact physical location of the house before a local delivery can reach it. Knowing the house number tells you who you want to reach, but you still need the local information required to actually deliver something. Networking has a similar situation. An IP address
194:56
Speaker A
identifies a device logically. A MAC address identifies a network interface at the local network level. These two addresses serve different purposes.
195:07
Speaker A
Remember, an IP address helps identify where communication should go across networks. A MAC address is used for local network delivery. So imagine this situation. Computer A wants to send data to 1 192.168.1.5.
195:27
Speaker A
Oh, computer A knows the destination IP address, but it does not know the destination MAC address. So, it needs to ask who has IP address 1 192.168.1.50.
195:41
Speaker A
That is exactly where ARP comes in. ARP stands for address resolution protocol. In simple terms, ARP helps a device discover the MAC address associated with an IPv4 address on a local network. This is the basic problem ARP solves. IP
195:59
Speaker A
address known. MAC address unknown. ARP helps find the answer. The real networking concept. Now, let's look at why ARP is necessary. You already learned that networking uses layers. In the TC CPIP model, IP operates at the internet layer. Ethernet and MAC
196:22
Speaker A
addressing operate at the network access layer. These layers work together. Suppose your computer wants to send an IPv4 packet to another device on the same Ethernet network. The IP layer knows the destination IP address. For example, 1 192.168.150.
196:45
Speaker A
But before the packet can be transmitted across the local Ethernet network, it needs to be placed inside a frame. That frame needs a destination MAC address.
196:55
Speaker A
So the device needs to translate IPv4 address into MAC address. That is the purpose of ARP. Technically, ARP performs address resolution for IPv4 communication on a local network. The word resolution simply means finding the corresponding address. For example, 1
197:17
Speaker A
192.168.1.5 O becomes associated with BB BB BB BB BB. This information can then be used for local network communication. An important point to remember is this ARP is used for IPv4.
197:36
Speaker A
IPv6 uses a different mechanism called neighbor discovery protocol. We will discuss IPv6 concepts later in the course. For now, our focus is ARP and IPv4 networks. How ARP works. Let's walk through the process step by step.
197:54
Speaker A
Imagine two devices on the same local network. computer A IP address 1 192.168.1.1 OMAC address a A a a computer B IP address 1 192.168.1.5 omac address BB BB computer A wants to send data to computer B it knows 1 192.168.1.5
198:25
Speaker A
O but it does not know the MAC address. So what happens? A RP request computer A sends an ARP request across the local network. The message essentially asks who has IP address 1 92.168.1.5.
198:45
Speaker A
Because computer A does not yet know which MAC address belongs to that IP address, the ARP request is typically sent as a broadcast on the local network. A broadcast means the message is sent to all devices within that local
199:01
Speaker A
broadcast domain. Every device receives the question. Now imagine several devices receive the request. Most of them check the requested IP address and realize that IP address is not mine. So they ignore the request. But computer B sees 192.168.1.5.
199:23
Speaker A
Oh, that is its IP address. So computer B responds ARP reply. Computer B sends an ARP reply back to computer A. The reply essentially says I have IP address 1 192.168.1.5 O. My MAC address is BB B colon BB colon
199:44
Speaker A
BB. Unlike the original broadcast request, the reply is typically sent directly back to the requesting device.
199:51
Speaker A
This is commonly called a uniccast reply. Now computer A has the information it needed. It knows the relationship between 1 92.168.1.5 O and B B B B B B B B B B B B B B B B B
200:04
Speaker A
B B B BB B E B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B B
200:05
Speaker A
B B B B B B Comp Computer A can now prepare local network communication using the destination MAC address. The complete process looks like this. Number one, computer A knows the destination IP address. Number two, computer A does not
200:23
Speaker A
know the destination MAC address. Number three, computer A sends an ARP request. Number four, the correct device recognizes its IP address. Number five, the device sends an ARP reply. Number six, computer A learns the MAC address.
200:41
Speaker A
And finally, number seven, local communication can continue. This is one of the most important local network processes to understand. ARP tables and local network memory. Now let's think about something. Imagine your computer had to ask who has this IP address every
201:02
Speaker A
single time it wanted to communicate. That would create unnecessary traffic. So operating system store recently learned ARP information. This information is commonly referred to as an ARP table. On modern Linux systems, you may also hear it called the neighbor
201:22
Speaker A
table. The table contains information about relationships between IP addresses and MAC addresses. For example, 1 92.168.1 O11 22 23 col 445192.168.1.5 O BB colb BB colB. When the computer needs to communicate again, it can check this information first. If the mapping
201:56
Speaker A
already exists and is still valid, the computer may not need to send another ARP request immediately. This makes communication more efficient. However, ARP information is not necessarily stored permanently. Entries can expire.
202:14
Speaker A
Devices can leave the network. Network interfaces can change. So, the operating system updates this information when necessary. This brings us to an important connection with DHCP.
202:27
Speaker A
DHCP helps a device receive its network configuration. ARP helps the device discover local MAC address information.
202:38
Speaker A
These are different processes, but both are important for normal network communication. Practical observation on Linux. Open your Linux terminal and run IP nay. This displays neighboring devices and their IP and MAC addresses.
202:54
Speaker A
To generate network traffic, run ping- c110.72 132 166. Then check again. IP nay. This allows you to observe the IP to MAC address relationship directly on Linux.
203:13
Speaker A
Why ARP matters in cyber security. EIP is a simple protocol, but it has an important security limitation.
203:21
Speaker A
Traditional ARP does not strongly verify whether ARP information is trustworthy. A device generally accepts ARP information based on the communication it receives. This creates potential security risks. If false information enters the ARP process, devices may receive incorrect IP to MAC mappings.
203:47
Speaker A
For example, a device may believe that 1 192.168.1.1 is associated with the wrong MAC address. This can affect where local network traffic is sent. This concept becomes important in attacks such as AARP spoofing, ARP poisoning, and some man-in-the-middle scenarios.
204:13
Speaker A
We are not going to study those attacks in detail yet. Those topics appear later in the cyber security section of this course. In video 42, we will study ARP spoofing concept and controlled lab. But there is an important learning rule in
204:33
Speaker A
cyber security. Understand normal behavior before studying abnormal behavior. Before you can understand ARP spoofing, you must understand normal ARP. You must understand what an ARP request looks like, what an ARP reply does, why IP to MACM mappings exist, and
204:55
Speaker A
where that information is stored. Only then can you understand what happens when the information is manipulated.
205:04
Speaker A
ARP is also useful during network investigations. A security professional may ask which MAC address was associated with this IP address. Did the mapping change unexpectedly?
205:18
Speaker A
Are there unusual duplicate mappings? Is a gateway address associated with an unexpected device? These questions can help investigators understand local network behavior. This is why networking knowledge is so important in cyber security.
205:37
Speaker A
Security professionals do not simply memorize attack names. They understand how normal communication works. Then they learn to recognize when something looks wrong. Recap. Let's review the most important points first. ARP stands for address resolution protocol. It helps resolve an IPv4 address to a MAC
206:02
Speaker A
address on a local network. Second, ARP connects two concepts you already learned earlier, IP addresses and MAC addresses. IP addresses provide logical addressing. MAC addresses are used for local network delivery. Third, the normal ARP process involves an ARP
206:22
Speaker A
request and an ARP reply. A device asks, "Who has this IP address?" The correct device responds with its MAC address.
206:32
Speaker A
Fourth, operating systems store learned IP to MAC information in a neighbor or ARP table. On Linux, you can observe this using IP nay. And fifth, ARP matters in cyber security because incorrect ARP information can affect local network communication.
206:52
Speaker A
Understanding normal ARP behavior is essential before studying attacks such as ARP spoofing. Now we have followed another important part of the communication journey. A device can receive network configuration through DHCP.
207:09
Speaker A
It can use DNS to translate names into IP addresses. And on a local IPv4 network, ARP can help connect an IP address to a MAC address. So now we are getting closer to understanding how real communication happens. But what happens
207:29
Speaker A
when you actually open a website? Your browser connects to a server. It sends a request. The server sends a response.
207:36
Speaker A
You see a web page. But what protocol makes that web communication possible? That's what we're going to explore next.
207:45
Speaker A
In video 16, we're going to learn about HTTP and HTTPS. We'll see how browsers and web servers communicate, what a request is, what a response is, and why secure web communication is so important for cyber security. I'll see you in video 16.
208:12
Speaker A
Every time you open a website, something happens in the background. You type a web address. Your browser finds the server. Then somehow your browser and that server begin communicating.
208:26
Speaker A
You request a web page. The server sends a response. Your browser displays the result. But how does this communication actually happen? What language does your browser use to ask a web server for information? And when you enter sensitive information such as a password
208:45
Speaker A
or credit card number, how is that information protected? The answer begins with two of the most important technologies on the modern internet.
208:54
Speaker A
HTTP and HTTPS. HTTP helps web browsers and web servers communicate. HTTPS adds security to that communication. And if you want to understand websites, web applications, web security, bug bounty, or penetration testing, you need to understand how these protocols work. In
209:21
Speaker A
the previous lessons, we learned how a device receives network configuration through DHCP and how devices discover MAC addresses on a local network using ARP.
209:35
Speaker A
Now we are moving higher into the communication process. The network connection exists. The device has an IP address. The device can reach other systems. But now the question becomes, how does a browser actually communicate with a website? That's what we're going
209:53
Speaker A
to learn in this lesson. Welcome to video 16. We are now continuing level two, how the internet actually works. So far, we have already learned several important pieces of the communication journey. DNS helps translate domain names into IP addresses. DHCP helps
210:15
Speaker A
devices automatically receive network configuration. ARP helps devices discover MAC addresses on a local network. Now we are moving to something you interact with almost every day. Web communication.
210:32
Speaker A
When you visit a website, your browser needs a way to communicate with the web server. It needs a standard method for sending requests and receiving responses. That standard is HTTP.
210:45
Speaker A
And when security is added to protect the communication, we use HTTPS. Understanding HTTP and HTTPS is extremely important because much of the modern internet is built around them. websites, web applications, AP, login systems, online banking, social media, cloud services and many cyber
211:09
Speaker A
security investigations involve understanding web traffic. So in this lesson we are going to build a strong foundation. First we will understand HTTP, then we will understand HTTPS.
211:25
Speaker A
Later in the course, we will go much deeper into how encryption works with TLS. For now, the goal is to understand the communication model. What you will learn by the end of this lesson, you should understand what HTTP
211:42
Speaker A
is, why HTTP exists, how the request and response model works, what a client and server are, the basic structure of an HTTP request, the basic structure of an HTTP response, what common HTTP methods mean, what HTTP status codes tell us,
212:02
Speaker A
what HTTPS is, The main difference between HTTP and HTTPS. How to observe HTTP communication using Linux tools and why HTTP and HTTPS matter in cyber security. The simple idea. Let's begin with a simple example.
212:22
Speaker A
Imagine you walk into a restaurant. You sit down and look at the menu. Then you tell the waiter what you want. The waiter takes your request to the kitchen. The kitchen prepares the food.
212:34
Speaker A
Then the waiter brings the result back to you. Web communication works in a similar way. Your browser asks for something. A web server receives the request. The server processes it. Then the server sends back a response. For example, you type example.com.
212:54
Speaker A
Your browser sends a request to the website server. The server responds with information. Your browser receives that information and displays the web page.
213:04
Speaker A
The protocol commonly used for this communication is called HTTP. HTTP stands for hypertext transfer protocol.
213:16
Speaker A
In simple terms, HTTP is a set of rules that allows web clients and web servers to communicate. The browser is usually called the client. The system providing the website or service is called the server. This creates one of the most
213:32
Speaker A
important models in networking and web communication. The client sends a request. The request goes to the server.
213:41
Speaker A
The server sends a response and the response returns to the client. Let's use a simple example. You open a browser and visit a website. Your browser might ask, "Please send me the homepage." The server processes that request. Then the
213:58
Speaker A
server sends back the HTML, the images, the CSS, the JavaScript or other resources needed by the browser.
214:08
Speaker A
The browser then displays the website. So HTTP is fundamentally based on communication between a client and a server. The real networking concept. Now let's move from the simple idea to the technical concept. HTTP is an application layer protocol.
214:31
Speaker A
Remember the networking models we studied in videos 11 and 12. HTTP operates at the application layer. It defines how web applications communicate.
214:44
Speaker A
HTTP does not directly care about how an Ethernet frame moves across a local network. It does not decide which route a router should use. It focuses on the communication between applications, for example, a web browser and a web server.
215:02
Speaker A
HTTP works together with other networking technologies. For example, DNS may help find the IP address of a website. IP helps identify where the traffic should go. TCP commonly provides reliable transport for HTTP communication and HTTP defines the application level communication. This is
215:27
Speaker A
why the concepts from earlier videos are starting to connect. Imagine you type www.example.com. A simplified communication process might look like this. First DNS helps find the server's IP address. Then your device sends traffic toward that destination. A network connection is established. Then
215:51
Speaker A
HTTP is used for the web communication. The server receives the HTTP request. The server sends an HTTP response. This is why networking knowledge is essential for cyber security. A website is not magic. Behind the screen, multiple networking technologies work together.
216:13
Speaker A
how HTTP works. Now, let's look at the HTTP communication process more closely. HTTP usually follows a simple model. Request response. The client sends a request.
216:27
Speaker A
The server sends a response. Let's break this down. The HTTP request. An HTTP request is a message sent by a client to a server. The request tells the server what the client wants. For example, a browser may request a web page. An
216:47
Speaker A
application may request data from an API. A user may submit a login form. A request usually contains several important pieces of information. Let's look at a simplified example. Get/http version 1.1. hostacample.com.
217:07
Speaker A
User agent misilla 5.0. zero. Don't worry if this looks unfamiliar. Let's break it down. The first line is g/http version 1.1. G is the http method. It tells the server what type of action the client wants to perform. G
217:29
Speaker A
usually means please retrieve information. The slash represents the requested resource or path. In this example, the client is requesting the main page. Then HTTP version 1.1 identifies the HTTP version being used. The request can also include additional information called
217:52
Speaker A
headers. Headers provide extra details about the request. For example, host example.com. This tells the server which website the client wants to access. A server may host multiple websites. The host header helps identify the intended website.
218:12
Speaker A
Another example is user agent. This can provide information about the client software making the request. So the HTTP request is essentially the client saying this is what I want and here is some additional information about my request.
218:30
Speaker A
The HTTP response. After receiving the request, the server processes it. Then it sends an HTTP response. A simplified response might look like this. http version 1.1. Status code 200. Okay.
218:49
Speaker A
Content type text/html. The response then contains HTML content. For example, an HTML document with a body containing the heading hello world.
219:01
Speaker A
The first line contains HTTP version 1.1 status code 200. Okay. The number 200 is an HTTP status code. Status codes tell the client what happened to the request.
219:17
Speaker A
The word okay means the request was successfully processed. The response can also contain headers. For example, content type text /html.
219:31
Speaker A
This tells the browser that the server is sending HTML content. Then the response may contain the actual content. In this example, HTTML code. The browser receives that code.
219:44
Speaker A
Then it interprets the code and displays the web page. So the core HTTP model is simple. The client asks, the server responds. Common HTTP methods. HTTP uses methods to describe what the client wants to do. The most common one for
220:03
Speaker A
beginners to understand is get is commonly used to retrieve information. For example, your browser requests a web page. Get slash products. The client is asking the server, please give me this resource. Another important method is post is commonly used to send data to a
220:26
Speaker A
server. For example, submitting a login form, creating a new account, sending form data. A simplified example might look like post/lo.
220:39
Speaker A
The client sends information to the server. Other HTTP methods include put, delete, patch. We will encounter these more often when studying web applications and APIs.
220:52
Speaker A
For now, remember the basic idea. Get T means retrieve information. P O S T means send information to the server.
221:02
Speaker A
These methods become extremely important in cyber security because security professionals often analyze how web applications handle different types of requests. HTTP status codes. Another important part of HTTP is the status code. The server uses status codes to tell the client what
221:23
Speaker A
happened. Let's look at a few common examples. 200. Okay, this usually means the request was successful. 404 not found. This usually means the requested resource could not be found.
221:39
Speaker A
For example, you request a page that does not exist. 403 forbidden. This usually means the server understood the request but is refusing access. 500 internal server error. This usually means something went wrong on the server. Status codes are useful
222:00
Speaker A
because they give us information about how the server responded. This becomes especially important when troubleshooting websites and analyzing web applications.
222:12
Speaker A
Later in cyber security work, understanding status codes can help you recognize successful requests, access restrictions, missing resources, server errors, and unusual application behavior, visualize HTTP and HTTPS.
222:29
Speaker A
So far we have focused on HTTP. Now let's introduce HTTPS. https stands for hypertext transfer protocol secure. In simple terms, HTTPS is HTTP communication protected by encryption. The most important difference is security. Let's imagine two situations. In the first situation,
222:52
Speaker A
a browser communicates using plain HTTP. With plain HTTP, the communication is not protected by encryption. That means the data can potentially be readable by systems that are able to observe the traffic. Now compare that with HTTPS.
223:11
Speaker A
https protects the communication using encryption provided by TLS. TLS stands for transport layer security. We will study TLS in much more detail in the next video. For now, the important idea is this. HTTPS combines HTTP communication with security protection. The browser still
223:33
Speaker A
sends requests. The server still sends responses, but the communication is protected. A simplified comparison looks like this. http The client sends a request to the server. The data may be readable if the communication is intercepted. Now, https.
223:55
Speaker A
The client sends an encrypted request to the server. The communication is protected using TLS.
224:01
Speaker A
Historically HTTP commonly uses port 80. HTTPS commonly uses port 443. Remember from video 9, ports help identify network services. So, these earlier concepts are connecting. Again, an IP address helps identify the destination system. A port helps identify the service and HTTP or HTTPS
224:28
Speaker A
defines how the application communicates. Why HTTPS is important. Imagine logging into a website. You enter your username, your password, then you click login. Your browser sends information to the server.
224:45
Speaker A
Without proper protection, sensitive information could potentially be exposed to unauthorized observers on the network. HTTPS helps protect the communication.
224:59
Speaker A
It provides important security properties such as confidentiality, integrity, and authentication. Let's briefly understand these.
225:10
Speaker A
Confidentiality helps keep the communication private. Integrity helps detect whether data has been modified during transmission. Authentication helps the client verify that it is communicating with the intended server.
225:25
Speaker A
We will explain these concepts much more deeply when we study TLS. For now, remember HTTPS is not simply HTTP with a green lock. It is a security mechanism that helps protect communication between clients and servers. Practical observation. Now
225:46
Speaker A
let's move from theory to a practical demonstration. Open your Linux terminal and use curl to observe HTTP and HTTPS communication. First make an HTTP request. Curl HTTP colon/testfire.net.
226:04
Speaker A
This sends a normal HTTP request and displays the server's response. Then make an HTTPS request. curl https colon//ginju.shop.
226:17
Speaker A
This sends the same type of request but through an encrypted https connection. To view only the response headers, run curl- i https colon//ginu.shop.
226:31
Speaker A
The dash i option tells curl to display only the response headers. You may see output like this. http version 2 status code 200 content type text /html 200 means the request was successful this allows you to directly observe http
226:54
Speaker A
and https communication from the Linux terminal cyber security connection http and https are extremely important in cyber security. A large portion of modern applications communicate using these protocols. Websites, web applications, AP, mobile applications, cloud services, authentication systems, all rely heavily
227:21
Speaker A
on HTTP or HTTPS. A security professional needs to understand normal web communication before investigating abnormal or suspicious behavior. For example, security professionals may analyze unexpected HTTP requests, unusual request methods, suspicious headers, strange status codes, failed login requests, unauthorized access attempts,
227:48
Speaker A
unexpected server responses, or communication using insecure HTTP. HTTP knowledge also becomes essential when using tools such as browser developer tools, Burp Suite, Wireshark, Curl, and web application testing tools.
228:07
Speaker A
But there is another important lesson here. HTTPS is designed to protect communication. That means network security professionals cannot simply look at encrypted HTTPS traffic and automatically read the application data. Encryption changes what is visible on the network. This is
228:28
Speaker A
one reason TLS becomes so important. Later in this course, we will study TLS and SSL, HTTP traffic analysis, Wireshark, packet captures, web communication, and security investigation. All of those future topics depend on understanding the foundation we built today. The key cyber
228:51
Speaker A
security principle is simple. You cannot properly secure web communication if you do not understand how web communication works. Recap. Let's review the most important points. First, HTTP stands for hypertext transfer protocol. It is used for communication between clients and
229:12
Speaker A
web servers. Second, HTTP uses a request and response model. The client sends a request. the server sends a response.
229:21
Speaker A
Third, HTTP requests can contain methods, paths, headers, and sometimes data. Fourth, HTTP responses can contain status codes, headers, and content.
229:34
Speaker A
Fifth, HTTPS is HTTP protected with TLS encryption. HTTPS helps provide confidentiality, integrity, and authentication for web communication. And finally, understanding HTTP and HTTPS is essential for cyber security because web traffic is one of the most important forms of communication on modern
230:00
Speaker A
networks. Now, we understand the basic difference between HTTP and HTTPS. HTTP allows clients and servers to communicate. HTTPS protects that communication. But this creates an important question. How exactly does HTTPS provide that protection? How can a browser communicate securely with a
230:26
Speaker A
server across an untrusted network? How does encryption begin? How does the browser know it is communicating with the correct server? And what exactly is TLS? That's what we're going to explore next. In video 17, we're going to learn
230:44
Speaker A
TLS/SL basics. And this is where HTTPS security starts to become much more practical. I'll see you in video 17.
231:00
Speaker A
When you log into a website, your password travels across a network. So, how does the internet stop someone from simply reading it? You see HTTPS and a padlock in your browser. But what actually makes that connection secure?
231:18
Speaker A
The answer is TLS, transport layer security. In this lesson, we'll see how TLS protects modern internet communication. In video 16, we learned about HTTP and HTTPS.
231:31
Speaker A
HTTP allows browsers and servers to communicate. HTTPS is HTTP protected by TLS. So today we're going one level deeper. We'll learn what TLS does, how a TLS connection is established, and how to observe one on Linux, what you will
231:51
Speaker A
learn. By the end of this lesson, you should understand what TLS and SSL are, why TLS is needed, confidentiality, integrity, and authentication. What a TLS certificate does. The basic TLS handshake. Symmetric and asymmetric cryptography. How to observe an HTTPS
232:13
Speaker A
connection on Linux and why TLS matters in cyber security. The simple idea. Imagine sending an important message through a public delivery system. If the message is completely exposed, someone handling it could potentially read it.
232:32
Speaker A
But if the message is protected using a secure mechanism, unauthorized people should not be able to understand it.
232:41
Speaker A
Network communication has a similar problem. Your data may travel through networks and infrastructure that you do not control. TLS helps protect that communication. It provides a secure way for a client and server to communicate.
233:00
Speaker A
For example, your browser connects to a website. Instead of normal readable application data traveling openly, TLS protects the communication. The simple idea is TLS helps protect data while it travels between systems. What are SSL and TLS? You will often hear two terms
233:20
Speaker A
SSL and TLS. SSL means secure sockets layer. TLS means transport layer security. SSL is the older technology.
233:32
Speaker A
TLS replaced SSL and is the modern protocol used for secure communication. So when someone says SSL certificate, they often mean a TLS certificate. TLS is used in many types of communication.
233:47
Speaker A
But one of the most common examples is HTTPS. Remember the relationship HTTP equals web communication. TLS equals security for the connection HTTPS equals HTTP protected by TLS. This connects directly to video 16. We learned what HTTPS is. Now we are
234:11
Speaker A
learning what provides its security. Why TLS exists? TLS mainly helps solve three important security problems.
234:20
Speaker A
Confidentiality integrity authentication, confidentiality. Confidentiality means keeping information private. TLS encrypts application data so that someone observing the connection should not simply be able to read the original information. For example, plain text password equals my secret password. Then t
234:47
Speaker A
protection is applied. The result is encrypted data. The exact encrypted data is not important here. The important idea is that the original message is protected. Integrity. Integrity means detecting unauthorized changes. Imagine a message saying transfer $100. If someone secretly changed it to transfer
235:12
Speaker A
$10,000, that would be a serious integrity problem. TLS includes cryptographic protections that allow the communicating systems to detect unauthorized modification.
235:26
Speaker A
Authentication. Authentication helps the client determine whether it is communicating with the intended server. This is where TLS certificates become important. When your browser connects to a secure website, the server presents a certificate. The browser can check things such as is the certificate
235:48
Speaker A
trusted, is it still valid? Does it match the website? And has it expired? If there is a serious problem, the browser can warn you. So TLS is not simply encryption. It is a broader security system for protecting communication. How the TLS handshake
236:09
Speaker A
works. Before protected application data is exchanged, the client and server need to establish a secure connection. This process is called the TLS handshake.
236:21
Speaker A
Let's simplify it. First, the client begins the connection. For example, your browser wants to connect to a secure website. The client sends information about the TLS options it supports. Next, the server responds. The server selects the security parameters it will use. The
236:42
Speaker A
server also provides its certificate. Then the client verifies the certificate. It checks whether the certificate is trusted, valid, and appropriate for the website. If the checks fail, the browser may show a security warning. Next, the client and server establish the cryptographic
237:03
Speaker A
secrets needed to protect the session. The exact mathematics depends on the TLS version and the cryptographic methods being used for this course. Remember the main concept. The handshake establishes the security needed for the session.
237:20
Speaker A
Once the secure session is established, application data can travel through it. for HTTPS that means HTTP communication is protected by TLS.
237:35
Speaker A
So the basic process is connect, verify, establish security and protect communication. Modern TLS, especially TLS version 1.3, has technical details that are more complex than this simplified explanation. For now, this mental model is enough.
237:56
Speaker A
Symmetric and a symmetric cryptography. There are two cryptographic ideas you should understand at a beginner level.
238:05
Speaker A
Symmetric encryption. Symmetric encryption uses the same secret key for encryption and decryption. Imagine two people sharing the same key to a locked box. One locks it, the other uses the same key to unlock it. Symmetric encryption is efficient and fast which
238:26
Speaker A
makes it useful for protecting large amounts of data. But the systems first need a secure way to establish the necessary secrets.
238:35
Speaker A
This is where asymmetric cryptography becomes important. Asymmetric cryptography. Asymmetric cryptography uses a pair of related keys public key and private key.
238:49
Speaker A
The public key can be shared. The private key must remain protected. TLS uses asymmetric cryptography as part of establishing trust and secure session information. Then symmetric encryption is typically used for the ongoing session because it is efficient. You do
239:09
Speaker A
not need to memorize the mathematics yet. The important idea is TLS uses cryptography to establish and protect a secure communication session.
239:21
Speaker A
Cyber security connection TLS is fundamental to modern cyber security. It helps protect things like passwords, authentication data, personal information, financial transactions, API communication, and business applications. But TLS also matters to defenders because attackers can use encrypted connections too. So a security
239:48
Speaker A
professional should not simply think encrypted traffic is safe or encrypted traffic is malicious. Instead they investigate the context. Who is communicating? Where is the connection going? What certificate is being presented? Is the destination expected?
240:07
Speaker A
Does the behavior look normal? This is an important cyber security mindset. Understand normal behavior first. then you can recognize abnormal behavior.
240:17
Speaker A
Recap. Let's quickly review. Number one, TLS protects communication between systems. Number two, HTTPS is HTTP communication protected by TLS.
240:32
Speaker A
Number three, TLS provides important security properties including confidentiality integrity and authentication. Number four, the TLS handshake establishes the security needed before protected communication begins.
240:49
Speaker A
Number five, TLS matters in cyber security because defenders need to understand both normal encrypted traffic and potentially suspicious behavior. So far, we've talked about communication at a high level. But what actually carries all this information across a network?
241:09
Speaker A
When data travels between devices, it is divided and wrapped into specific structures. In the next video, we'll look at packets and frames. You'll learn what they are, how they differ, and how they carry information through a network. I'll see you in video 18.
241:33
Speaker A
Every time you open a website, send a message or log into an account, your device is moving information across a network. But that information does not travel as one giant piece. It is broken down wrapped addressed transmitted and rebuilt at the destination. So what
241:55
Speaker A
exactly is moving through the network? The answer starts with two important terms. packets and frames. In the previous videos, we learned how web communication works with HTTP and HTTPS and how TLS protects HTTPS communication.
242:15
Speaker A
Now, we need to look underneath that communication. When data moves across a network, it is carried in smaller units.
242:23
Speaker A
At the network layer, we commonly talk about packets. At the data link layer, we talk about frames. Understanding the difference will help you understand what Wireshark shows later in the course.
242:38
Speaker A
What you will learn. By the end of this video, you will understand what a packet is, what a frame is, the difference between packets and frames, how packets and frames move through a network, why packets can contain different types of
242:55
Speaker A
information, how to observe packets on Linux, and why cyber security professionals care about them. The simple idea, imagine you want to send a large package through a delivery network.
243:10
Speaker A
Instead of trying to move everything as one huge object, the information can be divided into smaller pieces. In networking, these pieces allow data to travel efficiently across networks. A packet is a unit of data used at the network layer. A frame is a unit of data
243:30
Speaker A
used at the data link layer. Think of it this way. The packet helps move data between networks. The frame helps move that data across a particular local network link. That distinction is important. A packet can travel through several networks, but the frame carrying
243:49
Speaker A
that packet can change as the packet moves from one network link to another. The real networking concept. Let's connect this to what we already learned in video six. We learned about IP addresses. An IP address helps identify where network layer traffic needs to go.
244:10
Speaker A
In video five, we learned about MAC addresses. A MAC address is used for communication on the local network. Now, we can connect those concepts. A typical IP packet contains information such as source IP address, destination IP address, protocol information, the
244:32
Speaker A
actual payload. A frame can contain information such as source MAC address, destination MAC address, the packet being carried, other data link information. This is why packets and frames are not exactly the same thing. A frame carries a packet across a local
244:50
Speaker A
network technology such as Ethernet. The packet contains the network layer information needed to move data between networks. How it works? Let's follow a simple example. Your computer wants to communicate with a server. First, the application creates data. For example,
245:11
Speaker A
you might request a web page. That data is passed down through the networking stack. The transport layer adds its information. The network layer adds IP information. Then the data link layer creates a frame to send the information across the local network. The frame is
245:32
Speaker A
then transmitted across the local network. If the traffic needs to leave your local network, your computer sends it toward the appropriate next hop, usually your default gateway. The router receives the frame and processes the packet inside it. Then the router
245:49
Speaker A
creates a new frame for the next network link. This is an important idea. The packet can continue toward the destination while the frame can change at each network hop. So you can think of the journey like this. frame, packet,
246:06
Speaker A
frame, packet and frame. The exact technologies can vary, but the important concept is this. The data link frame is specific to the current network link, while the IP packet is used for communication across networks. Visualize it. Let's make this even simpler.
246:27
Speaker A
Imagine sending a letter through several delivery centers. The letter has a final destination, but each delivery center may place that letter into a different container for the next part of the journey. The letter represents the packet. The local container represents
246:45
Speaker A
the frame. When the packet reaches the next router, the old frame is removed. The router examines the packet and determines where to send it next. Then the packet is placed into a new frame for the next link. This is one reason
247:02
Speaker A
networking is easier to understand when we separate the layers. IP handles network level delivery. Mac and frames handle local link delivery. Practical observation. Now let's see real network traffic on Linux. A simple way to observe packets is with TCP dump. run
247:24
Speaker A
pseudo TCP dump- I any- C5. The command means TCP dump captures and displays network traffic. - I any listens on available network interfaces.
247:39
Speaker A
- C5 stops after five captured packets. You may see output containing information such as source and destination, IP addresses, protocols, and packet details.
247:53
Speaker A
The important thing to notice is that real network communication is made up of individual packets. The exact output will depend on what traffic is happening on your machine. Later when we reach wireshark and packet analysis, we will be able to inspect these packets in much
248:14
Speaker A
greater detail. Cyber security connection. This is where packets and frames become extremely important for cyber security.
248:25
Speaker A
Security professionals often investigate what is happening on a network by examining network traffic. Packets can provide evidence about who is communicating, where traffic is going, which protocols are being used, when communication happened, whether traffic looks normal or suspicious. For example,
248:47
Speaker A
an analyst investigating unusual activity may notice unexpected connections, unusual destinations, or unexpected protocols. Frames can also provide local network information such as MAC addresses and Ethernet details. Later in this course, you will use Wireshark to inspect packets directly. You will learn how to
249:11
Speaker A
recognize DNS traffic, HTTP traffic, TCP connections, suspicious behavior, and eventually attack activity. So today's lesson gives you an important mental model. Network communication is not one giant stream of data. It is carried through structured units that move across the network. Recap. Let's quickly
249:37
Speaker A
review. First, a packet is a network layer unit of data commonly carrying IP information.
249:45
Speaker A
Second, a frame is a data link layer unit that carries the packet across a local network link. Third, packets can travel across multiple networks while frames can change from one link to another. Fourth, IP addresses help with network level communication while MAC
250:05
Speaker A
addresses are used for local link communication. Finally, packets and frames are essential evidence when analyzing real network traffic. Now, we know that data travels through networks as packets and frames. But there is still an important question. How does data get wrapped
250:26
Speaker A
inside these different layers in the first place? That's what we will answer in the next video. In video 19, encapsulation and decapsulation.
250:38
Speaker A
We will follow data as it moves down the networking stack, gets wrapped with headers, travels across the network, and is finally unpacked at the destination.
250:53
Speaker A
When you send data across a network, it does not simply leave your computer as one piece of information.
251:01
Speaker A
Before it travels, different layers of the networking stack add their own information around it. At the destination, those layers are processed in the opposite direction. This process is called encapsulation and decapsulation.
251:18
Speaker A
In video 18, we learned that network communication uses packets and frames. Now we are going one step deeper. We need to understand how application data becomes a packet, how that packet becomes part of a frame and what happens
251:35
Speaker A
when the destination receives it. This is called encapsulation. The reverse process is called decapsulation.
251:45
Speaker A
Once you understand this, the networking models from level one will start to make much more sense. What you will learn in this video? You will learn what encapsulation means, what decapsulation means, how data moves down the networking stack, what each layer adds,
252:06
Speaker A
how the destination processes the data, how this connects to packets and frames, and why cyber security professionals need to understand this process. The simple idea. Let's start with a simple example. Imagine sending a gift to someone. You have the actual item you
252:26
Speaker A
want to send. You put it inside a box. Then you add an address label. Then the delivery company adds information needed to transport it. The original item has not changed. It has simply been wrapped with additional information needed to
252:42
Speaker A
move it. Networking works in a similar way. Your application creates data. As that data moves down through the networking layers, each layer adds information needed for communication.
252:57
Speaker A
This process is called encapsulation. At the destination, the process happens in reverse. The receiving device removes those layers and eventually delivers the original data to the correct application. That is decapsulation, the real networking concept. Let's connect this to the TCP IP model we
253:21
Speaker A
learned in video 12. Suppose you open a website. Your browser creates application data. The data then moves through the networking stack. At the transport layer, information such as TCP or UDP information is added. At the internet layer, IP information is added.
253:43
Speaker A
At the network access layer, information needed for the local network is added. The result is a nested structure. You can think of it like this. Application data, then a transport segment, then an IP packet, and finally a network frame.
254:02
Speaker A
The exact terminology can vary depending on the protocol, but this is the mental model you need. Each layer adds information that helps perform its job.
254:14
Speaker A
How encapsulation and decapsulation work. Let's follow a web request. Imagine your browser wants to communicate with a web server. The browser first creates application data.
254:28
Speaker A
That data moves down to the transport layer. If TCP is being used, TCP adds a header containing information needed for the connection such as source and destination ports. Now, we have a TCP segment. Next, the internet layer adds
254:47
Speaker A
an IP header. This includes information such as the source and destination IP addresses. Now, the transport data is inside an IP packet. Finally, the network access layer places that packet inside a frame suitable for the local network. For Ethernet, this includes
255:07
Speaker A
information such as source and destination MAC addresses. Now the frame can be transmitted that is encapsulation.
255:16
Speaker A
Now the frame reaches the destination. The destination processes the information in the opposite direction.
255:23
Speaker A
The frame is processed first. The IP information is then processed. The transport information is processed.
255:32
Speaker A
Finally, the original application data is delivered to the correct application. That is decapsulation. Visualize the complete journey. Let's put everything together. The sender starts with application data. The transport layer adds its header to the data. This creates the transport
255:53
Speaker A
segment. Then the internet layer adds an IP header. This creates the IP packet. Next, the network access layer adds the frame header. The result is a network frame. The frame is then transmitted across the network. At the receiver, the
256:13
Speaker A
process happens in reverse. The frame is processed first. Then the IP packet is processed. Then the transport information is processed. Finally, the application receives the original data.
256:29
Speaker A
The key idea is that every layer has a specific responsibility. The application layer deals with application communication.
256:39
Speaker A
The transport layer handles transport related information. The internet layer handles IPbased delivery. The network access layer handles local network transmission.
256:53
Speaker A
This is why networking models are useful. They break a complicated communication process into understandable layers. Practical observation. Now let's observe a real connection from Linux. Run curl-v https colon/jinu.shop.
257:13
Speaker A
We used curl in video 17 to observe https and tls. This time we are looking at it from a different perspective. The -v option means verbose. It makes curl show additional connection information. You may see information about the
257:32
Speaker A
destination, the connection TLS negotiation, the HT TP request and the server response. The important point is this. Your browser or curl starts with application level data.
257:49
Speaker A
That data does not travel through the network by itself. It is processed by the networking stack and carried through the lower layers using the appropriate headers and wrappers. To see the actual packets and their headers directly, we need a packet analysis tool and that is
258:07
Speaker A
exactly where Wireshark becomes useful later in this course. Cyber security connection encapsulation is extremely important in cyber security because security professionals often analyze communication at different layers. For example, during traffic analysis, you may need to determine which IP addresses
258:31
Speaker A
are communicating, which ports are being used, which protocol is involved, what type of traffic is being transmitted, whether the communication looks normal or suspicious. Different layers give you different pieces of evidence. This becomes especially useful when using tools such as Wireshark.
258:53
Speaker A
You might see an Ethernet frame containing an IP packet. Inside that packet, you might see TCP information.
259:02
Speaker A
And inside the TCP communication, you may find application layer information when the protocol allows it to be inspected. With encrypted protocols such as HTTPS, the application data is protected by TLS, which we learned in video 17. So understanding the layers helps you
259:23
Speaker A
understand what you can see, what you cannot see and where each piece of information belongs.
259:31
Speaker A
This is a fundamental skill for network monitoring, incident investigation and traffic analysis. Recap. Let's review the most important ideas. Encapsulation is the process of adding protocol information as data moves down the networking stack. Decapsulation is the reverse process as the receiving device
259:53
Speaker A
processes and removes those layers. A simplified journey looks like this. Application data, then a transport segment, then an IP packet and finally a frame. At the destination, the process happens in reverse. frame, then IP packet, then transport data, and finally
260:18
Speaker A
application data. Each layer adds information needed for its specific job. And this layered structure is one of the foundations of packet analysis and network security. Now you understand how data is wrapped and unwrapped as it travels through a network. But there is
260:37
Speaker A
still a major question. Once a packet needs to travel between different networks, how does a router decide where to send it? That's the job of routing.
260:47
Speaker A
In video 20, routing, we'll see how routers make forwarding decisions and how packets find their way toward a destination.
261:01
Speaker A
You send a request to a server on the other side of the internet. Your computer knows the destination IP address. But there is a problem. How does your computer know where to send the packet next? And once the packet
261:15
Speaker A
reaches a router, how does that router decide which path to use? That is the job of rooting. So far, we've followed data through several stages. We learned how DNS helps find an IP address. We learned how devices receive network
261:33
Speaker A
configuration. We learned how ARP helps discover local devices. We learned about HTTP, HTTPS, and TLS. Then we learned how data becomes packets and frames and how those layers are encapsulated.
261:51
Speaker A
Now, we need to answer one of the most important questions in networking. How does a packet get from one network to another? The answer is routing. What you will learn in this video? You will learn what routing means, why routers are
262:08
Speaker A
needed, how routers make forwarding decisions, what a routting table is, what a next hop means, how the best route is selected, how to view routing information on Linux, and why rooting matters in cyber security. The simple idea.
262:26
Speaker A
Imagine you want to travel to a city you've never visited before. You know the destination, but you still need to decide which road to take. If there are several possible roads, you need some information to choose the appropriate
262:41
Speaker A
one. Computer networks work in a similar way. A route is information about how to reach a destination network. Routing is the process of deciding where network traffic should be sent. And a router is a device that makes forwarding decisions
262:59
Speaker A
between networks. The important idea is routting is about choosing the next path toward a destination. The real networking concept. Let's connect this to what we already know. In video six, we learned about IP addresses. An IP address identifies a destination at the
263:21
Speaker A
network layer. In video 18, we learned that packets carry IP information. Now imagine your computer needs to send a packet to a destination that is outside its local network. Your computer cannot simply send that packet directly across the internet. It needs a device that can
263:41
Speaker A
forward the packet toward another network. That device is a router. Routers use information called a routing table. A routing table contains routes that tell the router where different destination networks can be reached. A simplified routting table might look
263:58
Speaker A
like this. Destination 192.168.1.0/24. Next hop direct interface eth0. Another route might be destination 10.0.0.0/24.
264:18
Speaker A
Next top 192.168.1.1 interface ETH0 and another route might be destination 0.0.0.0/ 0/0. Next hop 192.168.1.1 interface E T H0 You don't need to memorize this table yet. The important idea is that the router has rules describing where to
264:46
Speaker A
send traffic for different destinations. How routing works. Let's follow a packet. Suppose your computer wants to reach 203.0.1 0.1 1 3.5 O. Your computer examines its routting information. It asks, "Do I have a route to this destination?" If the destination
265:10
Speaker A
is on the local network, the device can communicate locally. If the destination is on another network, the packet is sent toward a router. The router receives the packet. It looks at the destination IP address. Then it checks its routting table. The router looks for
265:29
Speaker A
a route that matches the destination. If it finds one, it forwards the packet toward the appropriate next hop or interface. That next router repeats the process. This continues until the packet reaches the destination network. So routting is not necessarily one giant
265:49
Speaker A
decision made at the beginning. Each router along the path can make its own forwarding decision. Visualize the routing table. Let's look at the idea of a routting table more carefully. Imagine a router has these roots 10.0.0.0/8.
266:08
Speaker A
Router A 172.16.0.0/16. Router B 192.168.1.0/24. 0/24 local network 0.0.0.0/ routter C. Now a packet arrives with destination 1 92.168.1.5 O. The router sees that the destination belongs to 1 192.168.1.0/24.
266:44
Speaker A
So it sends the packet toward that local network. But what if the destination doesn't match a more specific route? The router may use a default route. A default route is commonly represented as 0.0.0.0/o.
267:01
Speaker A
It basically means for destinations I don't have a more specific route for send the traffic this way. One important principle is that routers generally prefer the most specific matching route.
267:15
Speaker A
This is often called longest prefix matching. You do not need to master subnetting here. We will build more practical subnetting skills later. For now, remember more specific route equals more precise destination. Practical observation. Now, let's look at routing
267:34
Speaker A
information on Linux. Run IP route. You may see something similar to this. Your actual output will be different depending on your network. Let's understand the important parts. The first line default via 10.136.239.83 means traffic without a more specific
267:58
Speaker A
matching route can be sent through that gateway. The second line 10.136.239.0/24 O24 dev etho shows a route for the local network and the interface used to reach it. The command is useful because it lets you see how your Linux system decides where
268:20
Speaker A
to send IP traffic. You can also ask Linux how it would route traffic to a specific destination.
268:28
Speaker A
IP route get8.8.8.8. This is especially useful for troubleshooting because instead of guessing which interface or gateway Linux will use, you can ask the operating system directly. Cyber security connection. Routing is fundamental to cyber security because security professionals need to
268:51
Speaker A
understand where traffic can go and how it gets there. For example, when analyzing a network, routing information can help you understand which networks are reachable, which gateway the traffic uses, which interface the traffic leaves through, how different network segments
269:11
Speaker A
communicate, and where traffic may be filtered or monitored. Routing also becomes important when investigating suspicious traffic. Suppose an internal machine suddenly communicates with an unexpected network. An analyst may need to understand the route that traffic takes and which devices are involved.
269:35
Speaker A
Later in the course, we will use tools such as tracer route to observe the path traffic takes through a network. We will also study network segmentation, firewalls monitoring, and packet analysis. All of those topics depend on understanding routing. Recap. Let's
269:57
Speaker A
review the key ideas. Routing is the process of deciding where network traffic should be forwarded. A router connects different networks and makes forwarding decisions. A routing table contains information about reachable destinations and where traffic should be sent. A next hop is the next router or
270:18
Speaker A
destination toward which traffic is forwarded. And when no more specific route exists, a default route can be used. On Linux, you can inspect routing information with IP route and check the route Linux would use for a destination with IP route get 8.8.8.8.
270:41
Speaker A
Now we understand how routers move traffic between networks. But there is another important problem. Your home network may contain devices using private IP addresses while the internet uses globally reachable addresses.
270:57
Speaker A
So how can those private devices communicate with the public internet? That's what we'll explore next. In video 21,nat and PAT, how private networks reach the internet. We'll see how a router translates private addresses and manages connections between your local network
271:19
Speaker A
and the internet. Your computer has a private IP address. The website you are visiting has a public IP address. So, how does your private computer communicate with a server on the public internet? The answer isnat and pat. In the previous
271:42
Speaker A
video, we learned how routers use routing information to forward packets toward their destinations. Now, we need to understand what happens when traffic leaves a private network and enters the public internet. This is where network address translation or NAT
272:02
Speaker A
becomes important. And when many devices share one public IPv4 address, PAT helps the router keep their connections separate. What you will learn in this video. You will learn what NAT is, why NAT is used, how NAT changes an IP
272:21
Speaker A
address, what PAT adds to the process, how multiple devices can share one public IP, and why NAT matters in cyber security. The simple idea. Let's imagine a small home network. Your laptop has 1 192.168.1.1.
272:40
Speaker A
Your phone has 1 192.168.1.11 and another device has 1 192.168.1.12. These are private IP addresses. Your router also has a public IP address provided by your internet service provider. For example, 203.0.11350.
273:08
Speaker A
Now your laptop wants to access a website. The laptop sends traffic toward the router, but the private IP address is meant for the private network. The router can translate the private source address into its public address before sending the traffic toward the internet.
273:27
Speaker A
This process is called network address translation or NAT. So in simple terms, private network then NAT router then public internet. How NAT translates an IP address? Let's follow one connection.
273:43
Speaker A
Our laptop has 1 192.168.1.1 O and it wants to communicate with a web server 1 198.51.1.2.
273:57
Speaker A
Before translation, the traffic can be represented as source 1 192.168.1.1 O destination 1 198.5.1.2 O. The router receives this traffic. It can translate the private source IP into its public IP source 203.0.113.5 O destination 1 98 51 1.1.1.2
274:30
Speaker A
O. The destination server now sees the connection coming from the router's public IP. The router also keeps track of the translation so that returning traffic can be sent back to the correct internal connection. This is the basic idea behind NAT. How PAT allows many
274:49
Speaker A
devices to share one public IP. Now imagine several devices are using the same router. If they all share one public IP address, how does the router know which connection belongs to which device? This is where PAT or port
275:08
Speaker A
address translation becomes important. Remember from earlier videos that ports help identify communication endpoints. For example, two devices might create connections like 1 92.168.1.1 and 1 92.168.11 O2. The router can translate these connections to the same public IP while
275:38
Speaker A
using different port mappings. For example 203.0.113.5 col 4 OI1 and 203.0.13 col 4 O2.
275:57
Speaker A
The exact port numbers are only examples. The important idea is that the router uses the port information to distinguish the different connections.
276:07
Speaker A
This allows many private devices to share a single public IPv4 address. That is why PAT is extremely common in home and small business networks. Follow the traffic. Let's put the process together.
276:23
Speaker A
Your laptop wants to access an HTTPS website. The laptop has 1 192.168.1.1 O. It creates a connection using a source port. For example, 1 192.168.1.151.
276:44
Speaker A
The destination server might be 1 98.51.1.2443. The traffic reaches the router. The router translates the private address and port into a public address and port 203.0.113.5 col4 01.
277:08
Speaker A
The traffic then continues toward the internet. When the response comes back, the router checks its translation information. It knows that the connection belongs to 1 92.1 68.1 col 5 0 O1.
277:28
Speaker A
So the router sends the response back to the laptop. This entire process happens very quickly. Practical observation.
277:36
Speaker A
Let's observe the network information from our Linux machine. Use your own Linux system or an authorized virtual machine. First run ip adder. This shows the network interfaces and their assigned addresses. You may see something similar to inet 10.74.36
277:57
Speaker A
144/24. Your address will be different. Notice that the machine has a private IP address. Now run IP routt. You may see default via 10.74.36.193D etho.
278:15
Speaker A
This shows the default route. The address after via is the router that the machine uses as its next hop for traffic outside the local network. This demonstrates the important relationship.
278:27
Speaker A
private IP address, then default gateway, then NAT and PAT and finally the public internet. The actualNAT translation happens on the router or gateway. So we are observing the information around that process rather than pretending the Linux host itself is
278:50
Speaker A
performing NAT cyber security connection.NAT NAT is important in cyber security because the public IIP address does not always identify one individual device. One public IP could represent many private devices. For example, 203.013.5.
279:11
Speaker A
O could represent 1 92.168.1.192.168.1.1192.168.1.12 and many more. So when investigating network activity, security professionals may need more than a public IP address.
279:34
Speaker A
They may use source ports, timestamps, net translation logs, firewall logs, DHCP records. These additional records can help connect external traffic to the internal device that generated it. One more important point,NAT is not the same as a firewall.NAT translates addresses and maintains
279:59
Speaker A
connection mappings. A firewall applies security rules to allow, block, or inspect traffic. So, NAT can be part of a network's design, but it should not be treated as a complete security control.
280:15
Speaker A
Recap. Let's quickly review.NAT stands for network address translation. It translates IP addresses between network address spaces. PAT uses ports along with IP addresses to distinguish multiple connections. This allows many private devices to share one public IPv4 address. And from a cyber security
280:40
Speaker A
perspective, understanding NAT helps us connect public network activity with the private systems behind it. So far, we have looked at how traffic can leave a private network and reach the internet.
280:54
Speaker A
But what happens inside that local network? How does a switch decide where to send a frame? And how can one physical network be divided into separate logical networks? That's what we will explore next in switching and VLANs.
281:15
Speaker A
Inside a local network, many devices may be connected to the same switch. But when a frame arrives, how does the switch know where to send it? And what if we want to separate one physical network into different logical networks?
281:31
Speaker A
The answer starts with switching and vans. In the previous videos, we followed traffic beyond the local network. We learned how routers forward packets between networks and how NAT and PAT allow private devices to communicate through a public network. Now let's move
281:50
Speaker A
back inside the local network. Here switches play a different role from routers. A switch mainly works with frames and MAC addresses to move traffic between devices on the same local network. Then we will see how vans can logically separate that network. What
282:11
Speaker A
you will learn in this video you will learn what switching means. How a switch forwards frames. How a switch learns MAC addresses. What a MAC address table is.
282:23
Speaker A
What a van is. Why vans are used and why switching and vans matter to cyber security. The simple idea. Imagine four computers connected to one switch.
282:36
Speaker A
Computer A wants to communicate with computer B. The frame enters the switch. The switch needs to determine where that frame should go. This is where the MAC address becomes important. Remember from video five, a MAC address identifies a
282:55
Speaker A
network interface at the local network level. The switch uses MAC addresses to make forwarding decisions. Think of the switch like a receptionist who learns which person is located in which room.
283:09
Speaker A
Once it knows where someone is, it can send the message directly to the correct room. In networking, the switch learns which MAC address is associated with which switch port. How a switch forwards frames. Let's look at what happens when
283:26
Speaker A
a frame reaches a switch. Suppose computer A sends a frame to computer B. The frame contains information about its source and destination MAC addresses.
283:39
Speaker A
The switch receives the frame. It looks at the source MAC address and can learn this MAC address is connected to this port. It then looks at the destination MAC address. If the switch already knows where that MAC address is located, it
283:56
Speaker A
can forward the frame through the appropriate port. This information is stored in a structure commonly called a MAC address table. For example, a a a01 port one bb 02 port 2 cc cc 03 port 3. The exact format depends on the switch. The
284:20
Speaker A
important idea is simple. MAC address maps to a switch port. This allows the switch to make forwarding decisions inside the local network. What happens when the switch does not know the destination?
284:35
Speaker A
Now imagine the switch receives a frame for a destination MAC address that is not currently in its table. What can it do? In a typical Ethernet network, the switch may flood the frame out other ports within the same van except the
284:52
Speaker A
port where the frame arrived. The destination device can then respond. The switch can learn from the response and update its MAC address table. Over time, the switch builds a better understanding of where devices are connected. This is one reason switches can efficiently
285:12
Speaker A
forward local network traffic. But notice something important. A switch and a router are not doing the same job. A switch primarily forwards frames within a local network. A router forwards packets between different networks. That distinction will become very important
285:32
Speaker A
later when we analyze traffic. What is a vlan? Now let's introduce another important concept.
285:41
Speaker A
Imagine an organization has one large physical network. There are computers for employees servers, guests, security systems. They could all be connected to the same physical switching infrastructure.
285:55
Speaker A
But we may not want all of these devices to behave as if they are on one large local network. This is where vans come in. VLAN stands for virtual local area network. A van allows a physical switching infrastructure to be divided
286:11
Speaker A
into separate logical networks. For example VL10 employees VL20 servers, V L30 guests. Even though these devices may use the same physical switch infrastructure, the VLANs logically separate their layer 2 traffic. This can improve organization, control, and network segmentation.
286:38
Speaker A
How VLANs control local traffic. Let's imagine a device in VLAN 10 sends a frame. That frame normally stays within VLAN 10 at layer 2. A device in VLAN 20 does not simply receive that frame just because both devices are connected to
286:56
Speaker A
the same physical switch. This gives network administrators a way to separate groups of devices. But what if a device in VL10 needs to communicate with a device in VL20?
287:10
Speaker A
That communication requires layer 3 routing between the VLANs. In other words, same V L layer 2 switching different V LS layer three routing is required. This is an important connection between today's lesson and our earlier lesson on routting. VLANs therefore do more than
287:33
Speaker A
organize devices. They can also support network segmentation, practical observation and cyber security connection. We can use Linux to observe the network interfaces and van related information available on our system. Run IP link. This command displays network interfaces and their link layer
287:57
Speaker A
information. On a normal machine, you may simply see interfaces such as E T0, WL A0, or names such as E N P O S3, WLP2SO.
288:12
Speaker A
The exact names depend on your system. Linux can also represent VLAN interfaces. For example, on a system where a VLAN has been configured, you may see an interface with a name such as ETH0.10.
288:27
Speaker A
The 10 commonly represents van I D10. The important point is not to memorize the interface name. It is to understand that vans can create logical network separation on top of physical networking. From a cyber security perspective, this matters because
288:47
Speaker A
network separation can reduce unnecessary communication between systems. For example, guest devices should not automatically have the same level of network access as internal servers. VLANs can help create that separation, while routting and firewall policies can control communication between the different networks.
289:12
Speaker A
Recap. Let's quickly review what we learned. A switch forwards frames within a local network. It uses MAC addresses to make forwarding decisions.
289:24
Speaker A
A switch can learn which MAC address is associated with which port and store that information in a MAC address table.
289:33
Speaker A
A van or virtual local area network creates a logical layer 2 network within a physical switching infrastructure. And when different vans need to communicate, layer 3 routting is required. We now understand how switches move traffic inside a local network and how vans can
289:55
Speaker A
separate that traffic. But there is one important piece we have been using throughout this course. When your computer wants to communicate with something outside its local network, where does it send the packet first?
290:11
Speaker A
That device is called the default gateway. And that is what we will understand in the next video.
290:23
Speaker A
Your computer knows its own IP address. It also knows the IP address of another device. But what happens when that device is outside your local network?
290:35
Speaker A
Who does your computer send the traffic to? The answer is the default gateway. In the previous videos, we learned how traffic moves through networks. We learned that switches forward frames inside a local network. We also learned that routers forward packets between
290:54
Speaker A
different networks. But there is one important question from the perspective of your computer. How does the computer know where to send traffic when the destination is not on the local network?
291:08
Speaker A
That is where the default gateway comes in. What you will learn in this video? You will learn what a default gateway is, why a computer needs one, the difference between local and remote destinations, how a computer uses the default gateway,
291:27
Speaker A
how this connects to rooting, how to observe your default gateway on Linux, why security professionals care about gateway configuration. The simple idea.
291:40
Speaker A
A default gateway is the device your computer sends traffic to when the destination is outside its local network. In most common networks, the default gateway is a router. Think of your local network as a building. Your computer is inside the building. If you
292:00
Speaker A
want to communicate with another device in the same building, you may be able to reach it directly through the local network. But if you want to reach something outside the building, you need an exit. The default gateway is like
292:12
Speaker A
that exit point. For example, imagine your computer has IP address 1 92.168.1.2 and your local network is 1 192.168.1.0/24.
292:33
Speaker A
Your computer can communicate directly with other devices in that same network. But what if it wants to reach 8.8.8.8?
292:41
Speaker A
That destination is outside the local network. So the computer sends the traffic to its default gateway such as 1 192.168.1.1 local versus remote destinations.
292:57
Speaker A
To understand the default gateway, we need to understand one important decision. Your computer needs to determine is the destination on my local network or somewhere else. Your computer uses its IP address and subnet information to make this decision. We
293:16
Speaker A
learned about subnet masks and CID earlier in the course. For example, computer 1 92.168.1.2 20/24 local network 1 192.168.1.0/24 If the destination is 1 192.168.1.5 oh that destination is on the same local network but if the destination is 10.0.5
293:46
Speaker A
0.0.5 it is on a different network. So the basic idea is same local network communicate through the local network different network send traffic toward the default gateway. The default gateway is therefore not a gateway for every packet. It is used when the destination
294:07
Speaker A
requires traffic to leave the local network. How the default gateway works? Let's follow a simple example. your computer 1 92.168.1.2 O default gateway 1 192.168.1.1 destination 8.8.8.8 Your computer first determines that 8.8.8.8 is not part of its local network. So it
294:38
Speaker A
needs to send the packet to the router. The computer forwards the traffic toward 92.168.1.1.
294:50
Speaker A
The router then examines the destination IP address and makes a routing decision. This connects directly to what we learned in video 20. The computer uses the default gateway as its next hop, while the router uses its own routting
295:07
Speaker A
table to determine where to forward the packet next. There is an important detail here. For IPv4 on a typical Ethernet network, a computer still needs a local layer 2 destination to deliver the frame to the gateway. This is where our earlier
295:24
Speaker A
lesson on ARP becomes useful. The computer can use ARP to discover the MAC address associated with the gateway's local IP address. So several concepts we learned earlier now connect together. IP address determines the network destination. Subnet information helps
295:47
Speaker A
determine local or remote default gateway. Provides the next hop for remote traffic. A RP can discover the gateways MAC address on a local IPv4 network router. Forwards the packet toward the destination.
296:04
Speaker A
This is exactly why networking concepts become more useful as we connect them together. Visualize the complete flow.
296:12
Speaker A
Let's put everything together. Imagine a laptop connected to a home router. The laptop has IP address 192.168.1.20.
296:25
Speaker A
The router has LAN IP address 192.168.1.1. The destination is 8.8.8.8. The process looks like this. Laptop 192.168.1.20.
296:45
Speaker A
Then the default gateway 192.168.1.1 then the router. Then the internet. And finally the destination. 8.8.8.8.
297:02
Speaker A
Eight. The important point is that the laptop does not need to know the complete internet path. It only needs to know where to send the traffic next. The default gateway provides that first step. After that, routers along the path
297:20
Speaker A
make their own forwarding decisions. Practical observation on Linux. Now, let's observe the default gateway on a Linux system. Use your own Linux machine or an authorized virtual machine. Run IP route. This command displays the systems IP routting information. You may see
297:43
Speaker A
something similar to this. The most important part for this lesson is default via 10.569.167.
297:54
Speaker A
The word default means this route can be used when there is no more specific route for the destination. Via 10.56967 tells us the next hop gateway and dev ho tells us which network interface Linux will use. Your interface may have a
298:16
Speaker A
different name such as WL0, ENP0 S3 or WLP2S0. The exact output depends on your system and network. You can also ask Linux how it would route traffic to a specific destination.
298:34
Speaker A
For example, IP route get 8.8.8.8. This asks Linux to show the route it would use to reach that destination.
298:46
Speaker A
This gives us a practical way to observe the same routting decision we just learned conceptually.
298:54
Speaker A
Cyber security connection. The default gateway is important in cyber security because it sits at a critical point in network communication.
299:05
Speaker A
If a device has an incorrect gateway, it may not be able to reach external networks. From a security perspective, professionals also need to understand where traffic is expected to leave a network. During network investigation and troubleshooting, they may examine IP
299:26
Speaker A
configuration, routting information, default gateways, network interfaces, traffic paths, gateway, and router logs. Unexpected gateway configuration can also be a security concern because network traffic may be redirected through an unintended device.
299:46
Speaker A
Understanding the normal gateway configuration helps a security professional recognize when network behavior does not look normal. The key idea is simple. You cannot properly understand network traffic without understanding where that traffic is supposed to go. Recap. Let's quickly
300:07
Speaker A
review. A default gateway is the device a host uses to reach destinations outside its local network. A computer determines whether a destination is local or remote using its IP address and subnet information. For remote destinations, the computer sends traffic
300:27
Speaker A
toward its default gateway. On typical IPv4 local networks, ARP can help the computer discover the gateway's MAC address, and the router then uses its routing information to forward the packet toward its destination.
300:45
Speaker A
We now understand how a computer reaches destinations through its default gateway. But there is another useful question. How can we test whether a destination is reachable and how can we observe the response? That brings us to I c and ping. In the next video, we will
301:04
Speaker A
see how ping tests network connectivity and how I c messages move through the network.
301:17
Speaker A
You send a request across a network, but how do you know if the destination is reachable, how can you test the connection without opening a website or logging into a service? One of the simplest answers is ping. Behind ping is
301:33
Speaker A
an important networking protocol called MP. In the previous video, we learned about the default gateway. We saw how a computer sends traffic toward its gateway when the destination is outside the local network. Now we need a way to
301:52
Speaker A
test whether communication is actually working. That is where Imping become useful. ICMP helps network devices communicate information about network conditions and errors. And the ping utility uses ICMP messages to test whether a destination can respond. What you will learn in this video. You will
302:16
Speaker A
learn what ICMP is, what ping does, how an ICMP echo request and echo reply work, what ping output means, how to use ping on Linux, what packet loss and response time tell you, why I cmp matters in cyber security. The simple
302:37
Speaker A
idea. Imagine you want to check whether someone is available. You could send them a simple message. Are you there? If they respond, "Yes, I'm here." You know, communication is working. Ping follows a similar idea. Your computer sends an MP
302:54
Speaker A
echo request to a destination. If the destination responds with an MP echo reply, your computer knows that the destination was able to respond. So, the basic flow is echo request destination echo reply. This does not mean that every service on the destination is
303:14
Speaker A
working. It simply tells us that the destination responded to the CMP request. The real networking concept stands for internet control message protocol. It is a network layer protocol used by IP networks to exchange control, diagnostic and error information. One of
303:37
Speaker A
its best known uses is network troubleshooting. Ping commonly uses two message types. Echo request. This is the message sent toward the destination.
303:50
Speaker A
Echo reply. This is the response sent back. This is important because different from TCP and UDP. TCP and UDP are commonly used to carry application traffic. ICMP is mainly used for network control, diagnostics, and error reporting. For example, ICMP can also be
304:14
Speaker A
involved when a router needs to report certain network conditions such as an unreachable destination. How ping works?
304:22
Speaker A
Let's follow a simple example. Your computer has 1 192.168.1.2 and you want to test 8.8.8.8.
304:34
Speaker A
Eight. Your computer creates an ICMP eco request and sends it toward the destination. If the destination receives the request and is configured to respond, it sends an CMP echo reply back. Your computer measures how long the exchange takes. This gives us a
304:54
Speaker A
value commonly called roundtrip time or RT. For example, 20 milliseconds means the request traveled to the destination and the reply returned in about 20 milliseconds.
305:08
Speaker A
A higher value can indicate greater network delay. If packets do not receive replies, ping may report packet loss.
305:18
Speaker A
But remember, no ping response does not automatically mean the destination is offline. A firewall or network policy may block or ignore CMP.
305:31
Speaker A
This is an important lesson for cyber security and troubleshooting. Visualize ping results. Let's imagine a simple ping result. You might see something similar to 64 bytes from 8.8.8.8 sequence 1 TTL 117 time 20.4C 4 milliseconds. There are several useful pieces of information
305:57
Speaker A
here. 64 bytes. This shows the size of the received CCMP message in this example. ICMP SEQ. This identifies the sequence number of the request. TTL. This is the IP time tolive value included in the response.
306:17
Speaker A
We will use TTL more deeply later when we analyze network paths and traffic time. This shows the approximate roundtrip time. At the end, ping normally provides a summary. For example, four packets transmitted, four received, 0% packet loss. This tells us
306:38
Speaker A
that all four requests received replies. The summary may also show minimum, average, and maximum response times.
306:47
Speaker A
This makes ping useful as a quick connectivity observation tool. Practical observation on Linux. Now let's test ping on a Linux system. Use your own Linux machine, personal network, or an authorized virtual machine. First, we can test a local device such as the
307:06
Speaker A
default gateway, for example, ping- c410.569.167. The - C4 option tells Linux to send four ICMP echo requests and then stop. The IP address should be replaced with your actual gateway. If it is different, you may see output similar to this. Now look
307:33
Speaker A
at the summary. You can observe how many packets were transmitted, how many were received, whether packet loss occurred, the roundtrip times. Because we are testing the local gateway, the response time may be very small. Next, you can test another destination that allows
307:53
Speaker A
CMP, for example, ping- c48.8.8.8. The result helps you observe connectivity beyond your local network.
308:06
Speaker A
But remember, a failed ping does not prove that the destination is offline. It could be filtering CMP or blocking echo requests. The important skill is learning to interpret the evidence rather than jumping to conclusions.
308:24
Speaker A
Cyber security connection ping is simple but it becomes useful in security work because it provides information about network behavior. A security professional may use observations during network troubleshooting to determine whether communication is working. Reconnaissance in authorized environments to understand
308:49
Speaker A
whether systems respond to network probes. Incident investigation to compare expected and unexpected network behavior. Network monitoring to identify unusual CMP activity or unexpected communication patterns. For example, a network may normally contain very little traffic. A sudden increase in ICMP
309:13
Speaker A
traffic could be worth investigating. But the presence of ICMP alone does not mean an attack is happening. As security professionals, we need to look at the wider context. And this is an important mindset for the rest of the course.
309:30
Speaker A
Network evidence should be analyzed, not assumed. Recap. Let's review the key ideas. ICMP is a network layer protocol used for control diagnostics and error information. PING commonly uses CMP echo requests and echo replies to test whether a destination responds. Ping can
309:54
Speaker A
show response time, packet loss, sequence information, other useful network details, but a failed ping does not automatically mean a destination is offline.
310:07
Speaker A
Firewalls and network policies can block or ignore. And from a cyber security perspective, ICMP observations can help with troubleshooting, reconnaissance in authorized environments, monitoring, and investigation.
310:25
Speaker A
We have now completed level two. We started by learning how names become IP addresses. Then we learned how devices receive configuration, discover each other, communicate through HTTP and HTTPS, exchange packets, use routting,NAT, switching, VLANs and default gateways.
310:48
Speaker A
And now we know how CMP and ping can help us observe connectivity. But understanding how networks work is only the beginning. The next question is how can we observe the path that traffic actually takes across a network? That is
311:05
Speaker A
where tracer route comes in. In video 25, we begin the next stage of the course, practical networking and security. When you connect to a server on the internet, your traffic usually does not travel directly from your computer to that server. It may pass
311:24
Speaker A
through multiple routers along the way. But how can you see that path? How can you discover the network hops between your computer and a destination? This is where tracer route becomes useful.
311:39
Speaker A
So far in this course, we have focused on understanding how networks communicate. We learned about IP addresses packets routting NAT switching, default gateways, and connectivity testing with ping. Now we are entering level three practical networking and security. The goal is no
312:01
Speaker A
longer just to understand what happens. We are going to start observing real network behavior. Our first tool is tracer route. Tracer route helps us discover the path that packets take toward a destination by showing the network hops along the way. On Windows,
312:20
Speaker A
the equivalent command is called trace it. What you will learn in this video? You will learn what tracer route is, what a network hop means, how tracer route reveals a path, the difference between tracer route and ping, how to
312:37
Speaker A
use tracer route on Linux, how to interpret the output, why tracer route is useful in networking and cyber security.
312:47
Speaker A
A simple idea. Let's start with something we already understand. In video 24, we used ping to ask, "Can I reach this destination?" But ping mainly tells us whether the destination responds and gives us information such as response time. It does not normally
313:06
Speaker A
show the complete path between your computer and the destination. Tracer route answers a different question. Which routters are along the path to this destination?
313:18
Speaker A
Think about traveling to another city. You may know that you reached the destination, but you may also want to know which roads and cities you passed through. Tracer route gives us a similar view of the network path. What is a
313:34
Speaker A
network hop? A hop is one step from one routting device to another along a network path. For example, computer, then router A, then router B, then router C, and finally the server. Here, router A, router B and router C
313:53
Speaker A
represent different hops along the network path. This is important because the internet is made up of many interconnected networks. Your computer usually does not know every router that exists between itself and a remote destination.
314:10
Speaker A
Instead, each router makes its own forwarding decision based on the destination IP address. We learned about this in video 20 when we studied rooting. Tracer route gives us a way to observe part of that journey. How tracer route works. Now let's look at the basic
314:31
Speaker A
idea behind tracer route. Tracer route sends packets with different TTL or time to live values. We already know that packets travel through routers. The TTL value limits how many router hops a packet can pass through before it expires. For example, tracer route can
314:51
Speaker A
start with a TTL of one. The first router receives the packet. The TTL reaches zero so that router sends an MP message back. Tracer route can then try again with a higher TTL.
315:07
Speaker A
For example, TTL1. First router responds TTL2. Second router responds TTL3. Third router responds and this continues until the destination is reached or the tracing process stops. This allows tracer route to gradually reveal the path. The exact behavior can vary
315:28
Speaker A
depending on the operating system, tracer route implementation and network devices. Some routers may not respond to tracer root probes. That is why you may sometimes see three asterisks instead of an IP address and response time. This does not automatically mean the network
315:49
Speaker A
is broken. It may simply mean that a device or firewall is not responding to that type of probe.
315:58
Speaker A
Visualize the network path. Let's imagine we want to reach a remote server. Our computer sends traffic toward the destination. Tracer route helps reveal something like hop one, local router, hop two, ISP, router, hop three, another network, hop four,
316:19
Speaker A
another router, hop five, destination network. Each hop represents another routing point along the path. This connects directly to what we learned earlier. Your default gateway is usually the first router your computer uses when reaching a remote network. After that,
316:39
Speaker A
other routers can forward the traffic toward the destination. Tracer route does not mean that every packet in every connection will always follow exactly the same path. Internet routting can change. Different traffic may also take different paths. So tracer root should
317:00
Speaker A
be understood as an observation of a path at a particular time. Practical observation on Linux. Now let's use tracer root on Linux. Depending on your distribution, the tracer root utility may already be installed. You can run tracer routt 8.8.8.8.
317:23
Speaker A
Let's focus on the output. You may see something similar to this. your actual results will be different. The first column is the hop number. The next value is the address responding for that hop.
317:37
Speaker A
And the time values show approximately how long the probes took to receive responses. For example, 110.163.23 4.111.972 milliseconds may represent your local gateway. The later hops represent routers farther along the path. You may also see three asterisks. This means
318:05
Speaker A
tracer route did not receive a response for that probe. Again, this does not automatically mean that the router or destination is unreachable. Now, notice the difference between the two tools.
318:18
Speaker A
With ping, we mainly ask, can I reach the destination and how quickly does it respond? With tracer route we ask what network path can I observe toward that destination.
318:33
Speaker A
Both tools are useful but they answer different questions. Cyber security connection. Tracer route becomes useful to cyber security professionals because understanding network paths helps us understand how systems communicate.
318:49
Speaker A
For example, during authorized network troubleshooting or investigation, tracer route can help identify the local gateway, intermediate network hops, possible routting changes, where delays may appear, where responses stop. This can help a security professional build a better picture of the network. However,
319:14
Speaker A
tracer route does not reveal everything about a network. Some devices hide or filter responses and a tracer route result should never be treated as a complete map of an organization's infrastructure.
319:30
Speaker A
In security work, it is one piece of evidence that can be combined with other information.
319:37
Speaker A
This is an important change in level three. We are moving from simply learning networking concepts to observing real network behavior and interpreting evidence. Recap. Let's review what we learned. Tracer route is a network diagnostic tool that helps reveal the path toward a destination. A
319:59
Speaker A
hop represents a routting step along that path. Tracer route uses varying TTL values to identify intermediate network devices. Tracer routt is commonly used on Linux while Windows provides trace it and unlike ping which mainly tests reachability and response time. Tracer
320:22
Speaker A
route helps us investigate the path toward a destination. Now we can see the path that traffic may take through a network. But there is another question we need to answer. How are IP networks actually divided into smaller networks? And how do we
320:40
Speaker A
calculate which addresses belong to each one? In the next video, we will move into practical IPv4 subnetting.
320:54
Speaker A
Imagine you are given a network with hundreds of devices. You do not want every device to be placed into one large network. You want to divide that network into smaller organized networks. But how do you calculate those smaller networks?
321:13
Speaker A
How do you know which IP addresses belong to each subnet? And how can you determine the network address, usable host range, and broadcast address? That is what we are going to learn in this video. Welcome to video 26 IPv4
321:30
Speaker A
subnetting practical. In the previous video, we learned how tracer route helps us observe the path traffic takes across a network. Now, we are going deeper into something we introduced earlier in the course, IPv4 subnetting. In level one, we learned that a subnet mask and CID
321:52
Speaker A
notation tell us how an IPv4 network is divided. Now, in level three, we are going to use that knowledge practically.
322:02
Speaker A
Instead of only understanding what /24 or/26 means, we are going to calculate real subnets and understand exactly which addresses belong to them.
322:15
Speaker A
What you will learn in this video? You will learn what subnetting means in practice. How a subnet divides an IPv4 network. How to calculate the network address. How to find the usable host range. How to find the broadcast
322:33
Speaker A
address. How to calculate the number of usable hosts. How to observe subnet information on Linux. and why subnetting matters in cyber security. The simple idea. Let's start with the basic idea. A network does not always need to be one
322:52
Speaker A
large group of devices. Subnetting allows us to divide one IPv4 network into smaller networks called subnets.
323:02
Speaker A
Think about a large office building. Instead of putting every department into one huge room, we can divide the building into smaller sections.
323:11
Speaker A
For example, employees, servers, guests, management. Each section can have its own network. The important idea is subnetting divides a larger network into smaller networks. This gives us better organization, more efficient address usage, and better control over network communication. The real networking
323:35
Speaker A
concept. Let's use a real IPv4 network. 1 92.168.1.0/E24. The /24 tells us that the first 24 bits are the network portion. That leaves 8 bits for host addresses. With eight host bits, we have 2 to the^ of 8, which
324:00
Speaker A
equals 256 total addresses. But not all 256 addresses can normally be assigned to devices. First address is the network address. The last address is the broadcast address. So 1 92.168.1.0 is the network address. 1 92.168.1.255 is the broadcast address. That leaves 1
324:31
Speaker A
192.168.1.1 through 1 92.168.1.254 as usable host addresses. That gives us 254 usable host addresses. Now let's make the network smaller. Suppose we change 1 92.168.1.0/24 /24 to 1 192.168.1.0/26.
325:02
Speaker A
We have borrowed two bits from the host portion. That gives us 2 to the^ of 2 which equals four subnets. Each /26 subnet contains 2 to the^ of 6 which equals 64 total addresses. After removing the network and broadcast
325:22
Speaker A
addresses, we have 62 usable host addresses per subnet. How to calculate a subnet? Let's calculate the /26 network step by step. Our original network is 1 192.168.1.0/24.
325:41
Speaker A
We want/26. The interesting part is the last octet. For /26 the subnet mask is 255.255.255.192.
325:55
Speaker A
Now calculate the subnet block size. We use 256 - 192= 64. So the subnet boundaries increase by 64. That gives us 1 192.168.1.0192.168.1.64.
326:16
Speaker A
64192.168.1.128192.168.192. These are the four network addresses. Let's look at the first subnet. Subnet 1 network address 1 92.168.1.0 O usable hosts 1 92.168.1.1 to 1 92.168.1.62 Broadcast 1 192.168.1.63 Subnet 2 Network address 1 192.168.1.64 Usable hosts 1 192.168.1.65
327:03
Speaker A
65 to 1 192.168.1.126. Broadcast 1 92.168.1.127. Subnet 3. Network address 1 92.168.1.128. Usable hosts 1 9 to2.168.12 91 92.168.1.19.
327:30
Speaker A
O. Broadcast 1 92.168.19 1. Subnet 4. Network address 1 92.168.192. Usable hosts 1 192.168.1.193 to 1 192.16E8.1.254.
327:53
Speaker A
Broadcast 1 192.168.1.255. 255. This is the practical power of subnetting. We started with one/24 network containing 254 usable host addresses. We divided it into four smaller/26 networks. Each subnet now has 62 usable host addresses. Visualize the network. Let's imagine a small
328:22
Speaker A
organization. We have 1 192.168.1.0 0/24 we divide it into 4/26 subnets subnet 1 employees 1 192.168.1.0/26 subnet 2 servers 1 192.168.1.64/26 6 4/26 subnet 3 guests 1 192.168.1.128/26 subnet 4 management 1 9 2.168.192/26 Now devices can be organized into
329:08
Speaker A
different IP networks but remember something important from our earlier routting lessons Different IIP networks normally require a layer 3 device such as a router or layer 3 switch to communicate between them. So subnetting creates the logical boundaries. Rooting controls
329:29
Speaker A
communication between those networks. This connects directly to what we learned in video 20 about rooting.
329:37
Speaker A
Practical observation. Now let's observe subnet information on Linux. run ip add a look for your network interface and an address similar to inet 10.55 1834/24.
329:56
Speaker A
The /24 is the cirr prefix assigned to that interface. It tells Linux how large the local IPv4 network is. You can also use IP route. You may see something similar to 10.55.183.0/24 dev eth proto kernel scope link sr c
330:22
Speaker A
10.5583.144. Here Linux is showing the connected network 10.5583.0/24 0/24 and the source address 10.55 183.144.
330:45
Speaker A
The exact interface name and IP address will depend on your system. The important thing is to recognize the relationship between the IP address and the CIR prefix. For example, 10.55.183.144/24 means the device belongs to the 10.5583.0/24 network. This is where subnetting
331:20
Speaker A
becomes practical. You are no longer just looking at numbers. You can determine which network an address belongs to and understand how that network is divided. Cyber security connection subnetting is extremely important in cyber security. Security professionals often need to understand
331:42
Speaker A
how a network is divided. For example, an organization might separate user devices, servers, guest devices, security systems, management systems into different subnets. This can reduce unnecessary communication and make security controls easier to apply during authorized network assessment.
332:06
Speaker A
Understanding subnet ranges also helps a security professional understand the scope and structure of a network. And during incident investigation, an IP address is much more useful when you understand which subnet it belongs to.
332:23
Speaker A
For example, if an alert shows traffic from 1 192.168.170 and you know that 1 92.168.1.64/26 is the server subnet that immediately gives you useful network context.
332:43
Speaker A
Subnetting therefore helps connect IP address, then subnet, then network structure, then traffic, and finally security analysis. Recap. Let's quickly review what we learned. Subnetting divides a larger IPv4 network into smaller networks. A /24 network has 256 total addresses and normally 254 usable
333:12
Speaker A
host addresses. A /26 network has 64 total addresses and normally 62 usable host addresses. The network address identifies the subnet. The broadcast address is the last address in the subnet and the addresses between them are normally used by hosts. Most
333:34
Speaker A
importantly, subnetting helps us understand the structure and boundaries of an IPv4 network. Now, we know how IPv4 networks are divided. But IPv4 is not the only addressing system used on modern networks. There is another version of IP designed to provide a much
333:55
Speaker A
larger address space. It uses addresses that look very different from IPv4. In the next video, we are going to explore IPv6.
334:07
Speaker A
We will learn what IPv6 looks like, why it was created, and how it works. See you in video 27.
334:20
Speaker A
We learned how IPv4 addresses identify devices on a network. But there is a problem. IPv4 provides a limited number of addresses and the internet has grown far beyond what was originally expected.
334:35
Speaker A
So what happens when we need a much larger address space? The answer is IPv6.
334:42
Speaker A
And when you first see an IPv6 address, it may look confusing. something like this. So, what do all those numbers mean? Let's break it down. In the previous video, we went beyond the theory of IPv4 and practiced subnetting.
334:59
Speaker A
Now, we are continuing level three by looking at the other major version of Internet Protocol, IPv6.
335:07
Speaker A
Internet protocol version 6. You already learned about IPv4 and IPv6 in level one. This time we are not going to repeat the basic definition. Instead we are going to build a practical understanding of how IPv6 addresses look, how they are written,
335:27
Speaker A
[clears throat] the major address types you will encounter and how to observe IPv6 on Linux. What you will learn in this video you will learn why IPv6 was created. How IPv6 addresses are structured. How IPv6 notation works?
335:45
Speaker A
What address compression means? Common IPv6 address types. What 64 means in IPv6. How to observe IPv6 on Linux and why IPv6 matters in cyber security. One, the simple idea. Let's start with the main difference. IPv4 uses 32 bits. IPv6
336:07
Speaker A
uses 128 bits. That is a massive increase in address space. An IPv4 address looks like 1 192.168.1.2 O. An IPv6 address can look like 201 DB8 col 1 2 3 4 col 567 8 col 1. IPV4 is written using four decimal numbers
336:34
Speaker A
separated by dots. IPv6 is written using hexadesimal values separated by colons. The reason IPv6 uses 128 bits is mainly to provide a much larger address space.
336:48
Speaker A
This makes it possible to assign addresses to an enormous number of devices and networks.
336:55
Speaker A
The real networking concept. An IPv6 address contains 128 bits. These are normally written as eight groups called hext. For example, 201 colb 8 colon 1 2 3 4 colon 5 6 7 8 colon o.
337:15
Speaker A
Each group contains four hexadesimal digits. Hexadimal uses 0 to 9 and 8 to f. So instead of only using decimal numbers from 0 to 9, IPv6 can use 16 possible symbols. Now writing every IPv6 address in its full form would be
337:34
Speaker A
inconvenient. So IPv6 allows addresses to be shortened. For example 2 O 1 col 8 1 2 3 4 col 5 6 7 8 O can be written as 20 O1 col D B 8 col 1 2 3 4 col 5 6 7 8 col 1. The leading
338:00
Speaker A
zeros inside a hexet can be removed and a continuous sequence of all zero hexets can be compressed using colon colon. The double colon can be used only once in an IPv6 address. This makes IPv6 addresses much easier to write and read. Common
338:19
Speaker A
IPv6 address types. You will encounter several important IPv6 address types. Let's look at the ones beginners should recognize first. Number one, loop back.
338:31
Speaker A
The IPv6 loop back address is colon 1. It refers back to the local device. It is similar to 127.0.0.1 in IPv4.
338:46
Speaker A
Number two, link local addresses. IPV6 devices commonly have a link local address beginning with F E80 followed by two colons. A link local address is used for communication on the local network link. It is not designed to identify the device across the public
339:05
Speaker A
internet. For example, F- E-H 2 1-2-3-4 colon 5678 colon A B C D colon EF01 the exact address will be different on each system number three global uniccast addresses these are globally routable IPv6 addresses they can be used for
339:33
Speaker A
communication across interconnected networks and the internet. For example, documentation commonly uses addresses from 20001 colon DB8 followed by two colons/32.
339:50
Speaker A
This range is reserved for documentation and examples. So when you see an address beginning with 20001 colon DB8, it is usually an example rather than a real public internet address. IPv6 prefixes and /64. Just like IPv4 uses CID
340:10
Speaker A
notation, IPv6 also uses prefix lengths. For example, 201 DB8 col 1 2 3 4 col 5678 col/64.
340:25
Speaker A
The / 64 tells us that the first 64 bits represent the network prefix. The remaining 64 bits can identify interfaces within that network. This is an important concept because you will frequently encounter IPv6 networks using /64.
340:44
Speaker A
But remember 64 does not mean every IPv6 network must always use /64. Different IPv6 designs can use different prefix lengths. The important lesson is to understand what the prefix length represents. It identifies the boundary between the network portion and the
341:06
Speaker A
interface portion of the address. Practical observation. Now let's look at IPv6 on a Linux system. Run IP minus 6 adder. The IP command is the Linux networking utility we have already used.
341:23
Speaker A
The minus 6 option tells it to show ipv6 information. You may see something similar to this. Your output will be different. Let's understand what we are seeing. The first address 1/128 is the IPv6 loop back address. The second address beginning with FE80
341:47
Speaker A
is a link local address. The slash 64 tells us the prefix length associated with that address. You can also use IP minus 6 route. This displays the IPv6 routing table. You may see roots for connected IPv6 networks and possibly a
342:06
Speaker A
default IPv6 route. Depending on how your system is configured, this is useful because IPv6 is not just about addresses. Those addresses participate in routing and communication just like IPv4 addresses do. If your system has working IPv6 connectivity, you can also
342:27
Speaker A
test it with ping- 6 col 1. This sends ICMPv6 echo requests to the local IPv6 loop back address. A successful response confirms that the local IPv6 stack is responding. Notice that we are using ping over IPv6, not IPv4.
342:48
Speaker A
This is a simple way to begin observing IPv6 behavior on a Linux system. Cyber security connection. IPv6 matters in cyber security because modern networks can use both IPv4 and IPv6 at the same time. This is sometimes called a dual
343:07
Speaker A
stack environment. That means a security professional cannot assume. If I checked IPv4, I checked the entire network. IPv6 may have its own addresses, roots, interfaces, traffic, firewall rules, and security policies. During authorized network assessment or troubleshooting, understanding IPv6 helps you identify
343:33
Speaker A
what network traffic is actually possible. During traffic analysis, IPv6 packets also look different from IPv4 packets and contain IPv6 specific information that a security analyst needs to recognize. And because IPv6 uses mechanisms that differ from IPv4, security tools and network controls must
343:57
Speaker A
be configured to handle both protocols correctly. So the cyber security lesson is simple. Do not ignore IPv6 just because IPv4 is more familiar. Recap.
344:09
Speaker A
Let's review the key ideas. IPv6 uses 128 bit addresses compared with 32-bit IPv4 addresses. IPv6 addresses are written using hexadimal values separated by colons. Long ipv6 addresses can be compressed using rules such as removing leading zeros and using colon colon for
344:33
Speaker A
consecutive zero groups. Colon colon 1 is the IPv6 loop back address. F8 colon addresses are commonly used for link local communication. IPv6 also uses CID style prefix lengths such as /64.
344:52
Speaker A
And on Linux we can observe IPv6 using commands such as IP-6 adder IP-6 root ping-6 colon col 1. Now we understand IPv4 subnetting and the basics of IPv6 but so far we have mostly been looking at network information from the
345:13
Speaker A
perspective of the operating system. What if we want to actually see the traffic itself? What if we want to inspect packets as they move across a network interface? That is where one of the most important tools for network
345:29
Speaker A
analysis comes in. In the next video we are going to start using Wireshark. See you in video 28.
345:42
Speaker A
So far we have learned how network communication works. We have studied IP addresses packets routting TCP DNS HTTP and more. But there is one important question. How can we actually see what is happening inside network traffic? How can we capture packets? How can we
346:05
Speaker A
inspect them? And how can we tell what a device is communicating with? This is where Wireshark becomes extremely useful. Welcome to video 28 Wireshark basics. In the previous videos, we moved from theory into practical networking.
346:24
Speaker A
We use tracer route to observe network paths. We practiced IPv4 subnetting. We also looked at IPv6 addresses and routting. Now we are taking the next step. Instead of only observing network configuration and paths, we are going to start looking directly at network
346:45
Speaker A
packets. Wireshark is one of the most widely used tools for this type of network analysis.
346:53
Speaker A
In this lesson, we will learn the fundamentals without going too deep into packet analysis yet. That comes in the next video. What you will learn? In this video, you will learn what Wireshark is, what packet capture means, how Wireshark
347:12
Speaker A
captures network traffic, how to choose a network interface, how to start and stop a capture, how to generate simple traffic, how to recognize basic packet information, and why Wireshark is important in cyber security. The simple idea. Think about everything your
347:32
Speaker A
computer does on a network. You open a website. You send a message. You perform a DNS lookup. You ping another device.
347:42
Speaker A
Behind these actions, network packets are moving between devices. Previously, we learned that a packet carries information from one point to another.
347:54
Speaker A
But until now, we have mostly represented those packets using diagrams. Wireshark allows us to observe actual network traffic. So the simple idea is Wireshark lets us capture and inspect network traffic. It gives us a window into what is happening on a network
348:14
Speaker A
interface. What is Wireshark? Wireshark is a network protocol analyzer. That means it can capture network packets and help us examine the protocols and information contained in those packets. When you start a capture, Wireshark listens on a selected network
348:33
Speaker A
interface. For example, your computer may have Ethernet or Wi-Fi as its active network interface. Wireshark can capture traffic that is visible to that interface depending on the operating system, interface configuration, permissions and network environment.
348:54
Speaker A
This distinction is important. Wireshark does not magically capture every packet on the internet. It captures traffic available to the interface you are monitoring. In a normal switch network, you will generally see traffic involving your own device, broadcast or multiccast
349:13
Speaker A
traffic and other traffic the network configuration makes visible to your interface. How a packet capture works.
349:23
Speaker A
Let's understand the process. First, you select a network interface. Then you start the capture. Wireshark begins collecting packets that the interface receives or sends. You then generate some network traffic. For example, you can use ping- C48.8.8.8.
349:44
Speaker A
The ping command sends CMP echo requests. The - C4 option tells Linux to send four requests and then stop. While those packets are moving through the interface, Wireshark can capture them.
350:01
Speaker A
You can then stop the capture and inspect what was recorded. This gives us a very useful workflow. Generate traffic capture inspect and understand. That workflow will become extremely important throughout level three. Understanding the Wireshark interface. When you open a capture in
350:23
Speaker A
Wireshark, you will normally see a list of packets. Each row represents a captured packet. You will see columns such as number. This is the packet number in the capture. Time. This shows when the packet was captured. Source, the address sending the packet.
350:42
Speaker A
Destination. The address receiving the packet. Protocol. The protocol wire sharkark identified. Length. The packet size. Info. Additional information about the packet. For example, a packet might show source 10.2. 227.222.1 O destination 8.8.8.8 protocol ICMP.
351:10
Speaker A
This tells us that our device sent an MP packet toward that destination. Notice how the concepts we learned earlier are now becoming useful. We already learned about IP addresses protocols packets. Now, Wireshark allows us to observe them together. Practical
351:31
Speaker A
observation. Let's perform a simple capture on a Linux system. Open Wireshark. You will see available network interfaces. Choose the interface that is currently carrying your network traffic. For example, it might be E T0 or WL A N0 or another
351:52
Speaker A
interface name such as E N P O S3 or WLP2SO. The name depends on your system. Start capturing on the active interface. Now open a terminal and run ping- C48.8.8.8.
352:11
Speaker A
After the four packets are sent, return to Wireshark and stop the capture. Now look through the packet list. You should be able to find CMP traffic generated by the ping. Assuming the traffic is visible on the selected interface and
352:28
Speaker A
the destination response. You may see packets such as echo request and echo reply. Now select one of the packets.
352:37
Speaker A
Wireshark will show more detailed information about that packet. You may see protocol layers such as frame, Ethernet, internet protocol version 4, internet control, message protocol. This is where our previous lessons start connecting together. Remember the OSI and TCPIP
352:59
Speaker A
models. Wireshark gives us a practical way to see information associated with different layers. for this video. Don't worry about understanding every field.
353:10
Speaker A
The goal is simply to become comfortable with the process. Capture, select, inspect. In the next video, we will learn how to read those packet details properly. Cyber security connection.
353:25
Speaker A
Wireshark is extremely useful in cyber security because network traffic can contain valuable evidence. A security professional may use packet captures to investigate questions such as what device communicated with another device, which protocol was used, when did the communication happen, which IP addresses
353:49
Speaker A
were involved, was the traffic encrypted, did something unusual happen. For example, during an authorized investigation, a packet capture might reveal unexpected communication between an internal device and another system.
354:06
Speaker A
Wireshark can help analysts examine that communication and determine what happened. It can also be useful for troubleshooting network problems. But remember, a packet capture is evidence, not automatically an explanation.
354:24
Speaker A
You need to understand the protocols and context before drawing conclusions. That is why everything we learned earlier in this course matters.
354:34
Speaker A
Wireshark becomes much more powerful when you understand networking. Recap. Let's review the key ideas.
354:43
Speaker A
Wireshark is a network protocol analyzer. It can capture and inspect network traffic visible to a selected network interface. A packet capture is a recorded collection of network packets.
354:57
Speaker A
The Wireshark packet list can show information such as source, destination, protocol, length, and info. We also performed a simple MP capture using ping- C48.8.8.8.
355:15
Speaker A
And most importantly, we learned the basic workflow. generate traffic, capture, inspect, and understand. Now, we know how to capture packets, but capturing packets is only the beginning.
355:29
Speaker A
The real skill is being able to look at a packet and understand what it is telling us. What does the Ethernet information mean? What does the IP header contain? What does MP tell us?
355:43
Speaker A
And how do these layers relate to the communication we already studied? In the next video, we are going to learn how to read packet captures and start interpreting the information inside real network packets. See you in video 29.
356:03
Speaker A
Capturing packets is one thing. Understanding what those packets are telling you is another. A wire shark capture can contain hundreds or thousands of packets. But if you know what to look for, a single packet can tell you who sent it, where it was
356:22
Speaker A
going, which protocol was used, and what happened during that communication. So, how do we actually read a packet?
356:31
Speaker A
Let's find out. Welcome to video 29, reading packet captures. In the previous video, we learned the basics of Wireshark. We learned how to select an interface, start a capture, generate traffic, and inspect captured packets.
356:49
Speaker A
Now, we are going one level deeper. We are going to take a real packet and break it down layer by layer. This is an important step because from this point forward, we are not just looking at network traffic. We are learning how to
357:05
Speaker A
interpret network evidence. What you will learn in this video? You will learn how to identify packets in Wireshark, how to read source and destination addresses, how to identify the protocol being used, how to expand packet details, how different protocol layers
357:26
Speaker A
appear inside a packet, how to use a simple Wireshark display filter, and how packet information becomes useful in cyber security.
357:37
Speaker A
The simple idea. Let's start with something we already know. When your computer communicates across a network, information is divided and transmitted through packets. In video 28, we captured those packets. Now, imagine opening one packet. You might see a lot
357:55
Speaker A
of technical information. At first, it can look overwhelming, but don't worry. You don't need to understand every field immediately.
358:06
Speaker A
Instead, think of a packet as a structured container. Different layers provide different pieces of information about the communication.
358:15
Speaker A
For example, Ethernet can provide local network information. IP provides network layer addressing information. ICMP provides information about the MP message itself. This connects directly to what we learned earlier about networking layers. Read the packet list first. Let's begin with the packet list.
358:39
Speaker A
In Wireshark, you will normally see columns such as number, time, source, destination protocol length info.
358:47
Speaker A
Suppose we have a packet like this. Number one, source 10.227.222.144. Destination 8.8.8.8. protocol ICM information echo request. Before opening the packet, we can already learn several things. The source tells us where the packet came from. The destination tells
359:14
Speaker A
us where it is going. The protocol tells us what protocol Wireshark identified. And the info column gives us a quick description. This is your first level of packet analysis. Look at the summary first, then investigate the details.
359:31
Speaker A
Open the packet details. Now select one packet. Wireshark will show a detailed packet view for an IPv4 packet captured on a typical Ethernet or Wi-Fi interface. You may see sections similar to frame, Ethernet 2, internet protocol, version 4, internet control,
359:54
Speaker A
message protocol. The exact layers can vary depending on the interface and type of traffic being captured. Let's look at them one at a time. Frame. The frame section contains information about the captured packet as seen by Wireshark.
360:13
Speaker A
It can include information such as packet number, capture time, packet length, and other capture related information. This information tells us about the packet as it was captured.
360:26
Speaker A
Ethernet. Next, you may see Ethernet 2. This is where you can find local network information such as source MAC address and destination MAC address. Remember video five, we learned that MAC addresses are used for communication on the local network. Now, we can actually
360:47
Speaker A
see those addresses inside captured traffic. This is an important moment in the course. A concept that we first learned as theory is now appearing inside a real packet capture. Internet protocol version 4. Next, you may see internet protocol version 4. This
361:07
Speaker A
section contains IPv4 information. For example, source address 10.227.222.144. destination address 8.8.8.8. You may also see fields such as time to live protocol, header length, and other IPv4 header information. For now, focus on the most important fields. The source
361:35
Speaker A
address tells us which IPv4 address sent the packet. The destination address tells us where the packet is being sent.
361:44
Speaker A
The protocol field tells IPV4 what protocol is carried above it. For an ICMP packet, Wireshark will identify the upper layer protocol as ICMP.
361:57
Speaker A
Notice how this connects several lessons together. IP addressing packets and network layers are now visible in one packet. ICMP. Finally, we can see internet control message protocol or CMP. If we generated this traffic using ping, we may see echo request for the
362:20
Speaker A
packet sent by our computer and an echo reply for the response. This is the same communication we studied in video 24, but now we are seeing it directly inside a packet capture. Understand the direction of communication.
362:38
Speaker A
There is another important skill understanding the direction of traffic. Suppose you see 10.227.222.144 to 8.8.8.8.
362:55
Speaker A
That means the packet is moving from your device toward the destination. Then you may see 8.8.8.8 to 10.227. 227.222.144 that is traffic coming back. This simple observation becomes very important when analyzing real network traffic. You can start asking who started the
363:23
Speaker A
communication, who responded, which protocol was used, was there a response, how long did it take? You are beginning to move from simply reading packet fields to understanding communication behavior. Practical observation. Let's perform a simple packet capture again.
363:43
Speaker A
Start Wireshark and select your active network interface. Begin the capture. Then open a terminal and run ping- C48.8.8.8.
363:56
Speaker A
The - C4 option tells Linux to send four ICMP echo requests. Return to Wireshark and stop the capture. Now apply this display filter.
364:08
Speaker A
This tells Wireshark to display packets identified as CMP. The filter does not create or modify packets. It simply helps us focus on the packets we want to analyze. Now select one of the echo request packets. Expand Ethernet 2. then
364:26
Speaker A
internet protocol version 4. Then internet control message protocol. Look at source destination TTL protocol and the CMP message type. Then select an echo reply and compare it with the request. This comparison is important.
364:45
Speaker A
You are not just asking what fields are inside this packet. You are asking what does this packet tell me about the communication?
364:54
Speaker A
That is the beginning of real packet analysis. Cyber security connection. This skill is directly useful in cyber security. During an authorized investigation, packet captures can provide evidence about network communication.
365:11
Speaker A
For example, an analyst might investigate which device communicated with a server, which IP addresses were involved, which protocols were used, was there a response, was the traffic encrypted, did the communication happen at a particular time. Packet analysis can help answer these questions, but
365:34
Speaker A
there is an important rule. Do not interpret one packet without context. A single packet rarely tells the complete story. Security analysts often examine multiple packets and look for patterns.
365:50
Speaker A
For example, one packet may look normal, but hundreds of packets together may reveal repeated connection attempts, unexpected communication, unusual protocols, large amounts of traffic, or communication between systems that normally should not communicate. This is why packet analysis becomes more
366:12
Speaker A
powerful as we learn more networking concepts. Recap. Let's review what we learned. First, start with the packet summary source destination protocol and information. Then, open the packet and examine its layers. For a typical IPv4, ICMP packet, you may see frame,
366:33
Speaker A
then Ethernet, then IPv4, and finally Imp. Ethernet can show local MAC addresses. IPV4 can show source and destination, IP addresses. ICMP can show information such as echo request or echo reply. and the wire sharkark filter helps us focus on MP traffic. Most
367:00
Speaker A
importantly, reading packets means understanding what the fields tell us about communication. We have now learned how to read the basic structure of a packet. But there is a much more interesting question.
367:14
Speaker A
When two devices communicate using TCP, what happens before application data is exchanged? How does the connection begin? Why do we see packets called S Y N S Y N A C K and ACK? In the next video, we are going to
367:34
Speaker A
break down one of the most important processes in TCP networking, the TCP 3-way handshake. See you in video 30.
367:48
Speaker A
When you open a website, connect to an SSH server, or communicate with a TCP-based service, your device does not simply start sending application data immediately. Before the communication begins, TCP first establishes a connection. But how? How does your
368:08
Speaker A
computer tell the server, I want to connect? How does the server respond and how do both sides confirm that they are ready to communicate? This process is called the TCP 3-way handshake. Today we are going to see exactly how it works.
368:28
Speaker A
Welcome to video 30 of networking for cyber security beginner to pro. In the previous video, we learned how to read packet captures in Wireshark. We looked at packet summaries, source and destination addresses, protocols, and the different layers inside a packet.
368:47
Speaker A
Now we are going one step deeper. Instead of simply reading individual packets, we are going to understand a complete TCP connection. This is important because TCP is not just a protocol we memorize. It has a connection process. And once you
369:06
Speaker A
understand that process, TCP traffic in Wireshark becomes much easier to understand. What you will learn in this video, you will learn what TCP connection establishment means. Why TCP uses a three-way handshake s and ACK. How sequence numbers are used.
369:29
Speaker A
what the handshake looks like in Wireshark and why the TCP handshake matters in cyber security. The simple idea. Let's start with the simplest possible idea. Imagine two people who want to have a conversation. The first person says, "Can you hear me?" The
369:48
Speaker A
second person says, "Yes, I can hear you." The first person responds, "Great, let's start." Now, both sides know that communication can begin. TCP works in a similar way. Before TCP application data is exchanged, the two endpoints establish a connection using three
370:06
Speaker A
messages S Y N S Y N A C K. These three messages make up the TCP 3-way handshake. The real TCP concept.
370:18
Speaker A
Now, let's introduce the technical terms. The first message is SYN. S YN means synchronize. The client sends a TCP segment with the SYN flag set. It is essentially saying I want to establish a TCP connection and here is my initial
370:36
Speaker A
sequence number. The server receives the S Y N. If the server is willing and able to establish the connection, it responds with S Y N A C K. This contains two important things. First, the server sends its own S Y. Second, it
370:54
Speaker A
acknowledges the client's S YN with an A CK. Then the client sends AC K. This acknowledges the server's S YN. At this point, the TCP connection is established. So remember, number one, S Y N. Number two, S Y N A C K. Number
371:14
Speaker A
three, A C K. That is the TCP three-way handshake. How it works? Let's follow the process carefully. Suppose a client has the IP address 1 192.168.1.20 and it wants to connect to a server 1 192.168.1.5 on TCP port 443.
371:39
Speaker A
The client first sends a TCP segment containing S YN. The client also chooses an initial sequence number. For example, sequence number equals 1,000. The exact number is not important here. What matters is that TCP uses sequence numbers to keep track of data in the
371:59
Speaker A
connection. The server receives the SYN. The server responds with S Y N A C K.
372:08
Speaker A
For example, sequence number equals 5,000 and acknowledgement number= 1001. Y 1001 because the client's S Yn consumes one sequence number. The server is effectively saying I received your S Y N. I am ready and I will acknowledge the
372:30
Speaker A
next sequence number I expect from you. Then the client sends a CK with an acknowledgement number corresponding to the servers S Y N. The connection is now established.
372:44
Speaker A
Notice something important. The client and server both participate in establishing the connection. TCP is not simply client then server. It is a two-way conversation.
372:59
Speaker A
Why three messages? You may be wondering why three? Why not just one message? Because both sides need to establish that they can communicate and synchronize their TCP state. The client sends a s yn. The server receives it and
373:17
Speaker A
responds with s y n a c k. The client receives that response and sends the final AC.
373:26
Speaker A
Now both sides have confirmed the connection setup. After this process, TCP can begin carrying application data.
373:34
Speaker A
For example, an application may then send an HTTP request over a TCP connection. This is why the handshake is important. It happens before the actual TCP data exchange. Practical observation in Wireshark.
373:52
Speaker A
Now, let's observe the TCP 3-way handshake. We already learned how to use Wireshark in video 28 and how to read packets in video 29. So, this time we are going to use those skills to identify a TCP connection. Start
374:11
Speaker A
Wireshark and select your active network interface. Then generate TCP traffic from your own system. For example, you can use curl https colon//jin andju.shop.
374:26
Speaker A
This makes an https request and normally requires a TCP connection to the server. Remember, we are observing traffic from our own system. Now return to Wireshark.
374:39
Speaker A
You can use the display filter TCP. This displays TCP packets. Look through the packets for the beginning of a TCP connection. You may see information similar to S Y N S Y N AC K ACK. The exact addresses, ports, sequence
374:58
Speaker A
numbers, and packet details will depend on your system and the connection. Select the first packet. You should see TCP details in the packet details pane.
375:07
Speaker A
Look for the flags field. You may see S Y N. Then select the next packet. You should see S Y N A C K. Then select the third packet. You should see ACK. This is the TCP 3-way handshake happening in
375:25
Speaker A
a real packet capture. The important thing is not just seeing these packets. Understand what they represent. The first packet begins the connection. The second packet acknowledges the request and responds with the server's own synchronization.
375:42
Speaker A
The third packet acknowledges the server. After that, TCP data can be exchanged. Cyber security connection.
375:52
Speaker A
The TCP handshake is extremely important in cyber security because network security professionals frequently analyze TCP traffic. When examining a packet capture, you may ask who initiated the connection, which destination was contacted, which port was targeted, was the handshake
376:13
Speaker A
completed, did the server respond, was there a large number of connection attempts? For example, a normal connection may look like S Y N then S Y N A C K then A C K and finally data. But you may also encounter situations where
376:35
Speaker A
you see many S YN packets without completed handshakes. That pattern can have different explanations depending on the environment and context. So a security professional should not immediately assume an attack. The important skill is learning to recognize the TCP connection process and
376:56
Speaker A
investigate unusual patterns using additional evidence. This becomes especially useful later in the course when we study network scanning, network attacks, packet analysis for security, attack detection with Wireshark and following an attack through packets. So the TCP handshake is not just a
377:18
Speaker A
networking concept. It becomes part of your security investigation toolkit. Recap. Let's review what we learned.
377:28
Speaker A
First, TCP establishes a connection before exchanging normal application data. Second, the TCP 3-way handshake consists of S Y N S Y N A C A C. Third, SYN starts the connection. S Y NACK responds and acknowledges and the final
377:48
Speaker A
action confirms the server's response. Fourth, TCP uses sequence and acknowledgement numbers to keep track of communication. And finally, Wireshark allows us to observe this handshake directly in real network traffic. Now we understand how a TCP connection is established. But TCP is only one part of
378:13
Speaker A
network communication. What happens when your computer needs to communicate with a domain name such as a website? How does DNS traffic actually appear inside a packet capture? In the next video, we will move from TCP connection establishment to DNS traffic
378:33
Speaker A
analysis. I'll see you in video 31. You type a website name into your browser. for example, example.com.
378:46
Speaker A
But your computer does not communicate across the internet using that name alone. Somewhere in the process, that domain name must be translated into an IP address. We already learned how DNS works. But now comes the practical question. What does DNS actually look
379:06
Speaker A
like inside network traffic? Can we see a DNS request? Can we see the response and what can a security professional learn by analyzing DNS packets? In this video, we are going to find out. Welcome to video 31 of networking for cyber
379:25
Speaker A
security beginner to pro. In the previous videos, we moved from understanding networking concepts to observing real traffic. We learned how to use Wireshark. We learned how to read packet captures. And in the previous video, we examined the TCP 3-way
379:45
Speaker A
handshake. Now, we are going to analyze a different type of communication, DNS traffic. You already learned DNS in level two. So, we are not going to restart the DNS lesson. Instead, we are going to take what you already know and
380:03
Speaker A
see how DNS appears in a real packet capture. This is where networking knowledge starts becoming practical evidence. What you will learn in this video you will learn what DNS traffic looks like in Wireshark. How to identify a DNS query and response. How to use a
380:25
Speaker A
DNS display filter. What information a DNS packet contains. How DNS usually uses UDP. When DNS can use TCP and why DNS traffic matters in cyber security.
380:40
Speaker A
The simple idea. Let's begin with something familiar. Suppose you want to visit example.com. Your computer needs to discover the IP address associated with that domain. So it sends a DNS query. The DNS server responds with DNS information such as an
381:00
Speaker A
IP address. In simple terms, the client asks the DNS server, what is the IP address, for example.com.
381:10
Speaker A
Then the DNS server responds to the client. Here is the answer. We already learned this process earlier in the course. Today we are going to see those messages as actual packets. The real DNS traffic. DNS stands for domain name
381:27
Speaker A
system. A DNS query is a request asking for information about a domain. A DNS response contains the answer or information about that request. For example, a DNS query may ask for an A record. An A record maps a domain name
381:45
Speaker A
to an IPv4 address. A DNS query may also ask for an AAA record which is used for an IPv6 address. So when analyzing DNS traffic, you may see information such as query name, query type, response, answer source destination transaction
382:06
Speaker A
ID. These fields help us understand what the DNS communication was doing. How DNS communication works. Let's follow a simple example. Your computer has the IP address 1 192.168.1.2.
382:24
Speaker A
Oh, it wants to resolve. Example.com. Your computer sends a DNS query to its configured DNS server, for example, 192.168.1.20 to the DNS server. The DNS query asks for information about example.com.
382:45
Speaker A
The DNS server processes the request and sends a response. The response may contain an IPv4 address. Your computer can then use that IP address for the next stage of communication.
383:01
Speaker A
The important point is that DNS is itself network traffic and because it is network traffic, we can capture and analyze it. DNS over UDP and TCP. You may remember from video 10 that TCP and UDP are transport protocols. DNS
383:20
Speaker A
commonly uses UDP port 53 for ordinary queries. So a typical DNS exchange may look like client random source port to DNS server UDP 53. Then the DNS server sends the response back. A DNS is not limited to UDP.
383:39
Speaker A
DNS can also use TCP port 53 in situations where TCP is appropriate, such as certain larger responses or zone transfers. There are also modern encrypted DNS protocols such as DNS over HTTPS, commonly called DO, and DNS over TLS,
384:00
Speaker A
commonly called DOT. Those can change what an observer can see in the network traffic. For this lesson, our goal is to recognize traditional DNS traffic and understand what its packets contain. Analyzing DNS with Wireshark. Now let's observe DNS
384:19
Speaker A
traffic on our own system. Make sure you are capturing traffic from your active network interface in Wireshark. Then generate a DNS lookup. On Linux, you can use dig jinjuice.shop.
384:33
Speaker A
The dig command is a DNS lookup tool. It sends a DNS query and displays the DNS response. Now return to Wireshark. Use this display filter DNS.
384:47
Speaker A
This tells Wireshark to display packets that it identifies as DNS traffic. Now look at the packet list. You may see information similar to this. Your actual addresses and DNS server will be different. Now select the DNS query.
385:03
Speaker A
Look inside the packet details. You may see sections for domain name system. Then information about the query. Look for the query section. You may find name jinu.shop and type a. The a type means the query is asking for an IPv4 address.
385:24
Speaker A
Now select the DNS response. Look at the response information. You may see an answer section containing an IPv4 address associated with the requested domain. The exact answer can change over time and may contain multiple addresses.
385:43
Speaker A
This is the important skill. Do not just look at the packet. Read the fields. Ask what domain was requested, what type of record was requested, who sent the query, who responded, what answer was returned. that is DNS traffic analysis.
386:02
Speaker A
What should you notice? There are several important things to observe. First, identify the source and destination. This tells you who sent the DNS packet and where it was going.
386:15
Speaker A
Second, identify the query name. This tells you which domain was requested. Third, identify the query type. For example, a means IPv4 address. A a a means IPV6 address. Fourth, inspect the response. If the query was successfully answered, you may see an address in the
386:38
Speaker A
answer section. Finally, look at the transport protocol and ports. Traditional DNS commonly uses UDP53.
386:48
Speaker A
This connects directly to what you learned earlier about ports and protocols. Cyber security connection. DNS traffic can provide valuable information during authorized security analysis. Imagine you are investigating network activity inside an organization. You may want to know which domains are devices
387:11
Speaker A
requesting, which systems are making unusual DNS requests, how frequently are requests being made, are devices contacting unexpected domains, are there unusual patterns in DNS traffic? DNS analysis can therefore help with traffic analysis, network monitoring, incident investigation, threat detection. For
387:37
Speaker A
example, a security analyst might notice a workstation repeatedly making DNS requests to domains that are unexpected for that environment. That does not automatically prove malicious activity.
387:51
Speaker A
It is a signal that may require further investigation. The analyst can combine DNS evidence with other information such as IP addresses, TCP connections, HTTP or HTTPS traffic, process information, endpoint logs, and firewall logs. This is an important cyber security mindset.
388:15
Speaker A
One packet rarely tells the whole story. Good analysis connects multiple pieces of evidence. A note about encrypted DNS.
388:25
Speaker A
There is another important point. Traditional DNS traffic can expose DNS queries to systems that can observe that traffic. But modern technologies can encrypt DNS communication. For example, DNS over HTTPS, DO and DNS over TLS, DOT.
388:45
Speaker A
These technologies can protect DNS queries from being directly visible in the same way as traditional plain DNS.
388:53
Speaker A
This means a security professional must understand not only traditional DNS packets, but also how encrypted protocols change network visibility. We will encounter this idea again when we analyze other types of traffic later in the course. Recap. Let's review what we
389:13
Speaker A
learned. First, DNS traffic contains requests and responses related to domain names. Second, a DNS query can ask for different record types such as A for IPv4 or a AAA for IPv6.
389:29
Speaker A
Third, traditional DNS commonly uses UDP port 53, although DNS can also use TCP and other modern transport methods.
389:40
Speaker A
Fourth, Wireshark allows us to inspect DNS traffic using the DNS display filter. And finally, DNS traffic can provide useful evidence for network monitoring and security investigations.
389:55
Speaker A
We have now analyzed DNS traffic, but DNS is only one part of what happens when you communicate with a website.
390:04
Speaker A
What does an actual HTTP request look like inside a packet capture? What information can we see? And what changes when HTTPS encryption is involved? In the next video, we will move from DNS traffic analysis to HTTP traffic analysis. I'll see you in video 32.
390:31
Speaker A
You type a website address into your browser and press enter. A few moments later, the page appears. But what actually happened between your browser and the web server? We already learned about HTTP.
390:47
Speaker A
We learned about HTTPS. We learned about TCP. We learned how to read packets in Wireshark. and we just analyzed DNS traffic. Now, let's put those pieces together and look at something much more interesting. What does an HTTP request
391:06
Speaker A
actually look like inside network traffic? And more importantly, what can a security professional learn by analyzing it? Welcome to video 32 of networking for cyber security beginner to pro. In the previous video, we analyzed DNS traffic. We saw how a DNS
391:27
Speaker A
query can ask for the address associated with a domain and how the response can provide an IP address. Now we move to the next stage. After DNS helps the client discover where a service is located, the client may establish a
391:44
Speaker A
connection and communicate with the web server. that web communication can use HTTP or HTTPS.
391:53
Speaker A
Today our focus is HTTP traffic analysis. We are going to use Wireshark to observe HTTP communication and understand what the packets tell us.
392:05
Speaker A
What you will learn in this video you will learn what HTTP traffic looks like in a packet capture. The difference between an HTTP request and response.
392:17
Speaker A
HTTP methods such as get HTTP status codes. How HTTP uses TCP. How to identify HTTP traffic in Wireshark. Why unencrypted HTTP traffic is important from a security perspective and why HTTPS changes what we can see. The simple idea. Let's start with a simple
392:39
Speaker A
example. You open your browser and request a web page. Your browser needs to communicate with a web server. The browser sends a request. The server processes that request and sends back a response. In simple terms, client to server, give me this resource. Then
392:58
Speaker A
server to client, here is the response. This is the basic idea behind HTTP communication. The real HTTP concept.
393:09
Speaker A
HTTP stands for hypertext transfer protocol. It is an application layer protocol used for communication between clients and web servers. A client can send an HTTP request. One common HTTP method is get. Get is commonly used to request a resource. For example,
393:29
Speaker A
get/index.html http1.1. The server then sends an HTTP response. The response contains a status code. For example, 200 okay means the request was successfully processed. You may also encounter other status codes such as 404 not found or 50 internal server error. We do not need to
393:58
Speaker A
memorize every HTTP status code right now. The important idea is that HTTP communication has two sides, request and response. How HTTP works over TCP. Now, let's connect this to what we learned in the previous video. HTTP can operate
394:18
Speaker A
over TCP. For a traditional HTTP/1.1 connection, the client commonly connects to the server on TCP port 80. The communication can look like this. TCP connection sac then the client sends an HTTP request for example get/http/1.1 host example.com the server sends an HTTP response notice
394:49
Speaker A
the relationship the TCP handshake establishes the connection http then uses that connection for application level communication This is why the concepts we learned earlier are becoming useful together.
395:04
Speaker A
What can we see in HTTP traffic? Now let's think like a packet analyst. Suppose we capture unencrypted HTTP traffic. We may be able to observe information such as source IP, destination IP, source port, destination port, HTTP method, requested path, host
395:27
Speaker A
header, HTTP status code, response information. Depending on the HTTP version, packetization and capture conditions. These fields may be spread across multiple TCP segments. So we should not assume that one packet always contains an entire HTTP request or response. This connects directly to what
395:52
Speaker A
we learned in video 29. A packet is structured. Different layers provide different information. At the network layer, we can see IP addresses. At the transport layer, we can see TCP information. At the application layer, HTTP provides request and response
396:12
Speaker A
information when it is visible. Practical HTTP traffic analysis. Now, let's observe HTTP traffic. There is one important issue. Most modern websites use HTTPS, not plain HTTP.
396:28
Speaker A
HTTPS encrypts the HTTP communication. So simply visiting a normal modern website may not give us readable HTTP requests in Wireshark. For this demonstration, use a local or intentionally configured HTTP test server that you control. For example, on your own Linux machine, create a simple
396:51
Speaker A
test directory and start a local HTTP server. Python 3-mTP.Server server 8000. This starts a basic HTTP server on your local machine using TCP port 8000. The -m option tells Python to run a module. Here the module is HTTP.Server
397:18
Speaker A
and 8000 is the TCP port where the server listens. Now open another terminal and request the local server.
397:26
Speaker A
curl http col127.0.0.18/ The curl command makes an http request. The address 127.0.0.1 is the IPv4 loop back address, meaning the communication stays on your own machine. Port 8000 is where our test HTTP server is listening. Now open Wireshark. If your capture setup can
397:59
Speaker A
observe loop back traffic, select the appropriate loop back interface and start capturing. Then run the curl command again. Stop the capture. You can use the Wireshark display filter http.
398:15
Speaker A
If Wireshark recognizes the traffic as HTTP, it will display the matching packets. You may see information similar to this.
398:24
Speaker A
Your exact output may differ depending on your system and software versions. Now, select the HTTP request. Look at the packet details. You may find request method get request urp headers. Then select the response. You may see response code 200 response
398:48
Speaker A
phrase. Okay, this is the important part. You are not simply seeing the word HTTP.
398:55
Speaker A
You are connecting the traffic to what actually happened. The client requested a resource. The server received the request. The server returned a response that is HTTP traffic analysis.
399:09
Speaker A
Understanding the request, let's look at the request again. You may see something like get/http1.1host127.0.0.18.
399:24
Speaker A
Let's break this down. Get is the http method. It tells the server that the client is requesting a resource. Slash is the requested path. It represents the root resource. In this example, host identifies the host requested by the
399:42
Speaker A
client. The exact headers can vary depending on the client and HTTP version. The important lesson is that HTTP requests contain structured information. Understanding the response.
399:57
Speaker A
Now look at the server response. You may see HTTP/1.0 200. Okay. The 200 is the status code.
400:07
Speaker A
It indicates successful processing of the request. The server may then send headers and the requested content.
400:14
Speaker A
Again, depending on the capture, the response may span multiple TCP segments. This is why packet analysis requires patience. A real communication exchange may involve many packets. You need to follow the conversation rather than judging everything from one packet.
400:35
Speaker A
Cyber security connection. Now we reach the security side. HTTP traffic can contain valuable information when it is transmitted without encryption. A security analyst examining authorized HTTP traffic may be able to see the requested host, the requested path, HTTP
400:57
Speaker A
methods, headers, status codes, and depending on the request and response, parts of the transmitted content. This can be useful during network monitoring, incident investigation, traffic analysis, troubleshooting, security testing in authorized environments. But it also creates a security problem. If sensitive
401:20
Speaker A
information is transmitted through unencrypted HTTP, someone who can observe that traffic may be able to read it. This is one of the reasons HTTPS is so important. HTTP vs HTTPS in packet analysis. Let's connect this to video 16 and video 17. With
401:42
Speaker A
plain HTTP application layer content can be visible in the captured traffic. With HTTPS, HTTP communication is protected by encryption through TLS. You can still observe network level information such as source and destination IP addresses, ports, TCP behavior, packet sizes,
402:05
Speaker A
timing, and other metadata. But the actual HTTP request and response content is normally encrypted. This creates an important limitation for security analysts. Encryption improves confidentiality, but it also changes what can be directly observed from a network capture. So, a packet analyst
402:27
Speaker A
must understand both what the network reveals and what encryption hides. Recap. Let's review the key points.
402:35
Speaker A
First, HTTP uses a request and response model. Second, HTTP can operate over TCP and traditional HTTP commonly uses TCP port 80. Third, Wireshark can help us identify HTTP requests and responses when the traffic is visible and recognizable as HTTP.
402:58
Speaker A
Fourth, a request may contain information such as the method, requested path, and headers, while a response contains a status code and response data. And finally, plain HTTP can expose application layer content, while HTTPS uses TLS to protect that content. We
403:20
Speaker A
have now learned how to analyze DNS traffic and HTTP traffic. We can observe communication. We can read packets and we can understand how protocols appear in network captures. But there is another important question for a security professional. How do we
403:41
Speaker A
discover what network services are available on a system? What does it mean to scan a network? What are ports, hosts, and services telling us? And how should network scanning be understood from a cyber security perspective? In the next video, we will explore network
404:01
Speaker A
scanning concepts. I'll see you in video 33. Imagine you are a security professional responsible for protecting a network.
404:15
Speaker A
You are given a network but you do not know which devices are currently online.
404:21
Speaker A
You do not know which services are exposed and you do not know which systems may be responding to network requests. So where do you start? Before analyzing a system deeply, you first need to understand what is there. This
404:38
Speaker A
is where network scanning becomes important. Welcome to video 33 of networking for cyber security beginner to pro. In the previous videos, we moved deeper into practical network analysis.
404:53
Speaker A
We used Wireshark. We learned how to read packet captures. We analyzed the TCP 3-way handshake. We examined DNS traffic and we analyzed HTTP traffic. Now we are going to look at another important area of practical networking, network scanning. But this
405:15
Speaker A
lesson is about understanding the concept. We are not going to start by aggressively scanning random systems on the internet. Instead, we will understand what scanning does, what information it can reveal, and how security professionals use it in authorized environments. What you will
405:36
Speaker A
learn in this video? You will learn what network scanning means, why network scanning is used, the difference between host discovery and port scanning, what an open, closed, and filtered port means. How scanning relates to IP addresses and ports. How scanning
405:56
Speaker A
connects to TCP. A safe Linux demonstration. Why network scanning matters in cyber security? The simple idea. Let's start with the simplest possible idea. Network scanning is the process of checking a network or system to discover what responds to
406:16
Speaker A
network communication. Think about a large office building. Before a security professional can protect the building, they need to know what exists inside, which rooms are occupied, which entrances are accessible, which services are available. Network scanning works with a
406:36
Speaker A
similar idea. Instead of rooms and doors, we are dealing with IP, addresses, hosts, ports, and services.
406:45
Speaker A
For example, imagine a local network 1 192.168.1.1 192.168.1.2 Oh 1 192.168.1.3 O. A security professional may want to determine which of these hosts respond.
407:08
Speaker A
That is one basic purpose of scanning. Host discovery. One important concept is host discovery. Host discovery asks a simple question. Which devices appear to be reachable or responsive? For example, you might have a network such as 1 192.168.1.0/24.
407:32
Speaker A
This represents a network containing many possible IPv4 addresses. A discovery process can help identify which addresses have responding devices. But remember something important. No response does not always mean no device exists. A firewall may block probes. A host may be configured
407:56
Speaker A
not to respond to certain requests. The device may be temporarily unavailable or the scanning method may simply not be suitable for that environment.
408:07
Speaker A
So scanning results must always be interpreted carefully. Port scanning. Once a host has been identified, another question becomes important. What network services are exposed? This is where port scanning comes in. Remember from our earlier lessons that a port is a logical
408:29
Speaker A
end point associated with network communication. For example, port 22 is commonly associated with SSH.
408:38
Speaker A
Port 80 is commonly associated with HTTP. Port 443 is commonly associated with HTTPS. A port scan checks how a system responds when communication is attempted toward different ports. The important point is this. A port number does not automatically prove which service is
409:02
Speaker A
running. Port 443 is commonly used for HTTPS, but a service can be configured differently. Therefore, scanning can tell us about network behavior, but additional observation may be required to identify the actual service.
409:22
Speaker A
Understanding port states. When scanning a TCP port, you may commonly encounter results such as open, closed, filtered.
409:32
Speaker A
Let's understand what these mean. Open. An open port generally means that a service is listening and accepting network connections on that port. For example, a server may have TCP port 443 open because a web server is accepting HTTPS
409:53
Speaker A
connections. Closed. A closed port generally means the host is reachable, but there is no application currently listening on that port. Filtered. A filtered result generally means something such as a firewall or filtering device is preventing the scanner from determining the port's
410:13
Speaker A
state directly. These states are extremely useful because they give us information about how a network is configured, but they are not complete answers. A security professional needs to understand the environment and the scanning method before interpreting the result. How scanning connects to TCP.
410:37
Speaker A
Now, let's connect this topic to what we learned in video 30. We studied the TCP 3-way handshake. S Y N S Y N A C K A C K. A TCP-based scanning technique can use TCP behavior to learn how a target
410:53
Speaker A
responds. For example, conceptually, scanner S Y N to the server. If the server responds with S Y N A C K that provides evidence that the port is accepting TCP connections. If the server responds with RST, that generally
411:12
Speaker A
indicates the port is closed. If there is no useful response, filtering or other network conditions may be involved. This is why the TCP knowledge from our previous lesson is now becoming useful. We are not learning another isolated concept. We are using the TCP
411:31
Speaker A
behavior we already studied to understand how security tools can observe network services. Practical demo. Now let's make this practical in a safe environment. We will scan our own local system, not an external target. A simple way to begin is by checking which
411:51
Speaker A
TCP services are currently listening on our Linux machine. run ss-tn. Let's break this command down. ss is a Linux utility for displaying socket information. The -ash t option shows TCP sockets. The - option shows UDP sockets.
412:15
Speaker A
The -L option shows listening sockets. and the dash n option displays numerical addresses and port numbers instead of trying to resolve names. You may see outputs similar to this. The exact output will depend on your system. The important part is the local address and
412:33
Speaker A
port. For example, oon22 means a TCP service is listening on port 22 on the available IPv4 interfaces represented by that address. While 0.0.0.0 colon 8,000 means the service is listening only on the local loop back interface. That difference is important.
413:03
Speaker A
A service listening only on 1 127.0.0.1 is not normally reachable from another machine through the network interface.
413:14
Speaker A
This gives us our first practical lesson. Before scanning a network, understand what is actually listening on the system you control. Cyber security connection. Network scanning is important because security professionals need visibility during an authorized security assessment. Scanning can help
413:36
Speaker A
answer questions such as which hosts are present, which ports are exposed, which services may be reachable, which systems are unexpectedly accessible, are there services that should not be exposed?
413:51
Speaker A
This information can support attack surface discovery, but scanning is only one stage of a larger process. A simplified workflow might look like this. Discover, scan, enumerate, analyze, assess, and defend. Scanning tells us that something is responding.
414:12
Speaker A
It does not automatically tell us whether that system is vulnerable. For example, finding port 443 open does not mean the server is vulnerable. Finding port 22 open does not mean SSH has been compromised.
414:29
Speaker A
Scanning provides information. The security professional must then interpret that information in context. And this is exactly why authorization matters. Only scan systems you own or systems for which you have explicit permission to test. For this course, practical scanning should remain inside
414:51
Speaker A
your own machine, local network, virtual machines, or intentionally vulnerable labs. Recap. Let's review what we learned. First, network scanning is used to discover how systems respond to network communication. Second, host discovery helps identify devices that appear to be reachable. Third, port
415:16
Speaker A
scanning helps determine how a host responds on different network ports. Fourth, TCP behavior such as S Y N, S Y N C, and R S T can provide information about TCP port states. And finally, scanning is an information gathering
415:35
Speaker A
technique. It does not automatically mean that a vulnerability exists. Now we know what network scanning means and how it can reveal hosts and exposed ports. But network communication does not always travel directly from one machine to another. Sometimes traffic
415:54
Speaker A
passes through an encrypted tunnel. Sometimes it passes through an intermediary and sometimes the source and destination seen by another network device may be different from what the application originally expected. In the next video, we will explore VPNs and
416:12
Speaker A
proxies. We will learn what they are, how they affect network traffic, and how they change what a network observer can see. I'll see you in video 34.
416:29
Speaker A
When you connect to a website, your traffic normally travels through your network, your router, your internet provider, and then toward the destination. But what happens when you send that traffic through a VPN? And what changes when your application
416:46
Speaker A
communicates through a proxy? Do they do the same thing? Not exactly. Understanding the difference is important because VPNs and proxies can change where traffic travels, what address a destination sees, and what network observers can see.
417:05
Speaker A
Introduction. Welcome to video 34 of networking for cyber security beginner to pro. In the previous video, we learned about network scanning. We saw how security professionals can discover responding hosts and investigate exposed ports in authorized environments. Now we
417:26
Speaker A
are going to look at another important part of network communication VPNs and proxies. You have already learned about IP addresses, routing, TCP, DNS, HTTP packets and network traffic. Today we will use those concepts to understand what happens when traffic passes through
417:48
Speaker A
an intermediary or an encrypted tunnel. What you will learn in this video? You will learn what a VPN is, what a proxy is, the difference between a VPN and a proxy, how VPN traffic travels through a tunnel, how proxies forward application
418:06
Speaker A
traffic, how VPNs can change routting, how to observe VPN interfaces on Linux, how VPNs and proxies affect cyber security investigations.
418:19
Speaker A
The simple idea. Let's start with a simple question. Normally imagine your computer communicating with a website.
418:27
Speaker A
The traffic follows a path like this. Your computer, then the router, then the internet, and finally the website. Your traffic follows the normal network path.
418:40
Speaker A
But now imagine adding an intermediary. With a proxy, the communication may look like this, your computer. then a proxy, then the website. With a VPN, the general idea is different. Your computer, then an encrypted VPN tunnel, then the VPN server, then the internet,
419:02
Speaker A
and finally the website. Both VPNs and proxies can place another system between the client and the destination, but they operate differently. A proxy usually works at the application level or for specific applications and protocols. A VPN creates a network level tunnel that
419:24
Speaker A
can route traffic through the VPN connection depending on how the VPN is configured. That distinction is important. What is a VPN?
419:35
Speaker A
VPN stands for virtual private network. A VPN creates a logical connection commonly called a tunnel between your device and a VPN endpoint. The traffic sent through that tunnel is protected according to the VPN protocol and configuration.
419:55
Speaker A
A simple way to visualize it is like creating a protected pathway through an existing network. For example, your computer might have a local address such as 1 92.168.1.2.
420:12
Speaker A
Your normal internet connection may go through your local router. But when a VPN is active, the operating system may create a virtual network interface such as TU N0 or WG0.
420:28
Speaker A
The exact interface name depends on the VPN technology. Traffic can then be routed through that interface toward the VPN server. This is where our previous lesson about routting becomes useful.
420:43
Speaker A
Remember, your computer does not need to know the entire path to every destination. It makes a forwarding decision based on its routing configuration.
420:54
Speaker A
A VPN can change those routing decisions so that selected traffic or sometimes most internet traffic travels through the VPN tunnel. What is a proxy? Now let's look at a proxy. A proxy server is an intermediary that receives a request
421:13
Speaker A
from a client and forwards that request toward another destination. For example, with an HTTP proxy browser, then the proxy, then the web server. The browser communicates with the proxy. The proxy then communicates with the destination server. This is different from a VPN.
421:36
Speaker A
A proxy does not automatically mean that every network connection from your computer is going through it. The application must generally be configured to use the proxy or the network environment must explicitly redirect or enforce proxy use. For example, you
421:55
Speaker A
might configure a browser to use proxy server port 8080. Then the browser sends its supported traffic through that proxy. Another application on the same computer may continue using the normal network connection if it is not configured to use the proxy. That is one of the
422:18
Speaker A
important differences between a proxy and a VPN. VPN VS proxy. Let's compare them directly. A VPN can operate at the network level and can create a virtual network interface and encrypted tunnel.
422:34
Speaker A
A proxy commonly acts as an intermediary for specific application traffic. AVPN can change the routing path for traffic selected by its configuration. A proxy usually affects only the applications or protocols configured to use it. A VPN commonly protects traffic between your
422:55
Speaker A
device and the VPN endpoint using its VPN protocol. A proxy itself does not automatically provide encryption for every connection. For example, an HTTP proxy does not magically turn ordinary HTTP communication into encrypted HTTPS.
423:15
Speaker A
The encryption provided by HTTPS comes from TLS which we studied earlier. So remember VPN is not the same as a proxy and a proxy is not the same as encryption. The exact behavior depends on the technology and its configuration
423:34
Speaker A
VPN and your public IP. Another important concept is the IP address seen by the destination. Without a VPN, a website normally receives traffic from the public-f facing network connection used to reach it. With a VPN, the destination may instead see the VPN
423:55
Speaker A
server's public IP address. This does not mean the VPN makes a user invisible. The VPN provider can still have visibility into traffic metadata or traffic itself depending on the protocol configuration, encryption and service design and other systems can still
424:16
Speaker A
observe different parts of the communication path. So avoid thinking of a VPN as an invisibility button. It is better to think of it as a different network path with a protected tunnel between your device and the VPN endpoint. Practical observation.
424:38
Speaker A
Now let's connect this to Linux. If a VPN is configured on a Linux system, it may create a virtual network interface.
424:47
Speaker A
We can inspect network interfaces with IP address. On a normal system, you may see interfaces such as L, E0, WL, A0, or names such as E NP0 S3, WLP2S0.
425:03
Speaker A
If a VPN is active, you might also see something such as TON0 or WG0.
425:11
Speaker A
The exact interface depends on the VPN technology. Now we can look at the routing table IP route. This is especially useful because a VPN is not only about creating an interface. It is also about where traffic is routed. For
425:29
Speaker A
example, a VPN configuration may add routes that direct specific traffic through the VPN interface. In some configurations, the VPN can install a default route or equivalent routing policy so that most internet traffic goes through the tunnel. This connects
425:50
Speaker A
directly to what we learned earlier. Video 20, routing and video 23, default gateway. The VPN changes the network path by changing how traffic is handled by the operating systems networking configuration.
426:08
Speaker A
If you do not currently have a VPN configured, that is completely fine. You can still use IP address and IP routt to understand your normal interfaces and routes. The goal here is to learn how to recognize the networking changes that a
426:27
Speaker A
VPN can introduce. Cyber security connection. Now, let's connect VPNs and proxies to cyber security. Security professionals need to understand them because they affect traffic visibility, attribution routting and investigation.
426:45
Speaker A
Imagine an analyst investigating suspicious traffic. The logs may show client, then VPN server, then destination. The destination may only see the VPN servers public IP address.
427:01
Speaker A
That can change how the analyst interprets the connection. Similarly, a proxy can become an important point in a network. An organization may intentionally route web traffic through a proxy so that it can apply security policies, logging, filtering or
427:19
Speaker A
monitoring. This means proxies can be both network infrastructure and security controls. VPNs can also be used legitimately for remote access, connecting users to corporate networks, protecting traffic across untrusted networks, connecting separate network environments. But from an investigation perspective, VPNs and
427:46
Speaker A
proxies also introduce additional layers that analysts must understand. For example, when investigating an event, you may need to examine endpoint logs.
427:57
Speaker A
then VPN logs, then proxy logs, then firewall logs, and finally network traffic. One log source may not tell the complete story. This is another important cyber security lesson. Network evidence must be interpreted in context.
428:16
Speaker A
Recap. Let's review what we learned. A VPN or virtual private network creates a logical tunnel between a device and a VPN endpoint. A proxy acts as an intermediary for traffic from an application or configured environment. A VPN can change routting and may cause
428:39
Speaker A
traffic to appear to destinations as coming from the VPN servers public IP. A proxy usually affects only the applications or traffic configured to use it. And most importantly, VPNs and proxies are not the same thing.
428:58
Speaker A
Understanding them helps security professionals reason about network paths, traffic visibility, logging, and investigations. We now understand how traffic can travel through VPNs and proxies. But there is another question.
429:15
Speaker A
What happens when a network administrator wants to control which traffic is allowed to pass? What if we want to allow some connections and block others? For example, should this device be allowed to connect to that server?
429:31
Speaker A
Should TCP port 22 be reachable? Should a guest network be allowed to access internal systems? This brings us to one of the most important security controls in networking.
429:44
Speaker A
firewalls. In the next video, we will learn how firewalls filter network traffic, how they make allow or deny decisions, and how to observe firewall behavior safely.
429:58
Speaker A
I'll see you in video 35, firewalls. Imagine a server is connected to a network. It has several services running. Some connections should be allowed, others should be blocked. But who decides which traffic can enter or leave? That is one of the main jobs of a
430:23
Speaker A
firewall. A firewall can sit between networks, between a computer and a network or directly on a server. And for a cyber security professional, understanding how a firewall makes decisions is essential. Welcome to video 35 of networking for cyber security
430:44
Speaker A
beginner to pro. In the previous video we learned about VPNs and proxies. We saw how traffic can travel through different paths and intermediaries.
430:56
Speaker A
Now we are going to look at another important part of network security firewalls. You already understand IP addresses, ports, TCP and UDP, routting, packets, network scanning and network traffic. Today we are going to bring those concepts together and understand
431:18
Speaker A
how a firewall decides what traffic should be allowed or blocked. What you will learn in this video? You will learn what a firewall is, why firewalls exist, how firewalls make allow and deny decisions, inbound versus outbound traffic, how firewall rules use IP
431:40
Speaker A
addresses, ports, and protocols. What stateful filtering means, how to observe a Linux firewall safely. Why firewalls matter in cyber security. The simple idea. Let's start with a simple example.
431:55
Speaker A
Imagine a building with a security checkpoint at the entrance. People arrive at the checkpoint. The security system checks whether each person is allowed to enter. Some people are allowed, others are denied. A network firewall works with a similar idea, but
432:15
Speaker A
instead of people, it examines network traffic. A firewall is a security control that monitors and controls network traffic according to defined rules or policies. The important idea is traffic comes in. The firewall evaluates it. A decision is made. For example,
432:35
Speaker A
allow or deny. What does a firewall look at? A firewall can make decisions using information such as source IP address, destination IP address, protocol, source port, destination port, connection state, network interface, direction of traffic. This should sound familiar. We
432:58
Speaker A
have already learned these concepts throughout the course. For example, imagine a connection 192.168.1.20 20 29 192.168.1.50 port 443.
433:16
Speaker A
The firewall can examine information about this communication. The source is 1 192.168.1.2. The destination is 1 192.168.1.50.
433:32
Speaker A
The destination port is 443 and the transport protocol could be TCP. A rule could be designed to allow or deny this type of traffic. This is why understanding networking fundamentals is so important. A firewall is not making decisions from random information. It is
433:53
Speaker A
using the properties of network communication that we have already studied inbound and outbound traffic.
434:01
Speaker A
Now let's understand traffic direction. Inbound traffic. Inbound traffic is traffic entering a system or network from another source. For example, internet, then web server. Outbound traffic is traffic leaving a system or network, for example, internal computer, then internet. A firewall can have rules
434:25
Speaker A
for both directions. For example, an organization might allow a web server to receive HTTPS connections while restricting other incoming connections.
434:37
Speaker A
At the same time, it may allow internal systems to make certain outbound connections while blocking others. The exact policy depends on the organization's security requirements.
434:50
Speaker A
Firewall rules. Now, let's look at the idea of a firewall rule. A rule can be thought of as a condition followed by an action. For example, source any destination web server protocol TCP destination port 44 43 action allow.
435:11
Speaker A
This means traffic matching those conditions can be permitted. Another rule might say source guest network destination internal server network action deny. Firewall policies can become much more complex in real environments. There can be many rules and rule order can matter depending on
435:31
Speaker A
the firewall technology and configuration. Some firewalls evaluate rules from top to bottom and apply the first matching rule. Others use different processing models. So a security professional must understand the specific firewall implementation instead of assuming every firewall behaves identically.
435:56
Speaker A
Stateful firewalls. There is another important concept stateful firewalling. A stateful firewall can keep track of the state of network connections.
436:06
Speaker A
Remember our TCP 3-way handshake from video 30. S Y N S Y N A C K A C K A stateful firewall can use connection state information to understand whether traffic belongs to an established connection. For example, if an internal
436:28
Speaker A
computer starts a TCP connection to a web server, the firewall can track that connection. When the expected response comes back, the firewall can recognize that the traffic belongs to an existing connection. This is different from simply looking at one packet in
436:48
Speaker A
isolation. The firewall can consider the state of the communication. This is one reason why the TCP knowledge from our earlier lessons is now useful again. Firewall versus router. It is also important not to confuse a firewall with a router. A router primarily makes
437:09
Speaker A
forwarding decisions. It determines where traffic should go next. A firewall primarily makes security decisions about whether traffic should be permitted or blocked according to policy. In real networks, the same device can perform both functions. For example, a home
437:29
Speaker A
router may also contain firewall functionality. So remember routing answers. Where should the traffic go?
437:38
Speaker A
Firewalling answers. Should this traffic be allowed according to policy? These functions can work together. Practical demo. Now let's observe a firewall on Linux. We will keep this demonstration red only. We do not want to change firewall rules during the lesson because
437:58
Speaker A
an incorrect rule can interrupt network connectivity, especially on a remote machine. On systems using UFW, which stands for uncomplicated firewall, you can check the firewall status with pseudo UFW status verbose. Let's break this down. Pseudo runs the command with
438:20
Speaker A
administrative privileges. UFW is a simplified firewall management interface commonly available on Ubuntu based systems. Status asks UFW to display its current status and verbose provides additional information about the configuration. You may see something similar to status active logging on low
438:45
Speaker A
default, deny incoming, allow, outgoing, disabled, rooted. Your output may be different. The important part is the policy. For example, deny incoming means incoming connections are generally denied unless an appropriate rule permits them. and allow outgoing means outbound connections are generally
439:09
Speaker A
permitted unless another rule or firewall configuration blocks them. You may also see configured rules such as 22/T CP allow 80/T CP allow 443/T CP allow. These indicate the TCP traffic to those ports has been permitted according to the displayed UFW rules. If
439:34
Speaker A
UFW is not installed or active on your system, do not worry. Linux systems can use different firewall technologies.
439:44
Speaker A
Modern Linux systems commonly use NFTables while other environments may use tools such as part of their firewall configuration.
439:54
Speaker A
For a readonly view of NFTables rules, a system using NFTs may allow pseudo NFT list rules set. This can produce a much larger output. Do not try to memorize it yet. The important lesson is that the operating system can contain firewall
440:14
Speaker A
rules that control how network traffic is handled. Understanding the practical. Let's connect what we just observed to the networking concepts we already know.
440:27
Speaker A
Suppose a Linux server is running a web service on TCP port 443. The service may be listening. We learned in video 33 that a listening service can make a port appear open, but that does not automatically mean an external
440:46
Speaker A
system can reach it. A firewall may block the connection before it reaches the service. So we can have a situation like this. Service is listening. The firewall blocks the traffic. The remote client cannot connect. Or service is listening. The firewall allows the
441:07
Speaker A
traffic. The remote client can connect. This is a very important cyber security concept. A service being available on a system and a service being reachable through the network are not always the same thing. Cyber security connection.
441:25
Speaker A
Firewalls are one of the fundamental security controls used to reduce unwanted network access. Security professionals use firewall policies to help restrict unnecessary exposure, control access between networks, protect servers, separate trusted and untrusted traffic, reduce attack surface, control outbound communication,
441:51
Speaker A
support network segmentation. But firewalls are not magic security barriers. A firewall can only enforce the policies it has been configured to enforce. A poorly designed policy can leave unnecessary services exposed.
442:09
Speaker A
An overly restrictive policy can break legitimate communication and traffic that is allowed by the firewall can still contain malicious activity. This is why firewalls work together with other security controls such as network segmentation, IDS and IPS, endpoint security, logging and monitoring, packet
442:33
Speaker A
analysis. We will explore many of these topics later in the course. A simple security example. Imagine an organization has three networks, employees, servers, guests. The organization may want employees to access specific services on the server network, but guest devices may need
442:54
Speaker A
internet access without direct access to internal servers. A firewall can enforce policies between these networks. This connects directly to what we learned about VLANs and network segmentation.
443:08
Speaker A
The network architecture creates different zones. The firewall can then enforce security policies between those zones. That is how networking concepts begin to become cyber security controls.
443:23
Speaker A
Recap. Let's review the key ideas. First, a firewall monitors and controls network traffic according to security rules or policies. Second, firewall decisions can use information such as IP addresses ports protocols direction and connection state. Third, inbound traffic enters a system or network while
443:47
Speaker A
outbound traffic leaves it. Fourth, stateful firewalls can track connection state instead of treating every packet as completely independent. And finally, a listening service is not necessarily reachable from the network. Firewall policy can determine whether that traffic is allowed to reach it. We have
444:11
Speaker A
now learned how firewalls can control network traffic. But when something goes wrong, security professionals need more than security controls. They need to determine where the problem actually is.
444:26
Speaker A
Is the device configured correctly? Is the interface working? Is the gateway reachable? Is DNS working? Is the destination reachable? Is a firewall blocking the connection? In the next video, we will bring together many of the networking concepts we have learned
444:45
Speaker A
throughout this course and use them to troubleshoot connectivity problems systematically. That will be video 36.
444:54
Speaker A
Basic network troubleshooting connectivity fundamentals. Your computer cannot reach a website. Is the problem your computer? Is it the network interface? Is it your local network? Is the default gateway down? Is DNS failing? Is the internet connection unavailable? or is the destination
445:19
Speaker A
itself unreachable? Instead of guessing, a networking professional follows a process. In this video, we are going to learn the fundamentals of network troubleshooting.
445:33
Speaker A
So far in level three, we have moved from simply understanding networking to actually observing network behavior. We used tracer route to examine network paths. We practiced IPv4 subnetting. We looked at IPv6. We captured traffic with Wireshark. We read packet captures. We
445:55
Speaker A
analyzed the TCP 3-way handshake. We examined DNS traffic. We analyzed HTTP traffic. We explored network scanning concepts. We looked at VPNs and proxies.
446:10
Speaker A
And we learned how firewalls control network traffic. Now we are going to bring many of these ideas together because understanding networking is not only about knowing how things work. You also need to know what to do when something stops working. That is where
446:29
Speaker A
network troubleshooting becomes important. What you will learn in this video you will learn what network troubleshooting means. Why troubleshooting should be systematic? How to separate local problems from remote problems. How to check your network interface and IP configuration. How to test connectivity
446:53
Speaker A
step by step. How to use Linux networking commands. How to interpret common troubleshooting results. And why troubleshooting skills matter in cyber security. The simple idea network troubleshooting means finding the cause of a network problem. Imagine you open your browser and try to visit a website.
447:16
Speaker A
The website does not load. A beginner might immediately think the internet is down. But there are many possible causes. Maybe your network interface is disconnected. Maybe your computer does not have an IP address. Maybe your default gateway is unreachable. Maybe
447:36
Speaker A
DNS is not working. Maybe a firewall is blocking the connection. Maybe the remote server is unavailable. Or maybe the website is working perfectly and the problem is somewhere on your own system.
447:52
Speaker A
So troubleshooting is not about guessing. It is about collecting evidence. A useful way to think about troubleshooting is start local, test step by step, and find where communication stops. This prevents you from changing random settings without understanding the problem. The real
448:14
Speaker A
networking concept. Let's build a simple troubleshooting path. Suppose your computer has this configuration. IP address 1 192.168.1.20 subnet /24 default gateway 1 192.168.1.1.
448:34
Speaker A
And you want to reach a website. The communication path might look like computer, then the local network, then the default gateway, then the internet, then DNS, and finally the destination server. Each part can potentially fail. So, we can
448:53
Speaker A
test different parts of the path. First, does the network interface exist and appear to be working? Second, does the computer have a valid IP configuration?
449:06
Speaker A
Third, can the computer reach the local gateway? Fourth, can it reach an external IP address? Fifth, can it resolve a domain name using DNS? And finally, can it reach the actual application or website? Notice something important. We are moving from the
449:26
Speaker A
closest part of the network to the more distant parts. This gives us a logical troubleshooting process.
449:34
Speaker A
Check the local system first. Let's start with the computer itself. On Linux, we can use IP address. This command displays network interfaces and their addresses. For example, you might see Eth 1 192.168.1.2/24.
449:57
Speaker A
The important information here is that the interface has an IPv4 address. We can also check the routing configuration with IP route. You might see default via 10.22.238.14 dev e 010.222.238.0/24 dev. Oroto kernel scope link src 10.222.23 238.114.
450:28
Speaker A
The first line tells us that the default route goes through 10.222.238.114. That is the default gateway. So now we have evidence about the local network configuration. But having an IP address does not automatically mean that communication is working. We still need
450:50
Speaker A
to test it. Test connectivity in a logical order. A simple first test is the local gateway. For example, ping- c410.222.238.114.
451:03
Speaker A
The ping command sends CMP echo requests and waits for replies. The - C4 option tells Linux to send four requests. If you receive replies, that gives us evidence that your computer can communicate with the gateway. For example, 64 bytes from 10.2
451:25
Speaker A
22.238.114. This does not prove that the entire internet is working. It only tells us that this particular communication path is responding. Now we can test an external IP address. For example, ping- c48.8.8.8.
451:48
Speaker A
If this works but a domain name does not, we have an important clue. For example, ping- c4 jinju.shop.
451:57
Speaker A
If the IP address responds but the domain name does not resolve, DNS becomes a strong area to investigate. We could then test DNS directly using diggynju.shop.
452:10
Speaker A
network interface IP configuration default gateway external IPDNS resolution application/ website this is the key idea do not test everything at once test one layer or component at a time practical Linux troubleshooting now let's put the idea together in a simple
452:32
Speaker A
Linux workflow imagine a website is not loading first check the interfaces IP and you are look for the active interface and its IP address. Next, check the roots IP route. Look for the default route and gateway. Then test the
452:51
Speaker A
gateway ping- c.222.238.114. Replace the address with your actual gateway. If that works, test an external IP ping- c48.8.8.8.
453:09
Speaker A
If that works, test dns digample.com. Finally, test the application layer curl- genu.shop. The curl command makes a request to the web server. The dash I option asks for the http response headers instead of downloading the complete page. You might
453:29
Speaker A
receive a response such as http/2200. The exact response depends on the destination. IP address IP root ping gateway ping external IP dig domain curl website. This is not a magic formula.
453:49
Speaker A
Different problems require different tests. But the principle is extremely useful. Start with the local system, test progressively, and use the results to narrow the problem. Understanding failure. Now let's look at what different failures can tell us. Suppose the network interface has no IP address.
454:10
Speaker A
The problem may be related to network configuration DHCP the interface itself or the connection.
454:19
Speaker A
Suppose the computer has an IP address but the gateway does not respond. The problem may be somewhere in the local network such as the interface, connection, switch, wireless network, gateway or filtering. Suppose the gateway responds but an external IP does
454:40
Speaker A
not. The problem may be farther along the routing path, the internet connection or filtering. Suppose an external IP responds but a domain name does not resolve. DNS becomes an important area to investigate. Suppose DNS works but the website does not
454:59
Speaker A
respond. Now we may need to investigate the application TCP connection, firewall, proxy, TLS or remote server.
455:09
Speaker A
And this is where the previous videos become useful. You already learned routing, default gateways, DNS, TCP, HTTP and HTTPS, firewalls, Wireshark, Tracer route.
455:24
Speaker A
Troubleshooting connects these concepts together. Practical observation. Let's summarize the Linux commands we used. Check network interfaces and IP addresses. IP adder used to inspect interfaces and IP configuration. Check routing. IP route used to see roots and the default gateway. Test connectivity.
455:47
Speaker A
Ping- C10.22.238.114. Used to test whether the gateway responds. Test an external IP ping- C48.8.8.8 8 used to test connectivity beyond the local network. Test DNS digample.com used to inspect DNS resolution. Test the web application. curl dash i ginju.shop
456:17
Speaker A
used to inspect an HTTP response from the destination. Remember these commands do not automatically tell you the complete cause of a problem. They provide evidence. The skill is knowing how to interpret that evidence. Cyber security connection. Network troubleshooting is also an important
456:38
Speaker A
cyber security skill. Why? Because security professionals constantly investigate unusual network behavior. Imagine a system suddenly cannot communicate with an internal server. You may need to determine whether the problem is a network configuration issue, a routing problem, a firewall
457:02
Speaker A
rule, a DNS problem, a service that is not running, or something related to a security incident. The same networking knowledge can also help during incident investigation. For example, you may compare IP configuration, routing tables, DNS responses, firewall rules,
457:25
Speaker A
network connections, packet captures, and system logs. You are not simply asking is the network working. You are asking where does communication succeed, where does it fail, and what evidence explains why. That is a much more professional way to troubleshoot. And
457:45
Speaker A
remember something important. A failed ping does not automatically mean that a host is down.
457:53
Speaker A
CMP may be blocked. A firewall may filter the traffic. The destination may be configured not to respond. So always interpret results in context. Recap.
458:07
Speaker A
Let's review what we learned. First, network troubleshooting is the process of finding the cause of a connectivity problem. Second, troubleshooting should be systematic rather than based on guessing. Third, start with the local system and progressively test farther into the network. Fourth, Linux commands
458:29
Speaker A
such as IP address, IP root, ping, dig, curl can provide useful evidence. And finally, a failed test does not automatically explain the cause. You need to interpret the result and continue investigating.
458:48
Speaker A
And with that, we have reached the end of level three. We started level three by learning how to observe network paths with tracerote. Then we practiced subnetting. We explored IPv6.
459:02
Speaker A
We learned how to capture and read packets with wireshark. We analyzed TCP handshakes, DNS traffic, and HTTP traffic. We explored network scanning concepts. We learned how VPNs and proxies affect traffic. We examined firewalls. And now we have learned how
459:24
Speaker A
to troubleshoot connectivity systematically. At this point, you should no longer think of networking as just IP addresses and cables. You should be able to look at network behavior and start asking, what is happening? Where is it happening? What evidence can I collect
459:43
Speaker A
and what does that evidence tell me? But there is still another major part of the journey. We understand how networks work. We can observe their traffic. We can analyze communication. We can troubleshoot problems. Now we need to understand what happens when someone
460:02
Speaker A
tries to attack that network. Next video level four. In the next level we move from practical networking to network security. We will begin with one of the most important security concepts in network defense IDs versus IPS. We will
460:21
Speaker A
learn how security systems can monitor network traffic, detect suspicious activity, and in some cases actively block it. That is where networking knowledge starts becoming directly connected to cyber security defense.
460:37
Speaker A
I'll see you in video 37, IDS versus IPS. You have learned how networks communicate. You have learned how to capture packets, analyze traffic, troubleshoot connectivity, and understand how firewalls control network traffic. But now imagine something different. What if someone is sending
461:01
Speaker A
suspicious traffic across the network? How would you know? And what if your security system could detect that activity? What if it could also stop it?
461:11
Speaker A
This is where we move from simply understanding how networks work to understanding how networks are monitored and protected. Welcome to level four. So far we have focused on how networks work and how to observe their behavior. We followed network paths with tracer
461:31
Speaker A
route. We analyzed packets with wireshark. We examined TCP connections, DNS traffic and HTTP traffic. We explored scanning concepts. We looked at VPNs, proxies, and firewalls. And in the previous video, we learned how to troubleshoot connectivity systematically.
461:53
Speaker A
Now we are entering a new chapter, cyber security and advanced networking. The question is no longer only how does this network communicate. We are now asking how can we detect suspicious communication and protect the network.
462:11
Speaker A
Two important technologies used for this purpose are IDS intrusion detection system and IPS intrusion prevention system. They sound similar but they have an important difference. What you will learn in this video? You will learn what an IDS is,
462:32
Speaker A
what an IPS is, how IDS and IPS monitor network traffic, the difference between detection and prevention, signature-based and behavior-based detection, where IDS and IPS can be placed in a network, how they relate to firewalls and wire sharkark, a safe
462:51
Speaker A
Linux observation of network monitoring, and why IDS and IPS are important In cyber security, the simple idea. Let's start with a simple example. Imagine a security checkpoint at the entrance of a building. The checkpoint watches people entering the building. If someone
463:11
Speaker A
matches a known threat or behaves suspiciously, the security team can raise an alert. But the checkpoint may work in two different ways. The first system watches and reports. The second system watches and can actively stop the activity. This gives us the basic
463:29
Speaker A
difference. IDS detects. IPS detects and can prevent. An IDS is like a security camera with intelligent detection. It observes traffic and generates alerts.
463:43
Speaker A
An IPS is more active. It sits in the traffic path and can take action according to its security rules. But remember, an IDS or IPS is not simply a device that blocks hackers. It is a security system that analyzes network
463:59
Speaker A
activity according to configured detection and prevention policies. The real networking concept. Let's define the terms properly. IDS stands for intrusion detection system. Its primary purpose is to monitor activity and identify traffic or behavior that may indicate a security threat. When
464:21
Speaker A
suspicious activity is detected, an IDS can generate an alert. For example, a device suddenly sends many unusual connection attempts. An IDS may recognize the pattern and alert the security team. An IPS or intrusion prevention system goes one step further.
464:43
Speaker A
It can detect suspicious traffic and take an action such as blocking or dropping the traffic depending on its configuration and capabilities. So the simplest distinction is IDS detect and alert. IPS detect and potentially prevent. The basic idea is for an ID traffic inspect
465:05
Speaker A
detect alert. For an IPS traffic inspect, detect allow or block. This is the basic idea how IDS and IPS analyze traffic. But how do these systems know that something may be suspicious? They can use different detection techniques.
465:23
Speaker A
One common technique is signaturebased detection. A signature is a known pattern associated with a particular type of activity. For example, security software may have a rule that recognizes a known malicious pattern in network traffic. If the observed traffic matches
465:43
Speaker A
that pattern, the system can generate an alert. Another approach is anomaly or behavior-based detection. Instead of looking only for a known pattern, the system can look for activity that is unusual compared with expected behavior.
466:01
Speaker A
For example, a workstation normally communicates with a small group of internal services. Suddenly, it begins making a large number of unusual connections across many systems. That behavior may deserve investigation.
466:18
Speaker A
However, unusual does not automatically mean malicious. This is extremely important. A security system can produce false positives and false negatives. A false positive happens when legitimate activity is incorrectly flagged as suspicious. A false negative happens when malicious activity is not detected.
466:43
Speaker A
So IDS and IPS systems require good rules configuration visibility and ongoing monitoring. Where do IDS and IPS fit? Now let's connect this to what you already learned. Remember the basic network path. Client, then switch, then router, and finally the internet. Now
467:08
Speaker A
imagine we add security monitoring. An IDS can monitor network traffic and generate alerts. An IPS is commonly positioned in line, meaning traffic passes through it so that it can take enforcement action. For example, internet firewall IPS internal network. The exact architecture depends
467:31
Speaker A
on the organization. Some systems inspect traffic at network boundaries. Others monitor internal network segments. Some security platforms combine multiple functions.
467:44
Speaker A
The important idea is the position of a security control determines what traffic it can observe and what actions it can take. If a sensor cannot see certain traffic, it cannot analyze that traffic.
467:59
Speaker A
IDSVS firewall. You already learned about firewalls in video 35. So what is the difference? A firewall primarily controls traffic according to network security rules. For example, source any destination web server protocol TCP port 443 action allow. The firewall asks should
468:26
Speaker A
this traffic be allowed according to the policy? An IDS asks a different question. Does this traffic contain a pattern or behavior that may indicate suspicious activity? An IPS can combine detection with active prevention. So remember the basic difference. Firewall
468:47
Speaker A
policy based filtering, allow or deny, IDS, traffic analysis, detect and alert, IPS, traffic analysis, detect and prevent. These technologies can work together. A firewall does not replace an IDS. An IDS does not automatically replace a firewall. They solve related
469:10
Speaker A
but different security problems. Practical observation. Now, let's connect this concept to your Linux environment. We are not going to install or configure a full IPS.
469:23
Speaker A
Instead, we will observe something we have already learned. Network connections. run ss-tun. The SS command displays socket information. The T option shows TCP connections. The U option shows UDP connections. The N option displays numerical addresses and ports instead of
469:46
Speaker A
trying to resolve names. You may see outputs similar to this. The exact output will depend on your system. Now look at the information. You can see protocol local address, local port, remote address, remote port, connection state where applicable. This is not an
470:07
Speaker A
IDS. That distinction is important. SS simply gives us visibility into current socket activity, but security monitoring systems build on this general idea of visibility. They collect and analyze network activity to identify patterns that may require attention. Connect it
470:29
Speaker A
to what you already learned. Think back to video 28. We used Wireshark to capture traffic. In video 29, we learned how to read packet details. In video 30, we analyzed TCP handshakes. In video 33, we learned about network scanning. Now
470:51
Speaker A
imagine combining those concepts. Suppose a system suddenly generates many TCP connection attempts. You could observe the connections. Wireshark could show the packets. TCP flags could reveal connection behavior. An IDS could analyze those patterns and generate an alert. An IPS could potentially block
471:15
Speaker A
matching traffic according to its configuration. Network traffic, packets, traffic analysis, detection, alert, investigation prevention/response.
471:29
Speaker A
This is the direction we are taking in level four. We are connecting networking knowledge to security operations. Cyber security connection. This is where networking becomes directly connected to cyber security.
471:44
Speaker A
A security professional may need to answer questions such as what traffic is moving through the network? Which systems are communicating? Is this behavior normal? Is a known malicious pattern present? Is a system scanning other systems? Is an unusual connection
472:03
Speaker A
being established? Should the traffic generate an alert? Should the traffic be blocked and what evidence should be investigated?
472:12
Speaker A
IDS and IPS systems can help answer these questions, but they are not perfect. A security alert is not automatically proof of an attack. It is an indicator that requires context and investigation.
472:27
Speaker A
Security professionals may combine IDS/IPs alerts with firewall logs, DNS logs, endpoint logs, packet captures, authentication logs, and other security data. This creates a more complete picture of what happened. A simple realworld example. Imagine an internal workstation suddenly attempts
472:53
Speaker A
connections to hundreds of systems. A possible investigation could look like this. The network sensor observes unusual connection behavior. The IDS generates an alert. The security analyst examines the source IP. They check firewall and endpoint logs. They inspect packet captures if available. They
473:17
Speaker A
determine whether the activity was authorized. If the behavior is confirmed as malicious, security controls may be used to contain or block it. Notice the workflow. The goal is not simply find an attack. The goal is observe, detect, investigate, verify, and respond. That
473:39
Speaker A
mindset will become increasingly important throughout level 4. Recap. Let's summarize. First, an IDS is designed primarily to detect suspicious activity and generate alerts. Second, an IPS can detect suspicious activity and may actively prevent or block it. Third, IDS and IPS systems can use signatures,
474:05
Speaker A
behavioral patterns, and other detection methods. Fourth, firewalls IDs and IPS perform different but complimentary security functions. And finally, detection is only the beginning. A security professional must investigate alerts and understand the surrounding network activity. Level four begins. We
474:28
Speaker A
have now crossed an important point in the course. In levels one and two, we learned how networks work. In level three, we learned how to observe, analyze, test, and troubleshoot network behavior. Now in level four we are asking a different question. How can
474:50
Speaker A
networks be attacked, monitored and protected? And our next topic is one of the most important security principles for controlling communication. Network segmentation.
475:03
Speaker A
Instead of putting every device into one large network, organizations can divide networks into separate segments. But why would we do that? What happens if an attacker compromises one system? And how can segmentation limit unnecessary communication between systems? We will answer those questions
475:27
Speaker A
in video 38, network segmentation. Imagine a company has 500 computers, servers, security systems, printers, and guest devices. Now imagine putting all of them into one large network. If one computer is compromised, should that computer be able to communicate freely with every
475:54
Speaker A
other system? What if the attacker discovers a server? What if that server contains sensitive information?
476:04
Speaker A
This is one reason network segmentation is so important. Instead of treating the entire network as one large space, we can divide it into smaller controlled sections. In this video, we are going to learn how network segmentation works and
476:22
Speaker A
why it is an important cyber security defense. Welcome to the second video of level 4. In video 37, we moved from practical networking into cyber security by learning about IDS and IPS.
476:40
Speaker A
We learned how network traffic can be monitored, suspicious activity can be detected and in some environments traffic can be prevented. But detection is only one part of network security.
476:53
Speaker A
Another important question is what happens if an attacker gets inside. This is where segmentation becomes important.
477:03
Speaker A
Network segmentation allows an organization to separate systems and control how those systems communicate with each other. You already learned about vans in video 22. Today we are going to take that concept further and look at it from a cyber security
477:22
Speaker A
perspective. What you will learn in this video? You will learn what network segmentation means, why organizations segment networks, the difference between a flat network and a segmented network, how vans can support segmentation, how rooting and firewalls control communication between segments, what a
477:46
Speaker A
DMZ is, how segmentation can limit the impact of a compromise. A practical way to observe network interfaces and roots on Linux and why segmentation matters to cyber security. The simple idea. Let's start with a simple analogy. Imagine a
478:06
Speaker A
large office building. Instead of giving everyone access to every room, the building is divided into different areas. Employees have access to employee areas. The server room has restricted access. Guests have access to public areas. Security staff may have access to
478:26
Speaker A
additional areas. The building is still one physical building, but access is separated. Network segmentation follows a similar idea. A network can be divided into separate logical or physical segments. For example, employee servers, guests, management security systems.
478:47
Speaker A
These segments can have different security policies. The goal is not simply to make the network look organized. The goal is to control communication and reduce unnecessary access. The real networking concept.
479:04
Speaker A
Network segmentation is the practice of dividing a network into separate segments so that communication between those segments can be controlled. A segment can be separated using technologies such as VLS, different IP networks or subnets, routters, firewalls, access control
479:26
Speaker A
policies. You already learned about vans in video 22. For example, van 10, employees, van 20, servers, van 30, guests, van 40, management. These vans represent separate layer 2 broadcast domains. But there is an important point. Creating vans alone does not
479:49
Speaker A
automatically create complete security. If systems in different vans need to communicate, layer 3 routing is required and that communication can then be controlled with routing policies, access control rules or firewalls.
480:07
Speaker A
So segmentation is not simply put devices into different vans. It is separate systems and control the communication between them. Flat network versus segmented network. Let's compare two network designs. First a flat network. Imagine a switch connected to employees, servers, and guests.
480:31
Speaker A
Everything is placed into one large network. Communication between devices may be easier, but there is less separation. Now imagine a segmented network, a firewall or router connected to employees, servers, and guests. The groups are separated using VL10 for employees, van 20 for servers, and
480:56
Speaker A
van 30 for guests. Now traffic between these areas can be controlled. For example, employees may need access to certain application servers. Servers may need access to specific services. Guests may only need internet access. And management systems may need access to
481:16
Speaker A
network infrastructure. This creates a much more controlled environment. Why segmentation matters for security? Now, let's connect segmentation to cyber security. Imagine an attacker compromises a guest laptop.
481:34
Speaker A
If the network is completely flat, that compromised device may be able to communicate with many other systems. The attacker could potentially discover more hosts and services. But with proper segmentation, guest traffic can be restricted. For example, guest network,
481:53
Speaker A
internet access allowed, internal servers blocked. Now imagine a different situation. An employee workstation becomes compromised. That workstation may need access to certain servers, but it does not necessarily need unrestricted access to database servers, network management systems, security infrastructure or other employee
482:20
Speaker A
devices. Segmentation can reduce unnecessary communication. This leads to an important security principle. A system should have only the network access it actually needs. This is closely related to the principle of least privilege. How communication between segments works. Let's look at
482:43
Speaker A
what happens when two devices are in different networks. Suppose we have employee IP address 192.168.10.20.
482:55
Speaker A
20 server IP address 192.168.20.50. These are different IP networks. The employee cannot simply treat the server as a local layer 2 destination. The traffic needs to be rooted between the networks. A simplified flow looks like this. Employee 192.168.10.20.
483:23
Speaker A
Then the gateway or layer 3 device. Then the firewall policy and finally the server network 192.168.2050.
483:36
Speaker A
The firewall or layer 3 device can evaluate the traffic. For example, source 192.168.10.0/24 destination 192.168.20.0.
483:53
Speaker A
0/24 protocol TCP port 443 action allow another rule might say source guest network destination server network action deny this is where segmentation becomes a security control the network is separated and communication between the separated areas can be governed by policy the DMZ
484:19
Speaker A
another important segmentation concept is the DMZ. DMZ stands for demilitarized zone. In networking, a DMZ is a separate network segment commonly used for systems that need to be reachable from less trusted networks such as internet-facing servers. For example,
484:40
Speaker A
internet, then firewall. From the firewall, traffic can be separated into two areas. DMZ, an internal network. In the DMZ, we might have a web server. In the internal network, we might have employee computers and a database. A public web
485:00
Speaker A
server might be placed in the DMZ. The idea is that the public-f facing server should not automatically have unrestricted access to the internal network. For example, internet to web server allow web server to database specific access only. Internet to
485:21
Speaker A
internal computers block. The exact design depends on the organization and its security requirements. The important principle is public-f facing systems should not automatically have the same level of network trust as internal systems. Practical Linux observation.
485:44
Speaker A
Now let's observe the building blocks of segmentation on a Linux system. We are not going to modify network configuration. We are simply going to inspect the system. First run IP adder.
485:58
Speaker A
This shows the network interfaces and their IP addresses. You may see something like ETH0 in 10.22.238.14.
486:08
Speaker A
238.14/24. You may also see additional interfaces depending on your system. For example, Eth0.1. Oh, an interface such as Eth10 is commonly used for a vlan interface with vlan ID10. Although interface naming depends on the system configuration. To inspect more detailed
486:36
Speaker A
link information, you can use ip-d link show. The dash d option asks IP to display additional details. If van interfaces are configured, the output can contain information identifying the van configuration.
486:54
Speaker A
Now check the routing table IP route. You may see roots information like this. The exact output depends on your environment. The important thing to notice is that different IP networks can have different routes. This is the networking foundation that allows
487:14
Speaker A
[clears throat] controlled communication between separate network segments. Connecting the practical to security. The commands we just used do not create segmentation. They allow us to observe the network configuration that supports it. We can see network interfaces, IP addresses, vlan related interfaces when
487:38
Speaker A
configured roots gateways different network prefixes in a real security investigation. This type of information can help an analyst understand what network am I on?
487:52
Speaker A
Which interfaces exist, which networks are reachable, what routes are configured, which systems may belong to different segments. This is why the networking fundamentals from earlier levels continue to matter. Segmentation and lateral movement. There is another important cyber security concept,
488:16
Speaker A
lateral movement. Lateral movement describes an attacker's movement from one compromised system or environment toward other systems within a network.
488:26
Speaker A
Imagine this internet, then a compromised workstation, then an internal server, and finally a database.
488:36
Speaker A
If there are few controls between these systems, an attacker may have more opportunities to move through the environment. With segmentation, access between these areas can be restricted.
488:50
Speaker A
For example, internet, compromised workstation, restricted server network, protected database. Access between these areas can be controlled by security policies. The attacker may still be a threat. Segmentation does not make a network invulnerable, but properly designed segmentation can reduce
489:12
Speaker A
unnecessary paths and make unauthorized movement more difficult. This is one reason segmentation is an important part of defense in depth. Cyber security connection network segmentation supports several security goals. Number one, limiting access. Not every system needs to communicate with every other system.
489:37
Speaker A
Segmentation helps enforce that principle. Number two, reducing attack surface. Fewer reachable systems and services can mean fewer unnecessary communication paths. Number three, limiting lateral movement. If one system is compromised, segmentation can restrict its ability to reach other parts of the network.
490:02
Speaker A
Number four, protecting sensitive systems. Databases, management systems, authentication infrastructure, and other sensitive resources can be placed into more controlled network segments.
490:18
Speaker A
Number five, improving monitoring. When communication between segments is controlled through specific gateways or firewalls, security teams can monitor important traffic paths more effectively. And this connects directly to video 37. IDS and IPS systems can monitor traffic. Segmentation controls
490:42
Speaker A
where traffic is allowed to move. Together, these technologies can provide multiple layers of defense. A simple enterprise example.
490:52
Speaker A
Imagine a small company with four major network segments. VAL 10 employees. VLAN 20 servers. VLAN 30 guests. VLAN 40 management. The security policy might look conceptually like this. Employees to approved servers allow. Employees to management network block. Guests to the
491:16
Speaker A
internet allow. Guests to internal servers, block. Servers to required services, allow. Servers to the guest network, block. Management to network devices, allow. The exact rules depend on the organization, but the principle is clear. Different systems have different trust and access requirements.
491:41
Speaker A
The network should reflect those requirements. Recap. Let's review the key ideas. First, network segmentation divides a network into separate logical or physical segments. Second, vans and different IP networks can help create those segments. Third, communication between segments requires rooting and
492:05
Speaker A
can be controlled by firewalls and access control policies. Fourth, segmentation can reduce unnecessary access and help limit lateral movement.
492:16
Speaker A
And fifth, segmentation is not a complete security solution by itself. It works together with firewalls, IDS and IPS, monitoring, endpoint security, access controls, and logging. Together, these technologies create a defense in-depth approach. Now we have learned how to divide a network into controlled
492:41
Speaker A
segments. But there is another major part of modern networking that we have not explored deeply yet. Wireless networks. Your laptop, smartphone, tablet, and many IoT devices may connect without an Ethernet cable. So how does wireless networking actually work? What
493:01
Speaker A
are Wi-Fi access points? SSID channels WPA2 and WPA3. And from a cyber security perspective, what changes when the network is transmitted through the air instead of a physical cable? That is what we will explore next. Video 39. Wireless
493:23
Speaker A
networking basics. You connect your laptop or phone to Wi-Fi every day. You select a network, enter a password and suddenly your device can communicate with the internet. But what is actually happening between your device and the wireless network? How does your device
493:46
Speaker A
communicate without an Ethernet cable? How does a wireless access point handle multiple devices? And from a cyber security perspective, what makes a wireless network secure or insecure?
493:59
Speaker A
Today we are going to understand what is happening behind Wi-Fi. In the previous video we learned about network segmentation.
494:10
Speaker A
We saw how networks can be divided into separate areas using technologies such as VLANs, subnets, routting and firewalls. But not every device connects to the network using a cable. Phones, laptops, tablets, and many other devices commonly connect wirelessly.
494:31
Speaker A
This brings us to wireless networking. Wireless networking allows devices to communicate using radio signals instead of physical network cables. And one of the most common technologies used for this is Wi-Fi. In this video, we will build the networking foundation needed
494:51
Speaker A
to understand how wireless networks work and why they matter to cyber security. What you will learn by the end of this video, you will understand what wireless networking is, what Wi-Fi is, what a wireless access point does, what an SSID
495:10
Speaker A
is, how wireless devices connect to an access point. The basic idea behind wireless channels and frequency bands, how wireless networks differ from wired Ethernet, and why wireless security is important. The simple idea. Let's start with something familiar. Imagine your
495:32
Speaker A
laptop is connected to your home Wi-Fi. There is no Ethernet cable connecting the laptop directly to the router.
495:40
Speaker A
Instead, the laptop uses radio communication to communicate with a wireless access point. The access point receives the wireless communication and connects it to the rest of the network.
495:53
Speaker A
Think of the access point as a wireless entrance into the network. Your device communicates through radio waves. The access point receives that communication and forwards traffic into the network.
496:08
Speaker A
So the basic path can look like this. Wireless device, then access point, then local network, then router, and finally the internet. The important point is that wireless does not replace networking. It simply provides a different way for a device to connect to
496:27
Speaker A
the network. Instead of using a physical Ethernet cable, the device uses radio communication. What actually happens when you connect to Wi-Fi? Now, let's look at the actual process. First, your wireless device needs to discover available wireless networks. You may see names such as a
496:47
Speaker A
CW360-Wifi home network office- wifi. These names are called SSIDs. SID stands for service set identifier.
497:01
Speaker A
In simple terms, the SSID is the name used to identify a wireless network. When you select a network, your device communicates with the access point. If the network is protected, authentication is required. For example, a Wi-Fi network may use WPA2
497:22
Speaker A
or WPA3 security. After successful authentication, the device can establish wireless connectivity. It can then receive network configuration such as an IP address, usually through DHCP.
497:39
Speaker A
Remember from earlier videos, the wireless connection gets the device onto the local network. Then normal networking concepts take over. The device has an IP address. It may have a default gateway. It communicates using packets and traffic can eventually
497:58
Speaker A
travel through the router toward the internet. So Wi-Fi is not a separate version of the internet. It is simply one method of connecting a device to a network.
498:10
Speaker A
Frequency bands, channels, and wireless communication. Wireless networks use radio frequencies to communicate. Common Wi-Fi frequency bands include 2.4 4 GHz, 5 GHz, and with newer Wi-Fi technologies, 6 GHz. These bands provide different characteristics.
498:34
Speaker A
For example, 2.4 GHz generally provides better range and can travel through obstacles more effectively than higher frequency bands, but it can also experience more interference.
498:48
Speaker A
5 GHz can provide higher performance in many environments, but generally has shorter range than 2.4 GHz. 6 GHz provides additional spectrum for supported Wi-Fi technologies and devices. The exact behavior depends on the environment, equipment, regulations, and configuration.
499:12
Speaker A
Inside these frequency bands, Wi-Fi uses channels. A channel is a portion of the available radio spectrum used for wireless communication.
499:23
Speaker A
If many nearby networks use overlapping or congested channels, interference can affect wireless performance. This is one reason a Wi-Fi connection can become slower or less reliable even when the internet connection itself is working normally. There is another important
499:43
Speaker A
difference between wireless and wired networking. With Ethernet, a physical cable provides the communication medium.
499:52
Speaker A
With Wi-Fi, devices share a radio environment. That means wireless communication has to coordinate access to the shared medium. This is one reason wireless networking has its own protocols and mechanisms for managing communication.
500:10
Speaker A
Access point, router, and wireless client. Let's clear up another common misunderstanding. A wireless access point and a router are not exactly the same thing. A wireless access point provides wireless connectivity to a network. A router connects different networks and makes
500:30
Speaker A
forwarding decisions between them. However, home networking equipment often combines several functions into one physical device. A typical home device may contain a router, a switch, a wireless access point, a firewall, and sometimes other networking functions. So when someone says my Wi-Fi router, they
500:57
Speaker A
may actually be referring to one physical device performing several different networking roles. From the wireless client's perspective, the important relationship is wireless client to access point to network. The wireless client could be a laptop, smartphone, tablet, or another Wi-Fi
501:18
Speaker A
enabled device. The access point provides the wireless connection. After the device joins the network, it can communicate using the same networking concepts we have already learned. IP addressing, routting, DNS, TCP and UDP, firewalls and network monitoring. This is why everything we learned earlier is
501:42
Speaker A
still useful. Practical observation. Now let's observe the wireless interfaces on a Linux machine on a Linux system with wireless hardware and the appropriate tools available. Run IWDEV.
501:57
Speaker A
This command displays information about wireless interfaces managed by the Linux wireless subsystem. You may see an interface such as interface WO type managed. Your interface name may be different. Modern Linux systems commonly use names such as WL, O WLP2
502:19
Speaker A
S0, or another predictable interface name. The important thing to notice is that Linux recognizes a wireless network interface. You can also run IP link.
502:32
Speaker A
This shows the network interfaces available on the system. If your machine has a wireless interface, you may see it listed alongside other interfaces.
502:43
Speaker A
These commands do not perform an attack or change the wireless network. They simply help us observe the network interfaces available on our own system.
502:54
Speaker A
The exact output depends on your hardware, drivers, Linux distribution, and current connection. Cyber security connection. Wireless networks are especially important in cyber security because the communication medium is radio. A wired network generally requires physical access to the cable or
503:17
Speaker A
network equipment. Wireless communication can extend beyond the physical building. That means security controls are extremely important. Modern Wi-Fi networks commonly use security mechanisms such as WPA2 or WPA3 to protect wireless access and communication. Security professionals may need to examine wireless
503:43
Speaker A
authentication, encryption, access point configuration, connected devices, signal coverage, unexpected access points, wireless network segmentation, and network monitoring. An organization might also place wireless clients into a separate van or network segment. For example, employees, corporate Wi-Fi, employee van, and guests, guest Wi-Fi, guest van.
504:12
Speaker A
The guest network can then be restricted from accessing sensitive internal systems. This connects directly to what we learned in video 38.
504:23
Speaker A
Wireless networking provides connectivity. Segmentation and security controls determine what that connectivity is allowed to reach. Recap. Let's summarize what we learned. First, wireless networking allows devices to communicate using radio instead of physical network cables. Second, Wi-Fi is a common
504:47
Speaker A
technology used for wireless networking. Third, an access point provides wireless connectivity to a network. Fourth, an SSID identifies a wireless network while authentication and security mechanisms control access. And finally, wireless networks can be integrated with technologies such as via lans, routting,
505:13
Speaker A
and firewalls to create stronger network security. So far we have looked at how networks communicate, how traffic can be observed, how networks can be segmented, and how wireless devices connect. But real networks do not always work perfectly. A device may lose
505:33
Speaker A
connectivity. DNS may fail. A gateway may become unreachable. A wireless connection may become unstable. And simply knowing the networking concepts is not enough. A security professional also needs to know how to systematically diagnose what is happening. That brings us to the next
505:57
Speaker A
video. Network diagnostics. Systematic troubleshooting. A computer suddenly loses network access. The website does not open. The Wi-Fi looks connected, but something is wrong. So, where do you start? Is the network interface working? Does the computer have an IP address? Can it
506:23
Speaker A
reach the gateway? Can it reach the internet? Is DNS working? Or is the problem actually the website itself? In cyber security and networking, guessing is not enough. You need a systematic way to find the problem.
506:41
Speaker A
In the previous video, we learned how wireless networks work. We saw how devices connect to access points and how wireless connectivity becomes part of a larger network. But whether a device uses Wi-Fi or Ethernet, network problems can happen at many different points.
507:00
Speaker A
That is why network diagnostics is important. In video 36, we introduced basic connectivity troubleshooting.
507:10
Speaker A
Now in level four, we are taking that idea further. Instead of simply asking, does the network work, we will learn how to diagnose a problem systematically, the goal is to move from symptom, then evidence, then test, then result, and
507:29
Speaker A
finally root cause. What you will learn by the end of this video you will understand what network diagnostics means. Why systematic troubleshooting is important. How to separate local problems from remote problems. How to check interfaces IP configuration routting and connectivity. How to test
507:52
Speaker A
DNS and application level connectivity. How to interpret different results and why systematic diagnostics matters in cyber security. The simple idea. Let's imagine your Linux computer cannot open a website. A beginner might immediately say the internet is down. But that
508:14
Speaker A
conclusion is too broad. The problem could be much closer to the computer. For example, the network interface may be disconnected. The computer may not have an IP address. The default gateway may be unreachable. DNS may not be resolving names. A firewall may be
508:34
Speaker A
blocking traffic. Or the remote server may be unavailable. This is why troubleshooting should move from the simplest and closest components toward the more distant components. Think of it like checking a chain. If the first link is broken, there is no reason to
508:52
Speaker A
investigate the final link first. The systematic diagnostic process. A useful diagnostic process is interface and then IP, then gateway, then external connectivity, then DNS, and finally application. Let's understand each part. First, check the network interface. Is the computer
509:16
Speaker A
actually connected? Next, check the IP configuration. Does the system have a valid IP address? Then check the default gateway. Can the computer communicate with the local router? After that, test external connectivity. Can the computer reach a known external IP address? Then
509:36
Speaker A
test DNS. Can the computer translate a domain name into an IP address? Finally, test the application. Can the browser or command line client actually communicate with the destination?
509:51
Speaker A
This approach prevents us from jumping to conclusions if the computer does not even have an IP address, there is no reason to start investigating DNS.
510:03
Speaker A
If DNS works, but the website does not load, the problem is probably somewhere beyond basic DNS resolution. The goal is to narrow the problem down one layer at a time. How to interpret the results?
510:19
Speaker A
Now, let's connect the tests to possible causes. Suppose the network interface is down that points toward a local connectivity problem. Maybe the Wi-Fi connection is disconnected, the Ethernet cable is unplugged, or the interface has been disabled. Now suppose the interface
510:38
Speaker A
is working but there is no usable IP address. The problem could involve DHCP or local network configuration.
510:48
Speaker A
Next suppose the computer has an IP address but it cannot reach its default gateway that points toward a local network problem. The issue could involve the wireless connection, Ethernet, vlan, switch, access point, gateway or firewall configuration.
511:08
Speaker A
Now suppose the gateway responds but an external IP address does not. The problem may be farther along the network path. It could involve rooting, upstream connectivity, filtering or an internet service issue. Now imagine an external IP responds but example.com does not
511:29
Speaker A
resolve that points toward DNS. Finally, if DNS works but the website still does not load, we can investigate higher level problems such as TCP connectivity, TLS HTTP proxy configuration, firewall rules, or the remote application itself.
511:53
Speaker A
Notice that none of these results automatically proves one specific cause. They help us narrow the investigation.
512:01
Speaker A
That distinction is extremely important. Good troubleshooting is based on evidence. Visualize a real diagnostic path. Let's imagine a user reports. My computer cannot access a website.
512:17
Speaker A
Instead of immediately checking the website, we start locally. The computer has a working network interface. It has an IP address. It has a default gateway.
512:28
Speaker A
The gateway responds. An external IP address responds. DNS successfully resolves the domain, but the HTTPS connection fails. Now, we have already eliminated several possible causes. The network interface is working. The local IP configuration is working. The gateway is reachable. External connectivity
512:53
Speaker A
exists. DNS is working. So the investigation can move toward the application connection. We can then examine TCP connectivity, firewall rules, proxy configuration, TLS or the remote service. This is the real value of systematic troubleshooting. You do not need to guess the entire answer
513:16
Speaker A
immediately. you progressively reduce the number of possible causes. Practical observation. Let's observe this process on a Linux system. First, check the network interface and IP configuration. IP address. Look for the active interface and its IP address. Next, check the
513:38
Speaker A
routting information IP route. Look for a line such as default via 10.92.44.236. 236 devo.
513:49
Speaker A
This shows the default gateway. Now test the gateway. Ping- C410.92.44.236. The - C4 option tells ping to send four packets. If the gateway responds, the local path is working at least to that point. Next, test an external IP
514:10
Speaker A
address. Ping- C48.8.8.8. 8. This helps test connectivity beyond the local gateway. Then test DNS digample.com.
514:23
Speaker A
Look for an answer containing an IP address. Finally, test the application layer curl-iggoogle.com. The -i option asks curl to request the HTTP response headers rather than downloading the full page. The exact output will vary depending on your system and network. The important thing
514:47
Speaker A
is not to memorize one output. The important thing is to understand the order interface, IP address, gateway, external IP address, DNS and finally the application that is systematic network diagnostics, cyber security connection.
515:06
Speaker A
Systematic troubleshooting is also a cyber security skill. During an incident, a security professional may see symptoms such as a device suddenly losing connectivity, unexpected DNS failures, a server becoming unreachable, abnormal routting, blocked connections, or unusual network behavior. Instead of
515:30
Speaker A
immediately assuming an attack, the analyst collects evidence. They can compare IP configuration, routing tables, DNS responses, firewall rules, network traffic, packet captures, system logs, and monitoring alerts. This helps separate a normal network failure from a possible security event. For example, a
515:54
Speaker A
connectivity problem could be caused by a broken interface, but it could also involve an incorrect firewall rule, a routing change, or another security control. The important skill is the same. Observe, test, interpret, and verify. Do not treat one failed test as
516:14
Speaker A
proof of an attack. Recap. Let's summarize. First, network diagnostics means using evidence to identify where a network problem is occurring. Second, troubleshoot systematically instead of guessing. Third, move through the path interface, IP address, gateway, external connectivity, DNS, and finally the
516:39
Speaker A
application. Fourth, commands such as IP adder, IP root, ping, dig, and curl can help us isolate problems. And finally, the same diagnostic thinking is useful during cyber security investigations.
516:54
Speaker A
So far in level four, we have learned about IDS and IPS, network segmentation, wireless networking, and systematic diagnostics. We have focused on how networks work and how professionals observe and troubleshoot them. But networks are not only affected by
517:15
Speaker A
accidental failures. They can also be deliberately targeted. An attacker may try to intercept traffic, disrupt availability, manipulate network communication or gain unauthorized access. So in the next video we will begin looking at the major categories of network attacks. Video 41 common network
517:40
Speaker A
attacks. Imagine a network where everything appears to be working normally. Devices are connected. Users can access websites. Servers are responding. But somewhere inside that network, an attacker is trying to interfere with communication.
518:02
Speaker A
They may target how devices discover each other. They may manipulate network traffic. They may overwhelm a service or they may try to position themselves between two communicating systems. So the question is what kinds of attacks can happen at the network level? That is
518:23
Speaker A
what we are going to explore in this video. Welcome to video 41. In the previous videos, we learned how to understand and troubleshoot networks systematically. We learned about IDS and IPS, network segmentation, wireless networking, and network diagnostics.
518:44
Speaker A
Now we are moving into another important part of level four, understanding common network attacks. This does not mean immediately attacking a network. The goal is to understand how these attacks work, what they look like, and how security professionals detect and defend
519:04
Speaker A
against them. This knowledge will prepare us for the next videos where we will examine specific attacks such as ARP spoofing, DNS spoofing, and DHCPbased attacks in controlled environments. What you will learn in this video? You will learn what a
519:26
Speaker A
network attack is, the major categories of network attacks, how attackers can target availability, how attackers can manipulate network communication, what network reconnaissance and scanning are. How wireless networks can be targeted. How security professionals detect suspicious network behavior. Why
519:50
Speaker A
understanding normal network behavior is important for security. The simple idea. A network attack happens when someone intentionally interacts with a network or its communication in a way that can compromise confidentiality, integrity, or availability.
520:10
Speaker A
Let's make that simple. Confidentiality means information should only be accessible to authorized parties. Integrity means information should not be changed without authorization.
520:24
Speaker A
Availability means systems and services should remain accessible when needed. Different attacks can target different goals. For example, an attacker may try to observe traffic. That can affect confidentiality.
520:40
Speaker A
They may try to modify communication. That can affect integrity. Or they may overwhelm a service with traffic that can affect availability.
520:50
Speaker A
This is why network security is not just about blocking one specific attack. It is about understanding how communication can be abused. Common categories of network attacks. There are many network attacks, but we can organize them into several useful categories. Number one,
521:12
Speaker A
traffic interception and manipulation. An attacker may attempt to position themselves between communicating systems or manipulate network communication. One example is man in the middle or M I TM.
521:27
Speaker A
The goal may be to observe, modify or redirect communication. Later in this level, we will study M I TM attacks in more detail. Number two, address and name manipulation. Networks depend on mechanisms such as ARP and DNS. If an
521:48
Speaker A
attacker manipulates these mechanisms, devices may receive incorrect information. For example, ARP spoofing can attempt to associate an attacker's MAC address with another devices's IP address. DNS spoofing can attempt to provide a false DNS response. These attacks are especially important because
522:11
Speaker A
they target mechanisms that normal network communication depends on. We will study both of them separately in the upcoming lessons. Number three, availability attacks. Some attacks focus on making a service difficult or impossible to access. A common example is denial of service or DOS. The basic
522:35
Speaker A
goal is to consume resources such as network bandwidth, CPU, memory, connection capacity, and application resources. When many distributed systems participate in this type of attack, it becomes a distributed denial of service or DD Os. We will study the networking
522:55
Speaker A
perspective of D O S and D O S later in this level. Number four, network scanning and discovery. Attackers may also try to discover what exists on a network. They may look for live hosts, open ports, running services, network
523:17
Speaker A
devices, and accessible systems. This is related to network reconnaissance and scanning. But remember what we learned in video 33.
523:27
Speaker A
Scanning does not automatically mean a system is vulnerable. It is a discovery process. The same techniques can also be used legitimately by security professionals during authorized assessments. Number five, wireless attacks. Wireless networks introduce another important consideration. Unlike a cable that physically connects a
523:52
Speaker A
device to a network, wireless communication travels through radio signals. That creates additional security concerns.
524:03
Speaker A
For example, attackers may attempt to target wireless authentication, create a rogue access point, interfere with wireless communication, or trick users into connecting to an unauthorized network. This is one reason wireless security must be considered separately from simply securing wired connections.
524:27
Speaker A
How these attacks differ? It is important not to think of all network attacks as the same. Consider these examples. An attacker manipulating ARP is targeting local network communication. An attacker manipulating DNS is targeting name resolution. An attacker scanning ports is trying to
524:49
Speaker A
learn about services and reachable systems. An attacker performing a DOS attack is targeting availability. An attacker attempting MITM is trying to interfere with communication between systems. The important skill is recognizing what part of the network communication is being targeted. That
525:12
Speaker A
question helps security professionals understand what evidence to look for. What does an attack look like on a network? One of the most important ideas in network security is this. Attacks generate network behavior and network behavior can often be observed. For
525:32
Speaker A
example, a security professional might notice a large number of connection attempts, unexpected ARP activity, unusual DNS responses, repeated requests to the same service, unexpected traffic between network segments, a sudden increase in traffic volume or communication with systems that normally
525:56
Speaker A
do not communicate with each other. But there is an important warning. Unusual does not automatically mean malicious. A large number of connections could be legitimate. A DNS change could be part of normal administration. A new device could simply be a newly authorized
526:16
Speaker A
system. A sudden traffic increase could be caused by a legitimate event. That is why security professionals do not rely on one observation alone. They compare evidence. They investigate context and they verify what actually happened. This connects directly to the diagnostic
526:39
Speaker A
mindset we developed in video 40. Observe, test, interpret, and verify. Step five, practical observation. We are not going to attack a network in this lesson. Instead, let's observe the kind of network information a security professional may start with on a Linux
527:02
Speaker A
system. Run IP nay. This displays the systems neighbor table. You may see entries containing an IP address, a MAC address, an interface, and a state. This connects directly to what we learned earlier about local network communication and ARP. You can also
527:23
Speaker A
observe active network connections with SS- tune. The -asht option shows TCP connections. The - U option shows UDP sockets. The dash end option displays addresses and ports numerically. These commands do not detect attacks by themselves. They simply give us
527:44
Speaker A
observations and observations are the starting point for investigation. Cyber security connection. Now we can connect everything together. A security professional needs to understand normal network behavior before identifying abnormal behavior. That means understanding how devices communicate, how addresses are resolved, how traffic
528:11
Speaker A
moves between networks, which services normally communicate, which ports are expected, which systems belong to which network segment, and what normal traffic patterns look like. Then when something changes, we can investigate it. For example, unexpected ARP changes may lead
528:32
Speaker A
us to investigate possible ARP spoofing. Unusual DNS responses may lead us to investigate DNS manipulation.
528:42
Speaker A
Large traffic volumes may lead us to investigate a possible availability attack. Unexpected connection attempts may lead us to investigate scanning or service discovery. The important point is not to immediately label something as an attack. Instead, observe, analyze, verify, detect, and respond. This is the
529:06
Speaker A
mindset we will use throughout the rest of level four. Recap. Let's quickly review. A network attack intentionally abuses network communication or network resources. Different attacks target different areas. ARP spoofing targets local address resolution. DNS spoofing targets name resolution. MITM attacks
529:29
Speaker A
target communication between systems. DOS and DDOS target availability. Scanning helps discover hosts, ports, and services. And wireless networks introduce additional attack surfaces because communication occurs through radio signals. Most importantly, unusual network behavior is an indicator for investigation, not automatic proof of an
529:56
Speaker A
attack. Now that we understand the major categories of network attacks, it is time to examine one of the most important examples in detail. In the next video, we will focus on ARP spoofing. We will see how ARP normally
530:14
Speaker A
helps devices communicate on a local network. How ARP spoofing attempts to manipulate that process and how the behavior can be observed and analyzed in a controlled lab. That is video 42 ARP spoofing concept and controlled lab.
530:38
Speaker A
On a local network, your computer needs to know which MAC address belongs to which IP address. That is where ARP comes in. But what if another device sends false information? What if your computer is told this IP address belongs
530:57
Speaker A
to my MAC address? Your computer may believe it and that simple manipulation can become the foundation of a much larger attack. This is known as ARP spoofing.
531:10
Speaker A
Today we are going to understand exactly how it works, how to recognize it and how security professionals investigate it in a controlled environment. In video 41, we introduced common network attacks and saw that attackers can target different parts of network
531:29
Speaker A
communication. One important category is address manipulation. Today we are focusing on one specific example ARP spoofing. You already learned about ARP in video 15.
531:45
Speaker A
You also learned about MAC addresses, IP addresses, switching and local network communication. So we are not going to restart those lessons. Instead, we are going to connect them together and see how ARP can be abused. The goal is
532:02
Speaker A
understand observe analyze detect and defend. All practical observation in this lesson should be performed on your own systems, VMs, or an intentionally isolated lab network. By the end of this video, you will understand what ARP normally does, what ARP spoofing means,
532:25
Speaker A
how false ARP information can affect communication, what a normal AR exchange looks like, how suspicious AR behavior can be observed, how to investigate ARP information on Linux, why ARP spoofing matters to cyber security. The simple idea, let's start with the normal
532:45
Speaker A
situation. Imagine your computer has IP 1 192.168.1.2 and your local gateway has IP 1 192.168.1.1.
533:00
Speaker A
Your computer knows the gateway's IP address. But on an Ethernet or Wi-Fi network, local communication also needs a MAC address. So your computer needs to discover 192.168.1.1.
533:16
Speaker A
Which MAC address? ARP or address resolution protocol helps answer that question. Your computer can send an ARP request asking who has 1 192.168.1.1.
533:31
Speaker A
The device using that IP can respond with its MAC address. Your computer can then use that information for local communication.
533:40
Speaker A
This is normal ARP behavior. What is ARP spoofing? Now imagine another device on the same local network sends false ARP information. Instead of the real gateway saying 1 192.168.1.1 gateway MAC, the attacker's device attempts to make other systems believe 1
534:05
Speaker A
192.168.1.1 attacker MAC. If a victim accepts that incorrect information, the victim may send local traffic intended for the gateway to the attacker's device instead.
534:20
Speaker A
That is the basic idea behind ARP spoofing, also called ARP poisoning. Notice something important. The attacker does not need to change the victim's IP address. Instead, the attacker is attempting to manipulate the relationship between an IP address and a
534:40
Speaker A
MAC address on the local network. That is why understanding both IP addresses and MAC addresses is important. How AP spoofing can affect communication. Let's follow the concept carefully. Suppose we have three systems. Client IP address 192.168.1.20.
535:03
Speaker A
Gateway IP address 192.168.1.1 and a potential attacker IP address 192.168.1.50 50 normally client then gateway. The client uses the gateway's legitimate MAC address. But if the client's ARP information is manipulated, the path may become client then attacker then
535:30
Speaker A
gateway. This can create different consequences depending on the attacker's behavior and the network configuration.
535:39
Speaker A
The attacker may attempt to observe traffic, modify traffic, redirect traffic, or disrupt communication. This is one reason ARP spoofing can become part of a man-in-the-middle attack. But remember, ARP spoofing and MITM are not exactly the same thing.
536:02
Speaker A
ARP spoofing is one technique that can help an attacker position themselves in the communication path. We will study the broader concept of man-in-the-middle attacks in video 45. Visualize normal versus suspicious ARP behavior.
536:21
Speaker A
Let's compare normal and suspicious situations. In a normal network, the gateway's IP address should normally correspond to the gateway's expected MAC address. Now, imagine that the same gateway IP suddenly appears associated with a different MAC address. That change does not automatically prove an
536:43
Speaker A
attack. There can be legitimate reasons for MAC address changes. For example, a router may have been replaced. A network configuration may have changed. A virtual machine environment may have changed. A device may have restarted. So the security professional asks why did
537:04
Speaker A
this mapping change? That question is much more useful than immediately saying this is an attack. This is the same evidence-based approach we learned in video 40. Practical observation. Now let's observe ARP information on Linux.
537:23
Speaker A
This demonstration is read only run IP nay. You may see something similar to this. Let's understand what we are seeing. 10.214.4.157.
537:37
Speaker A
This is the IP address of a neighboring device. Dev Etho. This tells us which network interface is being used. Ll.
537:48
Speaker A
This represents the link layer address. Normally the MAC address for Ethernet. The value after it is the MAC address associated with that IP and reachable or stale represents the current neighbor cache state. This table gives us a useful observation point. If we are
538:09
Speaker A
investigating possible ARP manipulation, we can compare the observed mappings against what is expected in our own authorized network. We can also observe ARP traffic with Wireshark. Use the display filter ARP then look for ARP requests and replies. The important
538:30
Speaker A
thing is not simply seeing an ARP packet. The important question is does the ARP information make sense for this network? For a controlled lab, you can use two or more VMs and generate normal ARP traffic between them. Then inspect
538:48
Speaker A
the packets in Wireshark. This lets you learn what normal ARP behavior looks like before studying suspicious behavior. Cyber security connection ARP spoofing matters because local network communication often depends on correct IP to MAC relationships. If those relationships are manipulated, traffic may be
539:12
Speaker A
redirected or communication may be disrupted. A security professional investigating possible ARP spoofing may examine ARP tables, ARP requests and replies, IP to MAC mappings, network interfaces, switch information, DHCP records, packet captures, firewall or monitoring alerts, changes over time.
539:38
Speaker A
And again, one unusual ARP entry is not automatically proof of an attack. The investigator needs context. For example, did the MAC address change? Is the new MAC associated with an authorized device? Are multiple systems receiving conflicting ARP information? Are there
539:59
Speaker A
unusual ARP replies? Does packet traffic support the suspicion? This is where networking knowledge becomes cyber security knowledge. You are not just looking at an ARP packet. You are asking what happened, why did it happen, and what evidence supports that conclusion.
540:21
Speaker A
Defensive measures can include appropriate network segmentation, switch security features, monitoring, secure network configuration, and encryption such as HTTPS so that intercepted traffic is not automatically readable. Recap. Let's review the key ideas. ARP helps devices discover the MAC address associated with
540:46
Speaker A
an IP address on the local network. ARP spoofing attempts to provide false IP to MAC information.
540:55
Speaker A
This can potentially redirect local traffic through an attacker's system. ARP spoofing can be used as part of a man-in-the-middle attack, but the two terms are not identical. Linux tools such as IP nay and wire sharkark can help us observe ARP behavior and most
541:15
Speaker A
importantly unusual RP behavior is evidence to investigate not automatic proof of an attack. Now we understand how an attacker can manipulate local IEP to MAC information. But ARP is not the only network mechanism that can be manipulated. What happens if an attacker
541:36
Speaker A
tries to manipulate DNS instead? Instead of changing where local traffic is sent, they may try to influence where a domain name points. That takes us to the next lesson, video 43, DNS, spoofing concept and controlled lab.
542:01
Speaker A
You type a familiar website name into your browser, for example, example.com. Your computer needs to discover the IP address behind that name before it can connect. But what if the DNS answer is manipulated? What if your computer is
542:19
Speaker A
told? Example.com is at this IP address, but that answer is false. Your browser may connect somewhere you did not expect. This is the basic idea behind DNS spoofing and today we are going to understand how it works, how to observe
542:39
Speaker A
DNS behavior and how security professionals investigate suspicious DNS responses. In video 42, we studied ARP spoofing and saw how attackers can manipulate local IP to MAC information. Now we are moving one step higher in the communication process. Instead of manipulating IP
543:02
Speaker A
address to MAC address, we are going to examine the relationship between domain name and IP address. That is the role of DNS.
543:13
Speaker A
You already learned how DNS works in video 13 and how DNS traffic appears in Wireshark in video 31. So we will not repeat those lessons from the beginning.
543:26
Speaker A
Instead we will use that knowledge to understand how DNS can be abused. The goal is understand, observe, analyze, detect and defend and all practical work should remain inside your own systems, virtual machines or an isolated authorized lab. What you will learn in
543:46
Speaker A
this video? You will learn what DNS normally does, what DNS spoofing means, how a false DNS response can affect a connection, the difference between legitimate and suspicious DNS responses, how to observe DNS queries and responses, how to investigate DNS
544:07
Speaker A
information with Linux and Wireshark, why DNS spoofing matters to cyber security. The simple idea. Let's begin with something you already know. Humans prefer names. Computers communicate using IP addresses. When you type example.com, your computer needs to discover the corresponding IP address.
544:30
Speaker A
DNS or domain name system helps perform that translation. You can think of DNS as an internet directory. You provide a domain name. DNS provides information about where that domain can be reached.
544:46
Speaker A
For example, a DNS response might contain an IPv4 address in an A record or it might contain an IPv6 address in an AA aa record. Once the system has the required address, the application can continue the connection. That is normal
545:05
Speaker A
DNS behavior. What is DNS spoofing? Now imagine that the DNS answer is manipulated. The user asks what IP address belongs to example.com.
545:19
Speaker A
But instead of receiving the legitimate answer, the system receives a false answer. For example, example.com resolves to 203.013.0.50.
545:34
Speaker A
The user may believe that this is the correct destination, but the response could have been manipulated. That is the basic concept of DNS spoofing. The attacker is not necessarily changing the domain name. Instead, they are attempting to influence the answer
545:52
Speaker A
associated with that domain. This can potentially redirect users toward an unintended destination. How DNS spoofing can happen. There are different ways DNS information can be manipulated. The exact mechanism depends on the environment. For example, an attacker may attempt to interfere with
546:16
Speaker A
DNS traffic on a local network. They may attempt to compromise or manipulate a DNS resolver. They may abuse a compromised device or network service.
546:28
Speaker A
or they may exploit weaknesses in how DNS information is trusted or cached. The important concept is the victim receives DNS information that is not the information they should have received.
546:43
Speaker A
normal client, then DNS resolver, then correct answer, and finally destination, manipulated client, then DNS resolver or network path, then false answer, and finally an unexpected destination.
547:01
Speaker A
Notice that DNS spoofing is different from ARP spoofing. ARP spoofing manipulates local IEP to MAC information. DNS spoofing manipulates or attempts to manipulate name to IP information. Different layer, different mechanism, potentially different evidence. Visualize normal versus suspicious DNS. Let's say a user
547:26
Speaker A
requests www.agample.com. A DNS query is sent. The response may contain query www.agample.com. Type a answer an IPv4 address. Now imagine that the answer suddenly changes. Yesterday www.agample.com resolve to IP address A. Today www.agample.com resolve to IP address B. Does that
547:54
Speaker A
automatically mean DNS spoofing? No. A domain can legitimately have multiple IP addresses. Websites can change their infrastructure.
548:05
Speaker A
CDNs can return different addresses depending on the user's location and DNS records can change during normal administration. So once again, an unusual result is an indicator for investigation, not automatic proof of an attack. A security professional may compare DNS responses, expected DNS
548:29
Speaker A
records, resolver information, DNS logs, packet captures, the time of the event, the source of the response, and other systems receiving the same response. The goal is to determine whether the response is legitimate or suspicious.
548:46
Speaker A
Practical observation. Let's observe normal DNS behavior first. run digg google.com. The exact output will vary depending on your DNS configuration and the current DNS response. You may see sections such as question section and answer section.
549:06
Speaker A
The question section shows what was requested. Here google.com is the domain name. A means the query is asking for an IPv4 address. The answer section contains the DNS answer. Now let's observe the traffic itself. Open Wireshark and capture traffic on the
549:28
Speaker A
appropriate interface. Then generate a DNS lookup. diggoogle.com. In Wireshark, you can use DNS as the display filter. You should be able to identify the DNS query and the corresponding response. Look for information such as query name, query type response answer source
549:52
Speaker A
destination. This is the same packet analysis mindset we developed in video 31. We are not simply looking at a command result. We are observing the communication that produced that result. For a controlled lab, you can also create your own
550:10
Speaker A
isolated DNS environment using two VMs and a test domain or local host name. The goal is to observe how a legitimate DNS response works before experimenting with any controlled manipulation.
550:25
Speaker A
Cyber security connection. DNS is extremely important in cyber security because applications depend on name resolution. If DNS information is manipulated, users may be redirected to an unintended destination. Security professionals may therefore monitor DNS queries, DNS responses, requested domains, returned IP addresses, DNS
550:53
Speaker A
resolver behavior, unusual domain patterns, unexpected DNS configuration changes, DNS traffic in packet captures, endpoint and network logs. For example, if many systems suddenly receive an unexpected IP address for an important internal service that deserves investigation. But again, unexpected
551:16
Speaker A
does not automatically mean malicious. The investigator should verify the expected DNS configuration and compare multiple sources of evidence. There is another important security control here.
551:29
Speaker A
Encrypted DNS can protect the confidentiality of DNS traffic in transit depending on the technology and deployment. Examples include DNS over HTTPS or DO and DNS over TLS or DOT. However, encrypted DNS does not automatically make DNS infrastructure trustworthy. The
551:52
Speaker A
resolver itself still matters. This is why security is about the entire communication chain, not one feature.
552:00
Speaker A
Recap. Let's review the key ideas. DNS translates or resolves domain names into information such as IP addresses. DNS spoofing involves attempting to provide false or manipulated DNS information.
552:17
Speaker A
ARP spoofing targets the relationship between IP addresses and MAC addresses. DNS spoofing targets the relationship between names and network destinations.
552:28
Speaker A
Commands such as digample.com and wire sharkark can help us observe normal DNS behavior. And most importantly, a strange DNS result is a reason to investigate, not automatic proof of an attack. So far, we have looked at two important network
552:48
Speaker A
manipulation techniques. ARP spoofing can manipulate local address resolution. DNS spoofing can manipulate name resolution. But there is another critical mechanism that devices depend on when they first join a network. DHCP.
553:08
Speaker A
What happens if an attacker interferes with the process that gives devices their IP address, gateway, and other network configuration?
553:17
Speaker A
That is what we will explore in the next lesson. Video 44. DHCP attacks concept and security.
553:31
Speaker A
Imagine you connect your laptop to a network. You expect the network to automatically give you an IP address, a subnet mask, a default gateway, and a DNS server. But what if an attacker interferes with that process? What if
553:49
Speaker A
legitimate devices can no longer receive IP addresses? Or what if your computer receives network information from the wrong DHCP server? The network may still look normal, but the information your device receives could be completely different.
554:08
Speaker A
Today we are going to understand how DHCP can be abused. How these attacks affect a network and how security professionals detect them. Welcome back to networking for cyber security beginner to pro. In video 14, we learned how DHCP
554:28
Speaker A
automatically provides network configuration to devices. We also learned the basic DHCP process. discover offer request and acknowledge. In video 41, we introduced common network attacks. Then in video 42, we looked at ARP spoofing. And in video 43, we examined DNS spoofing. Now
554:53
Speaker A
we are moving to another important part of network communication, DHCP. The goal is not to attack a real network. Our goal is to understand the mechanism, observe normal DHCP behavior, recognize suspicious behavior, and understand how defenders protect networks. What you will learn in this
555:17
Speaker A
video? You will learn how DHCP normally provides network configuration, what DHCPbased attacks are, what DHCP starvation means, what a rogue DHCP server is, how these attacks can affect clients, how to observe DHCP traffic safely, and why DHCP security matters to
555:40
Speaker A
cyber security professionals. Remember how DHCP works? Let's briefly connect this to video 14. When a device joins a network, it may not yet have an IP address. DHCP can provide the configuration automatically. The basic process is DHCP discover. The client
556:01
Speaker A
asks, is there a DHCP server available? Then DHCP offer. A DHCP server offers network configuration. Then DHCP request. The client requests the offered configuration. Finally, DHCP acknowledge. The DHCP server confirms the configuration. The DHCP server can provide information such as IP address,
556:27
Speaker A
subnet mask, default gateway, DNS server. This is why DHCP is so important. If DHCP becomes unavailable or provides incorrect information, the devices network configuration can be affected. What are DHCP attacks? A DHCP attack is an attempt to abuse or
556:48
Speaker A
interfere with the DHCP process. There are different ways this can happen. For this lesson, focus on two important concepts. DHCP starvation and rogue DHCP server. They are different attacks but both target the DHCP configuration process. Let's start with
557:11
Speaker A
DHCP starvation. DHCP starvation. The basic idea is simple. A DHCP server has a limited pool of addresses that it can assign. For example, imagine a network has 192.168.100 to 192.168.1.200 available for clients. If an attacker causes the DHCP server to receive a
557:43
Speaker A
large number of apparently different client requests, the server may attempt to allocate addresses from its available pool. Eventually, the pool can become exhausted. Legitimate devices may then have difficulty obtaining an IP address.
558:01
Speaker A
This is called DHCP starvation or DHCP exhaustion. The important idea is the attacker is trying to consume the DHCP address pool. Rogue DHCP server. Now, let's look at a different problem.
558:17
Speaker A
Imagine a normal network has one legitimate DHCP server. Clients expect to receive configuration from that server, but another unauthorized device starts behaving like a DHCP server. This is called a rogue DHCP server. The client may receive a DHCP
558:38
Speaker A
offer from the wrong server. That unauthorized server could potentially provide incorrect network configuration. For example, it might provide an unexpected IP address, an incorrect default gateway, an unexpected DNS server, or other incorrect DHCP options.
558:59
Speaker A
This can change how the victim's device communicates with the network. For example, client, then rogue configuration, then network instead of client, then legitimate configuration, then network. This is different from DHCP starvation. DHCP starvation focuses on exhausting available addresses. A
559:22
Speaker A
rogue DHCP server focuses on providing unauthorized network configuration. DHCP starvation. The goal is to exhaust the available address pool. As a result, legitimate clients may fail to obtain an IP address. Rogue DHCP server. The goal is to provide unauthorized DHCP
559:45
Speaker A
responses. As a result, clients may receive incorrect network configuration. How can we recognize suspicious DHCP behavior? Now, let's connect this to cyber security. A security professional does not simply see unusual DHCP traffic and immediately say, "This is an
560:06
Speaker A
attack." Remember what we learned in previous videos. Unusual behavior is an indicator, not automatic proof. There may be legitimate reasons for unexpected DHCP activity. For example, a network administrator may intentionally add another DHCP server during a configuration change. So, we need
560:29
Speaker A
evidence. What could we investigate? We could look at DHCP discover messages, DHCP offer messages, DHCP request messages, DHCP acknowledge messages, the source MAC address, the DHCP server identifier, the offered IP address, the default gateway, the DNS server, the
560:52
Speaker A
number and frequency of DHCP requests. For example, imagine that most clients normally receive DHCP offers from one known server. Suddenly, clients begin receiving offers from another unexpected device. That would be something worth investigating.
561:11
Speaker A
Similarly, a sudden large increase in DHCP requests could indicate abnormal behavior. But again, one unusual packet does not automatically prove an attack.
561:25
Speaker A
We need to compare it with the expected network behavior. Practical observation. We can safely observe DHCP behavior on our own Linux system or an authorized lab. First, we can examine our current network configuration. IP address. This shows the IP addresses assigned to our
561:47
Speaker A
interfaces. Then IP route. This shows the routing information including the default route depending on the Linux distribution and network manager. We can also inspect DHCP related configuration with NM CID show look for information related to IP addresses gateway DNS servers and other
562:13
Speaker A
network configuration for packet level observation. Wireshark is even more useful. Start a capture on your authorized lab interface and use the display filter DHCP.
562:26
Speaker A
On some Wireshark versions and environments, DHCP traffic may also appear under the protocol name bootyp.
562:35
Speaker A
Now look for the DHCP conversation. Discover offer request ACK. Pay attention to the source and destination information and the DHCP server information contained in the packets. The purpose of this demonstration is not to perform a DHCP attack. It is to understand what normal
562:58
Speaker A
DHCP communication looks like so that abnormal behavior becomes easier to recognize. Cyber security connection DHCP may look like simple network configuration but from a security perspective it is part of the network's trust and communication process. DHCP starvation can affect availability by preventing
563:22
Speaker A
legitimate devices from receiving network addresses. A rogue DHCP server can affect network configuration and traffic flow by providing unauthorized settings. For example, if a client receives an unexpected gateway or DNS server, its communication path may change. This is why defenders may
563:44
Speaker A
monitor DHCP logs, DHCP server activity, MAC addresses, DHCP requests and offers, network configuration, packet captures, and changes in expected network behavior in an enterprise environment. DHCP security can also work together with network segmentation, switch security controls, monitoring systems, and other access
564:12
Speaker A
control mechanisms. The bigger lesson is this. Network security is not only about blocking attacks. It is also about understanding what normal network behavior looks like. Once you understand normal behavior, you can investigate what changes.
564:31
Speaker A
Recap. Let's review what we learned. First, DHCP automatically provides network configuration to clients. Second, DHCP starvation attempts to exhaust the available DHCP address pool.
564:47
Speaker A
Third, a rogue DHCP server is an unauthorized DHCP server that can provide unexpected network configuration.
564:56
Speaker A
Fourth, security professionals investigate DHCP traffic, configuration, and logs to identify suspicious behavior. And finally, unusual DHCP behavior is an indicator that requires investigation, not automatic proof of an attack.
565:16
Speaker A
So far we have looked at several ways network communication can be manipulated. AP spoofing can interfere with the relationship between IP address and MAC address. DNS spoofing can interfere with the relationship between domain name and IP address. DHCP attacks can interfere
565:39
Speaker A
with network configuration. But what happens when an attacker tries to position themselves directly between two communicating systems? That brings us to one of the most important concepts in network security. Man in the middle attacks. In the next video, we will
565:59
Speaker A
understand what a MITM attack is, how the communication path can be manipulated, and how security professionals can recognize and investigate it.
566:16
Speaker A
Imagine you are communicating directly with a server. You send a request. The server sends a response. Everything looks normal. But what if another system secretly positions itself between you and the destination?
566:32
Speaker A
Your traffic goes through that system first. It may be able to observe, redirect, modify, or interfere with communication.
566:42
Speaker A
You may still believe you are communicating directly with the real destination. This is the basic idea behind a maninthe-middle attack. Welcome back to networking for cyber security beginner to pro. In the previous videos, we examined several ways network
567:01
Speaker A
communication can be manipulated. In video 42, we learned about ARP spoofing. In video 43, we examined DNS spoofing.
567:13
Speaker A
In video 44, we looked at DHCP attacks. These techniques can affect how a device communicates across a network. Now we are going one level higher. Instead of focusing on one specific protocol, we are going to understand the broader
567:31
Speaker A
attack scenario man in the middle or MITM. The goal of this lesson is not to teach unauthorized interception. We are going to understand the communication model.
567:45
Speaker A
See how a middle position can be created. observe the evidence safely and learn how defenders investigate and reduce the risk. What you will learn. By the end of this video, you will understand what a man-in-the-middle attack is. What normal direct
568:04
Speaker A
communication looks like, how an attacker can become positioned between two systems, how ARP, DNS or other techniques can contribute to MITM scenarios. What an attacker may be able to observe or modify. How encryption changes the situation. How security
568:25
Speaker A
professionals detect and investigate possible MITM activity. The simple idea. Let's start with the simplest possible example. Normally communication looks like this. Client server. Your computer sends traffic toward the destination.
568:43
Speaker A
The destination sends traffic back. There is a network path between them but the communication is intended to reach the correct destination. Now imagine this client then attacker then server.
569:01
Speaker A
The attacker has positioned their system somewhere in the communication path. Instead of traffic moving directly through the expected path, the attacker becomes an intermediate point. That is the basic idea behind a man-in-the-middle attack. The important word here is middle. The attacker is
569:22
Speaker A
attempting to place themselves between the communicating parties. How does a MITM position happen? Now let's connect this to what we already learned. There is no single method called MITM.
569:37
Speaker A
MITM describes the position and attack scenario. Different techniques can help create that position. For example, in video 42, we studied ARP spoofing. ARP is used on local networks to associate an IP address with a MAC address. If an
569:58
Speaker A
attacker manipulates those mappings, traffic intended for another system may be redirected through the attacker. Then in video 43, we studied DNS spoofing.
570:11
Speaker A
DNS determines information such as which IP address a domain name resolves to. If DNS information is manipulated, a user may be directed toward an unintended destination. And in video 44, we studied DHCP attacks. A rogue DHCP server can
570:33
Speaker A
potentially provide unauthorized network configuration, including an unexpected gateway or DNS server. So, notice the bigger picture. ARP spoofing, DNS manipulation, and DHCP attacks are not automatically the same thing as MITM, but techniques like these can contribute to scenarios where communication is
570:56
Speaker A
redirected or intercepted. MITM describes the broader situation. What can happen to the traffic? Once an attacker successfully becomes part of the communication path, several things are possible. They may attempt to observe, look at traffic that passes through their position, redirect, send
571:19
Speaker A
communication somewhere else, modify, change information before forwarding it, disrupt, interfere with communication so that it fails. But there is an extremely important limitation. Being in the middle does not automatically mean the attacker can read everything. This is where encryption becomes critical. For
571:42
Speaker A
example, with properly implemented H, T, T, P, S, and T, LS, the application data is encrypted between the endpoints. An attacker may still be able to observe certain metadata depending on the environment, but the encrypted application content is not simply
572:02
Speaker A
available as readable HTTP text. This is one reason we studied HT TPS and TLS earlier in the course. Visualize normal versus MITM communication. Let's compare the two situations. Normal communication client then network then server. The client communicates with the
572:26
Speaker A
intended destination through the expected network path. Now compare that with possible M I TM scenario. client then intermediate system then server.
572:40
Speaker A
The intermediate system becomes part of the communication path. Now let's connect this with the protocols we already studied. For example, ARP spoofing can manipulate local IP tomac information. DNS spoofing can manipulate domain to IP resolution. DHCP attacks can influence network configuration.
573:04
Speaker A
These are different mechanisms but the security objective may become related. Influence where traffic goes or how communication happens. This is why understanding networking is so important for cyber security. The attack is not just a mysterious hacking trick. It
573:24
Speaker A
depends on how communication actually works. Practical observation. We can safely observe the evidence of normal communication using our own Linux system or an authorized lab. First check the local neighbor table IP nay. This shows IP to MAC neighbor information
573:45
Speaker A
known by the system. The exact interface name and output will depend on your system. The important information is the relationship between IP address, MAC address, interface and state. This connects directly to the ARP concepts we studied earlier. We can also inspect the
574:06
Speaker A
root IP route. Look for the default route. For example, default via 10.28 198.168 devo.
574:21
Speaker A
This tells us which gateway the system normally uses for destinations outside the local network. Now we can observe actual traffic with Wireshark. Start a capture on your authorized interface and generate simple traffic such as ping- c48.8.8.8.
574:41
Speaker A
The - C4 option tells ping to send four requests. In Wireshark, we can use CMP.
574:48
Speaker A
to focus on ICMP traffic. We can also inspect ARP traffic with ARP. The goal here is not to perform a MITM attack.
574:58
Speaker A
The goal is to understand what normal network evidence looks like, who is communicating, which addresses are involved, what path information does the system know, what traffic is actually visible. Once you understand normal traffic, suspicious changes become easier to investigate. Cyber security
575:21
Speaker A
connection MITM attacks matter because communication is built on trust. A device expects certain network information to be correct. It expects the gateway to be the correct gateway. It expects DNS information to be trustworthy. It expects encrypted connections to protect sensitive
575:42
Speaker A
application data. If an attacker can manipulate the communication path, that trust can become a security problem.
575:51
Speaker A
Security professionals therefore look for indicators such as unexpected ARP mappings, unexpected gateway information, unexpected DNS behavior, unexpected network paths, certificate or TLS warnings, traffic appearing from unexpected systems, unexpected changes in network configuration, and unusual packet flows. But remember, one unusual
576:18
Speaker A
observation does not automatically prove a MITM attack. A MAC address can change legitimately. A DNS response can change legitimately. A network route can change legitimately. A certificate warning can have multiple causes. So the professional approach is observe, analyze, correlate, verify, and respond.
576:45
Speaker A
This is the same investigation mindset we have been building throughout level 4 and encryption remains one of the most important defenses. If application data is properly protected with modern TLS, simply positioning yourself in the network path does not automatically give
577:04
Speaker A
you readable application content. That is a major reason why cyber security professionals care about HTTPS certificate validation, secure network configuration, network monitoring, and endpoint security. Recap. Let's review the key ideas. First, a man-in-the-middle attack attempts to place an attacker between communicating
577:29
Speaker A
systems. Second, MITM describes a broader attack scenario, not one specific technique. Third, techniques such as ARP spoofing, DNS manipulation, or DHCP attacks can contribute to traffic redirection or interception scenarios. Fourth, being in the middle does not automatically mean an attacker
577:54
Speaker A
can read encrypted application data. And finally, security professionals investigate network configuration, traffic roots, ARP information, DNS behavior, and encryption indicators to identify possible MITM activity.
578:18
Speaker A
Imagine a website is working normally. Users can connect. Pages load. requests are being processed. Then suddenly the server starts receiving an enormous number of requests. Legitimate users begin experiencing delays. Some connections fail. Eventually, the service may become unavailable.
578:41
Speaker A
What happened? The attacker may not have stolen a password. They may not have modified a database. They may simply be trying to make the service unavailable.
578:52
Speaker A
This is where denial of service attacks become important. Welcome back to networking for cyber security beginner to pro. In video 41, we introduced availability attacks as one category of network attacks. We have since studied ARP spoofing, DNS spoofing, DHCP attacks, and
579:15
Speaker A
maninthe-middle attacks. Those attacks can affect how communication happens. Now we are looking at a different objective. Making a service or network resource difficult or impossible for legitimate users to access. This lesson focuses on the networking perspective of DOS denial of service and DDOS
579:40
Speaker A
distributed denial of service. We are not going to perform traffic flooding. Instead we will understand what happens to network resources. How do DOS and DD do differ? What defenders observe and how this activity can be investigated safely. What you will learn in this
580:01
Speaker A
video. You will learn what a DOS attack is, what a DDoS attack is, the difference between DOS and DDOS, how excessive traffic can affect network resources, the difference between bandwidth, connection and application level pressure, what suspicious traffic may look like, how to observe network
580:25
Speaker A
activity safely, and why do matter to cyber security professionals. The simple idea. Let's start with a simple example.
580:38
Speaker A
Imagine a small restaurant with only one entrance. If a normal number of customers arrive, the restaurant can serve them. But imagine thousands of people suddenly crowd the entrance.
580:51
Speaker A
Legitimate customers may no longer be able to enter. The restaurant has not necessarily been broken. The problem is that its available capacity is being overwhelmed.
581:03
Speaker A
A DOS attack works with a similar basic idea. Denial of service means an attempt to make a service or resource unavailable or significantly less available to legitimate users. The important concept is availability. In cyber security, we often think about the
581:22
Speaker A
CIA triad. confidentiality, integrity, availability, DOS and DDOS attacks primarily target availability. What is the difference between DOSS and DDOS?
581:38
Speaker A
Now, let's introduce the technical terminology. DOS, denial of service. A DOS attack attempts to overwhelm or disrupt a service using traffic or requests from a single source or a relatively limited number of sources.
581:54
Speaker A
The important idea is one attacking source or a concentrated source of traffic. Now, DDoS distributed denial of service. ADDOS attack uses multiple distributed systems or sources to generate traffic toward the target. The word distributed is the key. Because the traffic comes from
582:19
Speaker A
multiple locations or systems, the target may have to deal with a much larger and more distributed load. This can also make filtering and attribution more difficult. But remember, large traffic does not automatically mean DDoS.
582:37
Speaker A
A legitimate event, software update, viral content, or sudden increase in users can also produce unusually high traffic. Security professionals must investigate the evidence. What actually gets overwhelmed?
582:53
Speaker A
A common mistake is to think too much traffic means the internet connection becomes full. That can happen. But bandwidth is only one possible bottleneck. A service may have limits in several areas. For example, network bandwidth, the amount of traffic the connection can
583:15
Speaker A
carry. Connection capacity, the number of simultaneous connections or connection states a system can handle.
583:24
Speaker A
CPU. The server may spend too much processing time handling requests. Memory. Large numbers of connections or requests can consume available memory.
583:36
Speaker A
Application resources. The application may have limited workers, threads, database connections, or other resources. Show several possible pressure points. Bandwidth, connections, CPU, memory, application. This is why DOS and DDOS are not simply about sending a lot of packets. The exact
583:59
Speaker A
effect depends on what resource is being exhausted. How can we recognize abnormal traffic? Now let's connect this to network analysis. Suppose a website normally receives a relatively stable amount of traffic. Suddenly monitoring shows a major increase in incoming connections.
584:22
Speaker A
a large increase in requests, many source addresses, unusual traffic patterns, repeated requests to the same service, or a sudden increase in bandwidth usage.
584:36
Speaker A
These observations may indicate a denial of service event, but they are not automatically proof. For example, a company could launch a major product.
584:47
Speaker A
Thousands of legitimate users could visit the website at the same time. the traffic could increase dramatically without an attack. So investigators ask questions such as where is the traffic coming from? Which destination ports are involved? Which protocols are being
585:06
Speaker A
used? How quickly is the traffic increasing? Are the requests valid? Are many different sources involved? Which service is experiencing the problem? Is the network saturated? Is the server itself overloaded? And what do the logs show? This is the same evidence-based
585:25
Speaker A
thinking we have been using throughout level 4. Practical observation. We can safely observe current network connections on our own Linux system. Run SS- TU N. The SS command displays socket information. The - T option shows TCP sockets. The - U option shows UDP
585:49
Speaker A
sockets. The dash n option keeps addresses and ports in numeric form instead of trying to resolve names. You may see outputs similar to this. The exact output will depend on what your system is doing. The important information is local address port and
586:08
Speaker A
peer address port. This lets us see active network connections and the ports involved. We can also observe traffic volume with tools such as IP- S link.
586:22
Speaker A
The - S option shows interface statistics. Look for counters such as RX received traffic, TX transmitted traffic. These counters can help us understand whether an interface is receiving or transmitting increasing amounts of traffic. For packet level analysis, Wireshark can provide more
586:44
Speaker A
detail. We can capture traffic on an authorized interface and examine source, destination protocol ports packet rate, packet sizes, and timing. The goal is not to generate attack traffic. The goal is to learn what normal network activity looks like and how traffic
587:04
Speaker A
volume and connection behavior can be investigated. Cyber security connection. DOS and DDoS attacks are important because availability is a fundamental part of security. A system can have strong authentication, encrypted communication, secure passwords, and protected data. But if legitimate users cannot access the
587:28
Speaker A
service, the organization still has a security problem. Defenders may use multiple layers of protection. For example, rate limiting limits, how quickly requests can be accepted from a source or client. Firewalls and filtering can block or restrict unwanted traffic according to security rules.
587:50
Speaker A
Load balancing can distribute legitimate traffic across multiple servers. Traffic monitoring helps identify unusual increases and patterns.
588:01
Speaker A
DDoS protection services can help absorb, filter or distribute malicious traffic before it reaches the protected service. Network capacity and resilient architecture can reduce the impact of sudden traffic increases. But no single control solves every situation.
588:23
Speaker A
Security teams need visibility. They monitor traffic patterns, network utilization, connection behavior, application logs, and service health.
588:35
Speaker A
The investigation process can look like this. Observe, measure, analyze, correlate, mitigate, and verify. First, observe the behavior. Then, measure what is changing. Analyze the traffic.
588:51
Speaker A
Correlate network evidence with server and application logs. Apply appropriate mitigation. Finally, verify that legitimate users can access the service again. And remember, high traffic is not automatically an attack. Context matters. Recap. Let's review the key ideas. First, DOS means denial of
589:14
Speaker A
service, an attempt to disrupt availability for legitimate users. Second, DDoS is distributed, meaning multiple systems or sources can participate in generating the traffic.
589:28
Speaker A
Third, the resource being overwhelmed is not always bandwidth. It can also involve connections, CPU, memory, or application resources. Fourth, traffic spikes and unusual connection patterns are indicators that require investigation, not automatic proof of an attack. And finally, security
589:51
Speaker A
professionals use monitoring, traffic analysis logs filtering rate limiting, and resilient architecture to detect and reduce the impact of DOS and DDOS events.
590:05
Speaker A
So far we have studied several major network security concepts. We have looked at how attackers can manipulate communication. We have seen how traffic can be intercepted. And now we have seen how availability can be disrupted. But before an attacker can exploit many
590:23
Speaker A
network services, they often need to answer a basic question. What services are actually available? Which ports are open? Which services are listening and what can a system reveal about its network-f facing surface? That brings us to the next lesson. In video 47, we will
590:46
Speaker A
study port scanning and service discovery. Imagine you are responsible for securing a network. You know the network contains servers, workstations, applications and other devices. But there is one important question. How do you know which network services are actually
591:10
Speaker A
exposed? A device may have many possible ports. Some may be open, some may be closed, some may be filtered by a firewall, and behind an open port, there may be a running service. This is where port scanning and service discovery become
591:27
Speaker A
important in cyber security. Understanding what is exposed is an important part of understanding the attack surface.
591:38
Speaker A
Welcome back to networking for cyber security beginner to pro. In video 33, we introduced the concept of network scanning. We learned that scanning can help determine whether hosts and ports respond. And we introduced the ideas of open, closed, and filtered ports. Now,
591:58
Speaker A
in video 47, we are going one layer deeper. We are going to connect three things, ports, services, and attack surface. We will understand what port scanning actually tells us, what service discovery ads, how firewalls affect scan results, and how security professionals
592:21
Speaker A
use this information in authorized environments. This is not about blindly scanning random systems. The goal is to understand the networking behavior behind scanning and how defenders can use that knowledge. What you will learn by the end of this lesson, you will
592:41
Speaker A
understand what port scanning means. How open, closed, and filtered ports relate to services, what service discovery means, why an open port does not automatically identify a service. How TCP and UDP discovery differ. How firewalls can affect what a scanner
593:02
Speaker A
sees. How to observe listening services safely on your own Linux system. Why port scanning matters to cyber security.
593:11
Speaker A
From ports to services. Let's start with something you already learned in level one. A port is a logical communication endpoint associated with network communication.
593:24
Speaker A
Think of an IP address as the address of a building. The port is like a numbered entrance. Different services can use different ports. For example, HTTP commonly uses port 80. HTTPS commonly uses port 443.
593:43
Speaker A
SSH commonly uses port 22. DNS commonly uses port 53. But there is an important detail. A port number does not automatically prove what service is running there. A web server can be configured to use a different port. For
594:01
Speaker A
example, a web application might listen on 8080 instead of the conventional port 80. So when we discover an open port, we have learned something useful. Something is accepting or may be accepting network communication on that port. But we may
594:22
Speaker A
still need additional information to determine exactly what that service is. This is why cyber security professionals separate two ideas. Port discovery asks which ports appear reachable.
594:38
Speaker A
Service discovery asks what service or application appears to be associated with those ports. That distinction is important. Understanding port states. In video 33, we introduced three important port states. open, closed, filtered.
594:58
Speaker A
Let's briefly connect them to today's lesson. An open port generally means something is accepting the type of connection being tested. A closed port means the host is reachable, but there is no service accepting connections on that port. A filtered result means
595:16
Speaker A
something such as a firewall or filtering device is preventing the scanner from clearly determining whether the port is open. For example, imagine a server with 1 192.168.15 and port 22 appears open. That gives us a useful clue. There may be an SSH
595:39
Speaker A
service listening on that port. But we should not immediately conclude port 22 is definitely SSH. Why? Because port numbers are conventions. They are not guarantees. This is one reason service discovery exists.
595:56
Speaker A
What is service discovery? Service discovery is the process of identifying what network service or application is associated with an accessible port.
596:07
Speaker A
Suppose we discover 1 192.168.1.580. The port appears open. What is running there? It could be a web server, a development application, a management interface, a custom application, or something else entirely.
596:30
Speaker A
The port number alone does not tell us enough. Service discovery may use additional information from the service itself. For example, a service may respond with information that identifies its protocol or application.
596:46
Speaker A
Sometimes this information is called a banner. A banner is information returned by a service that may reveal details about the application or software. But banners have limitations. A service may hide its version. A banner may be customized. The application may provide
597:06
Speaker A
incomplete information and sometimes the information may be misleading. So professional analysis does not blindly trust one piece of evidence. Instead, we observe, correlate, and verify TCP, UDP, and firewall behavior. Port discovery can involve different network protocols.
597:28
Speaker A
For TCP, we already studied the three-way handshake in video 30, S Y N S Y N A C K.
597:39
Speaker A
That gives us a useful foundation for understanding TCP-based discovery. If a TCP service is reachable and accepting connections, the network behavior can provide evidence that the port is open.
597:53
Speaker A
If the port is closed, the host may respond differently. And if a firewall filters the traffic, the result may be different again. UDP is different. UDP does not use the TCP 3-way handshake. So determining the state of a UDP service
598:12
Speaker A
can require different observations and may sometimes be less straightforward. This is one reason we should not assume that TCP and UDP scanning behave exactly the same way. Now add a firewall. A firewall can allow some traffic while blocking or filtering other traffic. For
598:31
Speaker A
example, port 22 allowed, port 23 filtered, port 80 allowed. The scanner's view of the network depends partly on those security controls.
598:46
Speaker A
This is an important cyber security lesson. What a scanner sees is not always the complete picture of what exists. network configuration, firewalls routting filtering service behavior, and protocol differences all affect the result. Practical observation on Linux. Now, let's observe services
599:09
Speaker A
safely on our own Linux system. We are not scanning an external target. We are simply looking at what our own machine is listening on. Run ss-l.
599:22
Speaker A
Now let's break this command down. SS is a Linux utility for displaying socket information. The options are -L means listening. It shows sockets waiting for network connections. Dash N means numeric. Instead of trying to convert addresses and ports into names, it
599:41
Speaker A
displays them numerically. -ash T shows TCP sockets. -ash U shows UDP sockets and -p shows the process associated with the socket when that information is available. Depending on your permissions, you may need elevated privileges to see process information.
600:03
Speaker A
Now look at the local address colon port column. You may see something like 0.0.08000.
600:12
Speaker A
This tells us that a service is listening on TCP port 8000 on any interface E. The address 0.0.0 is important. It means the service is listening on the local machines any interface. That does not mean it is automatically reachable from other
600:33
Speaker A
devices on the network. You might also see col22. Depending on the system configuration, this can indicate that a TCP service is listening on port 22 across available IPv4 interfaces.
600:52
Speaker A
The exact output will vary from system to system. The important thing is not to memorize one output. Instead, learn how to interpret the relationship between address, port, protocol, and listening service. This gives us a local baseline.
601:12
Speaker A
We can now compare what is configured on our own machine with what we expect to be running. That is the same reasoning used in larger security investigations.
601:24
Speaker A
Cyber security connection. Now, let's connect everything together. Why does port scanning and service discovery matter to cyber security? Because every reachable service can become part of a systems attack surface.
601:40
Speaker A
Imagine a server that is supposed to provide only a web application. But during an authorized assessment, you discover that another network service is also reachable. That changes what needs to be reviewed. Security professionals can use service discovery to help answer
602:00
Speaker A
questions such as which services are exposed, which ports are reachable, are those services expected, are unnecessary services running, are management services exposed where they should not be, firewall rules working as intended, are there unexpected applications listening? This information can support
602:24
Speaker A
asset inventory, attack surface management, firewall validation, security monitoring, incident investigation, authorized penetration testing. But remember, an open port is not the same thing as a vulnerability.
602:41
Speaker A
An open port simply tells us that communication may be possible. We still need to understand the service, its configuration authentication exposure and security controls.
602:56
Speaker A
Likewise, a filtered port does not necessarily mean the service does not exist. The firewall may simply be preventing us from observing it directly. So the professional approach is discover, identify, verify, and assess, and always perform scanning and service discovery only against systems
603:18
Speaker A
you own or are explicitly authorized to assess. Recap. Let's quickly review what we learned. First, port scanning helps determine which ports appear reachable.
603:31
Speaker A
Second, ports can commonly appear as open, closed, or filtered depending on the observed network behavior. Third, service discovery goes beyond finding a port. It attempts to determine what service or application is associated with that port. Fourth, port numbers are
603:52
Speaker A
conventions. An open port does not automatically prove which service is running there. And finally, firewalls, routing, protocol differences, and service configuration can all affect what a scanner observes. Most importantly, port discovery tells us where communication may be possible.
604:15
Speaker A
Service discovery helps us understand what may be behind that communication, and that information helps security professionals understand the attack surface.
604:27
Speaker A
So far we have looked at network behavior from several different angles. We have studied packets. We have analyzed TCP connections. We have examined DNS and HTTP traffic. We have learned about scanning. And now we understand how exposed ports can reveal
604:48
Speaker A
services. But there is another question. What happens when we stop looking at individual ports and start looking at the packets themselves? for signs of suspicious activity. That is where we are going next. In video 48, packet analysis for security. We will take the
605:07
Speaker A
packet analysis skills we developed earlier and apply them directly to cyber security. We will learn how network traffic can provide evidence of suspicious behavior, unusual communication patterns, and possible security incidents. I'll see you in video 48.
605:30
Speaker A
A security incident can leave evidence moving through the network, a suspicious connection, an unexpected DNS request, a connection to an unusual server, a large amount of traffic, repeated connection attempts or communication between systems that normally should not communicate. The question is how can we
605:53
Speaker A
actually see what happened? Sometimes the answer is inside the packets. Welcome to video 48 packet analysis for security. Throughout level 3, we learned how to observe network communication. We used Wireshark. We learned how to read packet captures. We analyze TCP
606:16
Speaker A
handshakes, DNS traffic, and HTTP traffic. Then in level four, we connected networking to cyber security.
606:25
Speaker A
We studied common network attacks, ARP spoofing, DNS spoofing, DHCP attacks, man-in-the-middle attacks, DOS and DDoS, and service discovery. Now, we are going to bring those skills together. Packet analysis for security means examining network traffic to understand what systems are communicating, how they are
606:50
Speaker A
communicating, and whether the observed behavior matches what we expect. The goal is not to look at every packet individually. The goal is to recognize patterns, relationships, and evidence.
607:05
Speaker A
What you will learn in this lesson? You will learn what packet analysis means in cyber security, what security information can be found in network packets, how to recognize normal and suspicious communication patterns, how to use Wireshark to investigate traffic,
607:26
Speaker A
how to correlate IP addresses, MAC addresses, ports, protocols, and packet timing. Why one suspicious packet is not automatically proof of an attack. How packet analysis fits into a professional security investigation. The simple idea.
607:44
Speaker A
Let's begin with a simple idea. A network packet is part of communication between systems. Earlier in this course, we learned that packets can contain information such as source address, destination address, protocol, ports, packet length, timing, and depending on
608:06
Speaker A
the protocol and encryption, there may be additional information available. When we analyze packets for security, we are asking questions about that communication.
608:18
Speaker A
For example, who is communicating? Who are they communicating with? Which protocol are they using? Which port is involved? How frequently are packets being sent? Is the communication expected? Is the traffic encrypted? Are there unusual patterns? This is similar
608:38
Speaker A
to investigating activity at a physical location. You may not know everything about what is happening inside a building, but you can observe who enters, where they go, how often they arrive, and what patterns occur. With network traffic, packets provide part of
608:57
Speaker A
that evidence. What security information can packets reveal? Now, let's connect this to the networking concepts you already know.
609:06
Speaker A
Remember the layers we have studied. At the Ethernet level, we may see MAC addresses. At the IP level, we may see source and destination IP addresses. At the transport level, we may see TCP or UDP and port numbers. At the application
609:24
Speaker A
level, we may sometimes see protocol information such as DNS or HTTP. This gives us several useful relationships. For example, a workstation at 1 192.168.1.2 may communicate with 1 192.168.1.50 over TCP port 443. That tells us there is https
609:52
Speaker A
related TCP communication between those end points. But we should go further. We can ask when did the communication start? How many packets were exchanged?
610:06
Speaker A
Was the connection successful? How long did it last? Was the traffic repeated? Did the system communicate with many destinations? Did the communication use an expected protocol? This is where packet analysis becomes useful for security. We are not simply looking at
610:24
Speaker A
individual fields. We are connecting them together. Normal traffic versus suspicious traffic. One of the most important lessons in security monitoring is this. Unusual does not automatically mean malicious. Imagine a workstation suddenly communicates with a server it has never contacted before. That may
610:49
Speaker A
look suspicious, but there could be a completely legitimate explanation. Maybe the user opened a new application.
610:57
Speaker A
Maybe the operating system performed an update. Maybe a cloud service changed its infrastructure. Maybe a legitimate website loaded content from a new server. So packet analysis should not immediately jump from unusual to attack.
611:14
Speaker A
Instead, use a process such as observe, analyze, correlate, and verify. Let's say we observe repeated connections from one internal system to an unfamiliar external IP. We can examine the destination IP, the destination port, the protocol, the connection frequency,
611:36
Speaker A
the packet sizes, the DNS activity before the connection, the surrounding traffic and other available logs. One observation gives us a clue. Multiple related observations can give us stronger evidence. This is why professional security analysis is based on context and correlation.
611:57
Speaker A
Common security patterns in packet traffic. There are several patterns that can be useful during investigation.
612:06
Speaker A
Pattern one, repeated connection attempts. Imagine a system repeatedly attempts connections to many ports on another system. You might observe many TCP connection attempts in a short period.
612:21
Speaker A
This could be consistent with scanning behavior, but again, context matters. A vulnerability scanner, monitoring system, or legitimate administrative tool could also generate many connections. Pattern two, unexpected DNS activity.
612:40
Speaker A
Suppose a workstation suddenly generates a large number of DNS queries. You could investigate which domains were requested, how frequently, which DNS server was contacted, were the domains expected, did the DNS responses point to unusual destinations.
613:00
Speaker A
This does not automatically prove malicious activity, but it can provide useful evidence for further investigation.
613:09
Speaker A
Pattern three, unexpected internal communication. Imagine a workstation that normally communicates with user services suddenly begins communicating with a server in a management network that could be completely legitimate or it could indicate a configuration problem or suspicious activity. The packet capture
613:33
Speaker A
can help establish source, destination, protocol port timing frequency and communication sequence. Pattern four, unusual traffic volume. Earlier in video 46, we discussed DOS and DDOS.
613:51
Speaker A
Packet analysis can help us examine traffic volume. We can look at packet counts, packet sizes, source distribution, destination ports, protocols, timing, and whether the traffic is reaching the intended service. But remember, high traffic is not automatically an attack. A popular
614:13
Speaker A
event, software update, backup, or legitimate application workload can also create traffic spikes. Again, observe Analyze, correlate, and verify.
614:28
Speaker A
Practical observation with Wireshark. Now, let's use the skills we learned in videos 28 and 29. We will perform a safe packet analysis exercise on our own system or an authorized lab. Start Wireshark and capture traffic on the appropriate interface. Then generate
614:48
Speaker A
some normal traffic. For example, ping- c48.8 8.8.8 the ping command sends ICMP echo requests. The - C4 option tells Linux to send four requests. After the traffic is generated, stop the capture.
615:08
Speaker A
Now apply this Wireshark filter. You should now see the CMP packets. Select one packet and inspect the protocol layers. You may see frame, then Ethernet, then internet protocol, then internet control, message protocol. Now look at the source and destination. You
615:31
Speaker A
can ask which system sent the packet, where was it going, what protocol was used, what was the packet length, what type of MP message was it. This is basic packet analysis. Now let's make the investigation slightly more realistic.
615:47
Speaker A
Clear the filter and observe the surrounding traffic. You may see other protocols DNS, TCP, TLS, UDP, and potentially many other types of traffic depending on your system. Instead of examining everything manually, use filters to narrow the investigation. For example, DNS or TCP
616:10
Speaker A
or UDP. The goal is not to memorize filters. The goal is to learn how to move from all traffic to relevant traffic and finally to specific evidence. And this is one of the most important skills in packet analysis.
616:26
Speaker A
Cyber security investigation. Now let's imagine a real security investigation. A monitoring system reports that a workstation may be communicating with a suspicious external destination. A security professional could begin with the available evidence. First observe what traffic actually exists. Then
616:51
Speaker A
analyze which systems, protocols, ports, and destinations are involved. Then correlate. Can we connect the packet activity with DNS logs, firewall logs, endpoint events, authentication logs, or other evidence? Then verify. Does the evidence support the suspected behavior?
617:13
Speaker A
And finally, respond. If the activity is confirmed as malicious or unauthorized, appropriate security controls can be applied. This is where packet analysis becomes much more powerful. A packet capture rarely tells you the entire story by itself. Instead, it provides
617:32
Speaker A
evidence that can be combined with other sources. For example, suppose you see 10.0 0.0.25 to 203.013.50 port 443.
617:49
Speaker A
That tells you an internal system communicated with an external IP over T CP port 443.
617:57
Speaker A
But it does not automatically tell you who was using the system, why the connection happened, whether the destination was malicious, whether the user intentionally initiated it or whether the connection was generated by background software. You need context.
618:15
Speaker A
This is why professional investigation is about correlation, not simply finding something unusual. Cyber security connection packet analysis is useful across many areas of cyber security. It can support incident investigation understanding what happened during a security event. Threat detection
618:38
Speaker A
identifying traffic patterns that deserve investigation. Network monitoring. Understanding normal and abnormal communication. Troubleshooting. Determining whether network behavior matches expectations.
618:54
Speaker A
Malware investigation. Analyzing network communication generated by a suspicious system in an authorized lab. Security validation. Checking whether network controls are behaving as expected. And this connects directly to everything we have learned in level four. ARP spoofing can change local communication behavior.
619:17
Speaker A
DNS spoofing can affect name resolution. DHCP attacks can influence network configuration. MITM scenarios can alter communication paths. DOS and DDOS can change traffic volume. Port scanning can generate repeated connection attempts. Packet analysis gives us a way to observe the
619:41
Speaker A
network evidence behind these behaviors. This is the progression we wanted. We are no longer learning networking concepts separately. We are using networking knowledge to reason about security events. Recap. Let's summarize the most important ideas. First, packet analysis means examining network traffic
620:03
Speaker A
to understand communication and identify useful evidence. Second, packets can provide information about sources, destinations protocols ports timing packet sizes, and communication patterns. Third, suspicious behavior must be interpreted in context. Unusual does not automatically mean malicious.
620:29
Speaker A
Fourth, wire shark can help us move from all traffic to relevant traffic and finally to specific evidence. And finally, professional investigation follows a structured process. Observe, analyze, correlate, verify, and respond.
620:48
Speaker A
And with that, we have completed level four, cyber security and advanced networking. We started level four by learning how networks can be monitored and protected. Then we studied network segmentation, wireless networking, systematic diagnostics, common attacks, ARP spoofing, DNS spoofing, DHCP attacks,
621:13
Speaker A
MITM, DOS and DDOS. We then learned how exposed ports reveal services and how packet analysis can provide security evidence. But there is one final level. The level where we stop studying these concepts individually and start combining them into realistic
621:32
Speaker A
professional workflows. In video 49, firewall rules and network filtering. We begin level five pro/realworld networking and security. We will move from individual security concepts to understanding how professionals combine network architecture, traffic, security controls, and investigation. I'll see you in level five. A firewall can sit
622:01
Speaker A
between a trusted internal network and an untrusted network. Packets arrive. Connections are requested. Some traffic is allowed. Some traffic is blocked. and some traffic may be logged for investigation.
622:17
Speaker A
But how does the firewall actually decide what happens to each connection? That is the question we are answering today. Because in real world cyber security, knowing that a firewall exists is not enough. You need to understand its rules. Welcome to level five
622:37
Speaker A
pro/realworld networking and security. Welcome back to networking for cyber security beginner to pro. You have now completed the first four levels of this course. You started by learning networking fundamentals. Then you learned how internet communication works. After that you learned how to
623:00
Speaker A
observe and analyze network traffic. And in level four you connected networking directly to cyber security. You studied attacks defenses monitoring packet analysis, and service exposure. Now we begin the final level. Level five is about putting those individual concepts
623:21
Speaker A
together into realistic professional workflows. Our first topic is firewall rules and network filtering. In video 35, we introduced firewalls and learned that they control network traffic according to security policies.
623:38
Speaker A
Today we are going one layer deeper. We are going to look at how firewall rules are structured, how rules are evaluated, what filtering decisions mean, and how security professionals verify that those rules behave as expected, what you will
623:56
Speaker A
learn. By the end of this lesson, you will understand what a firewall rule is, the main components of a firewall rule, how rules are evaluated, the difference between allow and deny decisions, how stateful filtering works, why rule order
624:15
Speaker A
matters, how Linux firewall rules can be observed safely, how firewall filtering connects to network security and incident investigation.
624:26
Speaker A
The simple idea. Let's start with the simplest possible example. Imagine a security checkpoint at the entrance to a building. The checkpoint has rules. Employees may enter. Visitors may need approval. Certain people may be denied. The decision depends on
624:46
Speaker A
information available at the checkpoint. A network firewall works in a similar way. Traffic arrives at the firewall.
624:55
Speaker A
The firewall examines information about that traffic. Then it compares the traffic against its rules. The rule determines what happens next. A simplified rule might say allow TCP traffic to port 443.
625:12
Speaker A
That means traffic matching those conditions can be allowed. Another rule might say block traffic from a specific source network. That traffic can be denied. So the basic idea is traffic then rule match then decision. The firewall is enforcing a security policy.
625:32
Speaker A
What is inside a firewall rule? Now let's look at the information a firewall can use. A rule can consider several properties of network traffic. For example, source IP. Where did the traffic come from? Destination IP. Where is the traffic going? Protocol is it
625:51
Speaker A
TCP, UDP, ICMP or another protocol? Source port, which source port is being used? Destination port, which service or destination port is being accessed?
626:05
Speaker A
Interface, which network interface did the traffic arrive on or leave through? Direction, is the traffic entering or leaving? Connection state for a stateful firewall. Is this traffic part of an existing connection? The firewall evaluates the available information and
626:24
Speaker A
determines whether the traffic matches a rule. For example, source 10.0.0.0/24. Destination 10.0.0.10. Protocol TCP. Port 443. Action allow.
626:43
Speaker A
This could represent a policy allowing systems from the 10.0.0. o/24 network to access https on a particular server. Notice something important. The rule is not simply saying allow the internet. It is describing a specific communication pattern. This is
627:04
Speaker A
where firewall rules become useful for controlling network exposure. How rule evaluation works. Now we need to understand an important concept. Rule order. A firewall may have multiple rules. For example, rule one, allow TCP port 443. Rule two, block traffic from
627:27
Speaker A
10.0.0.50. Rule three, allow established connections. Rule four, default deny. But what happens when traffic matches more than one rule? That depends on the firewall technology and its rule processing model. Many firewall systems evaluate rules according to an ordered
627:49
Speaker A
or defined processing logic. This means the position and structure of rules can matter. This creates an important security principle. A firewall policy must be designed and reviewed as a complete rule set, not as isolated rules. A rule that looks secure by
628:10
Speaker A
itself may behave differently when combined with other rules. There is also usually some form of default behavior.
628:19
Speaker A
If traffic does not match an explicit rule, the firewall may have a default policy. For example, default allow or default deny. The exact behavior depends on the firewall configuration. Security professionals therefore need to understand both explicit rules and
628:38
Speaker A
default policy stateful firewalling. Earlier in the course we learned about TCP connections. We saw S Y N S Y N A C K A C K. We can now connect that knowledge to firewalls. A stateful firewall keeps track of connection
628:58
Speaker A
state. Instead of looking at every packet as an unrelated event, it can understand that packets belong to an existing communication session. For example, a client inside the network starts a connection to a web server. The firewall allows the connection according
629:18
Speaker A
to its policy. The firewall can then track that connection. When the server sends response traffic back, the firewall can recognize that the traffic belongs to an established connection.
629:31
Speaker A
This is one reason stateful filtering is useful. The firewall is not only asking what is this packet, it can also ask what connection does this packet belong to. This connects directly to what we learned about TCP ports and network
629:49
Speaker A
traffic earlier in the course. Practical observation on Linux. Now let's observe firewall configuration on a Linux system. We will use a readonly inspection. We are not going to change any firewall rules on systems using UFW.
630:06
Speaker A
You can run pseudo UFW status verbose. This command displays the current UFW firewall status and available rules.
630:15
Speaker A
Let's break it down. Pseudo requests elevated privileges when they are required. UFW stands for uncomplicated firewall. It provides a simpler interface for managing firewall rules on supported Linux systems. Status asks UFW to display its current status and verbose provides additional information.
630:40
Speaker A
Look for information such as status, is the firewall enabled, default policies, what happens to incoming and outgoing traffic by default, rules, which specific traffic is allowed or denied. The exact output will vary depending on your system. If UFW is not
631:02
Speaker A
installed or is not the firewall management system being used, do not assume there are no firewall controls.
631:10
Speaker A
Many Linux systems use other firewall frameworks. For example, you may encounter inftables. A readonly inspection can be performed with pseudo NFT list rule set. This asks NF tables to display the current rule set. The output may look much more complex than
631:30
Speaker A
UFW. Do not worry about memorizing it. Instead, look for the same basic ideas. What traffic is being matched? What action is being taken? Which interfaces or addresses are involved? Are ports or protocols specified?
631:47
Speaker A
What happens when traffic does not match an explicit rule? This is the important lesson. The tool may change, the firewall framework may change, but the underlying reasoning remains. traffic, then matching conditions, then policy decision, cyber security connection.
632:09
Speaker A
Now, let's connect firewall rules to professional security work. A firewall is a security control. But a security control is only useful if its configuration matches the intended security policy.
632:24
Speaker A
Imagine an organization says only the web server should be reachable from the internet. A security professional needs to verify that policy. They may ask which ports are exposed, which services are reachable, which source networks are allowed, which destination networks are
632:45
Speaker A
protected, are management services restricted, are unnecessary ports blocked? Are internal networks properly segmented? Are firewall rules generating useful logs? Are there rules that are too broad?
633:00
Speaker A
This connects directly to video 47. In video 47, we learned about port scanning and service discovery. Now we can connect the two concepts. Service exposure, then firewall policy, then observed result. Suppose the firewall policy says TCP port 443 is allowed and
633:25
Speaker A
service discovery shows port 43 is reachable. That may be expected. But if service discovery shows an unexpected management service reachable from an untrusted network, that becomes something worth investigating.
633:42
Speaker A
The same principle works in the other direction. If a service is supposed to be reachable but the firewall blocks it, that may indicate a configuration problem. This is how networking and security concepts begin to work together. We are no longer studying
634:01
Speaker A
firewalls and scanning as separate topics. We are asking does the actual network behavior match the intended security policy. That is professional security reasoning. Cyber security workflow. A useful workflow is define, configure, observe, verify, and monitor.
634:25
Speaker A
First, define the intended security policy. What should be allowed? What should be blocked? Who should communicate with whom? Second, configure the appropriate firewall rules. Third, observe the actual network behavior.
634:41
Speaker A
This can include firewall logs, packet captures, service discovery, and connection information. Fourth, verify whether the observed behavior matches the policy. And finally, monitor the environment because network conditions and applications change over time. This is one of the major themes of level 5. Security is not
635:05
Speaker A
just configuring one control. It is continuously comparing intended behavior with actual behavior. Recap. Let's summarize today's lesson. First, a firewall rule defines conditions under which network traffic is allowed, denied, or otherwise handled. Second, rules can consider information such as
635:29
Speaker A
source IP, destination IP, protocol, ports interfaces direction and connection state. Third, rule processing and default policies matter because multiple rules work together to create the actual firewall behavior. Fourth, a stateful firewall can track connections and recognize traffic that belongs to an
635:53
Speaker A
established communication session. And finally, firewall security is not only about creating rules. It is about verifying that the rules produce the intended network behavior. The professional mindset is define, configure, observe, verify and monitor.
636:14
Speaker A
Now we have moved from individual firewall concepts to firewall policy and filtering. But a firewall is only one part of a secure network. A strong security design also depends on where systems are placed, how networks are separated, how traffic flows between
636:33
Speaker A
them, and where security controls are enforced. So in the next video, we will move one level higher. In video 50, secure network architecture, we will combine concepts such as network segmentation VLANs subnets firewalls servers, users, internet, and learn how
636:56
Speaker A
professionals design networks so that security is built into the architecture itself. I'll see you in video 50.
637:06
Speaker A
Imagine a company network where every computer can communicate with every other computer. Employees can reach servers.
637:18
Speaker A
Guest devices can reach employee systems. Workstations can directly reach sensitive databases. Management systems sit on the same network as normal user devices. And one firewall is expected to protect everything. Now imagine one workstation is compromised. The problem is no longer
637:40
Speaker A
just that one computer. The attacker may now have many possible paths to other systems. This is why cyber security is not only about protecting individual devices. It is also about designing the network so that unnecessary communication is limited from the
637:59
Speaker A
beginning. In this video, we are going to take everything we have learned about networking and security and start thinking about the network as a complete architecture.
638:12
Speaker A
Welcome to video 50 of networking for cyber security beginner to pro. We are now in level 5. In the previous levels, we learned individual networking concepts. We learned about IP addresses, MAC addresses, routting, switching, VLANs gateways NAT firewalls
638:33
Speaker A
Wireshark, network attacks, scanning, and packet analysis. In video 49, we went deeper into firewall rules and network filtering. Now, we move one level higher. Instead of asking should this packet be allowed, we start asking why should these systems be able to
638:54
Speaker A
communicate in the first place. That is the architectural question. What you will learn in this video you will learn what secure network architecture means.
639:07
Speaker A
Why flat networks create security problems. How networks can be organized into security zones. How user server guest management and DMZ networks can be separated. How north south and east west traffic help us understand network communication where routting vans and
639:29
Speaker A
firewalls fit into the architecture and how cyber security professionals think about limiting unnecessary communication.
639:38
Speaker A
The simple idea. Let's start with the simplest possible idea. A secure network should not give every device access to everything. Instead, communication should be controlled based on what systems actually need. For example, an employee computer may need to access a
639:59
Speaker A
web application. The web application may need to access a database, but the employee computer may not need direct access to the database. A guest device may need internet access, but it normally does not need access to internal company servers. A management
640:18
Speaker A
system may need access to network devices, but normal employee computers do not need access to management interfaces.
640:28
Speaker A
This is the basic idea behind secure network architecture. separate systems according to their purpose and control the communication between them. This does not mean that separation automatically makes a network secure. It means that separation gives us a structure in which security
640:49
Speaker A
controls can be applied from a flat network to security zones. Let's look at a simple flat network.
640:58
Speaker A
Imagine we have 50 employee computers, several servers, guest devices, network management systems, sensitive databases.
641:09
Speaker A
If everything exists in the same network segment, many systems may be able to communicate directly. This creates a large communication area. Now compare that with a segmented architecture. We could have user network for employee workstations, server network for internal application
641:31
Speaker A
and infrastructure servers, guest network for visitors and untrusted devices. management network for administrative access to network and security infrastructure and depending on the organization DMZ a separate zone for services that need controlled exposure to external networks. You have already seen some of
641:56
Speaker A
these ideas earlier in the course. In video 22, we learned about VLANs. In video 38, we learned about network segmentation.
642:08
Speaker A
And in video 49, we learned how firewall rules control traffic. Now we combine those concepts. The important difference is that we are no longer looking at them as individual technologies.
642:23
Speaker A
We are looking at how they work together as an architecture. Understanding trust boundaries. A security zone creates a boundary between different groups of systems. Think about an employee network and a server network. They may both belong to the
642:41
Speaker A
same organization, but that does not mean every employee computer should have unrestricted access to every server. The boundary gives us a place where communication can be controlled. This is important because security is often about reducing unnecessary access. Suppose an employee
643:03
Speaker A
needs HTTPS access to an internal application. The architecture can allow that specific communication, but it may not allow the same workstation to directly connect to sensitive database services. This creates a smaller communication path and a smaller communication path can reduce
643:25
Speaker A
unnecessary exposure. This is closely related to the principle of least privilege. You may already know least privilege from other areas of cyber security. The idea is simple. Give a user device or system only the access it actually needs. The same principle
643:47
Speaker A
can be applied to network communication. Instead of asking what can this device access, a security professional should also ask what does this device actually need to access.
644:01
Speaker A
Understanding traffic direction. There are two useful terms for understanding traffic inside a network. They are north south traffic and east west traffic. North south traffic generally describes traffic moving between an internal network and an external network such as the internet.
644:22
Speaker A
For example, employee then firewall then internet. East west traffic describes communication between systems inside the environment. For example, employee, then internal application server or application server, then database. This distinction matters because an attacker who compromises one internal workstation
644:50
Speaker A
may try to move toward other internal systems. This is commonly discussed as lateral movement. The architecture can therefore help reduce unnecessary east-west communication.
645:03
Speaker A
For example, a workstation may be allowed to access an application server, but it may not need direct access to a database server. The goal is not to create arbitrary restrictions. The goal is to create communication paths that match the actual requirements of the
645:22
Speaker A
organization. Putting the architecture together. Now, let's combine what we have learned. Imagine a small enterprise network. We have user network employee workstations, server network internal application servers, database network sensitive data systems, guest network visitor and personal devices management network and
645:49
Speaker A
security administration and a DMZ for services that need controlled external exposure. Now think about the communication an employee might need user then application server.
646:03
Speaker A
The application server might need application server then database. A guest might need guest then internet but normally guest then internal database should not be necessary. Similarly user then management systems should normally be restricted. The exact rules depend on
646:26
Speaker A
the organization's requirements. This is important. There is no single architecture that is correct for every organization. A hospital, university, bank, cloud provider, small business, and security lab can all have different requirements, but the underlying reasoning remains similar. Identify
646:49
Speaker A
systems. Group by purpose. Define trust boundaries. control communication and monitor the architecture. Practical demonstration.
647:01
Speaker A
We can observe part of this architecture directly from a Linux system. The goal is not to build an enterprise network on this machine. Instead, we will inspect the information that tells us how the system participates in its current
647:15
Speaker A
network. First, run IP adder. This shows the network interfaces and their IP addresses. For example, you may see an interface with an address such as 10.28.198.144/24.
647:37
Speaker A
The exact interface name and address will depend on your system. The /24 tells us about the size of the local IPv4 network. Now run IP route. This shows the systems routing information.
647:54
Speaker A
You may see something similar to this. The first line tells us where traffic for destinations outside the local network is normally sent. The second line represents the directly connected local network. Notice what we are doing.
648:09
Speaker A
We are not changing the network. We are observing its structure. The interface tells us how am I connected. The route tells us where does my traffic go. In a larger environment, this same type of information becomes part of
648:27
Speaker A
understanding network architecture. Cyber security connection. Now we can connect architecture directly to cyber security. Suppose an attacker compromises one employee workstation. If the network is completely flat, the attacker may have many possible communication paths. But if the architecture separates users, servers,
648:52
Speaker A
databases, guests, and management systems, communication can be controlled between those zones. This can make unauthorized movement more difficult. It also creates more useful security boundaries. For example, security monitoring can focus on important communication paths. A connection from an employee workstation to an approved
649:16
Speaker A
application server may be normal, but an unexpected connection from that workstation toward a sensitive database network may deserve investigation.
649:27
Speaker A
This is where architecture connects with the topics we learned earlier. Firewall rules can enforce communication policies.
649:36
Speaker A
VLANs can provide layer 2 separation. Routing can connect different networks. Firewalls can control traffic between zones.
649:46
Speaker A
IDS and IPS systems can monitor or act on suspicious activity. Wireshark can help investigators examine the actual packets and logging can provide evidence about what happened. So secure architecture is not one technology. It is the structure that allows multiple
650:07
Speaker A
security controls to work together. This is exactly the direction of level five. We are moving from individual concepts toward professional reasoning. Recap.
650:20
Speaker A
Let's summarize. First, secure network architecture organizes systems according to their purpose and security requirements.
650:30
Speaker A
Second segmentation creates boundaries between different groups of systems. Third, not every system should have unrestricted access to every other system. Fourth, north south traffic describes communication between internal and external networks while eastwest traffic describes communication between internal systems.
650:55
Speaker A
And finally, secure architecture combines segmentation, routting, firewall policies, monitoring and other controls into one security design. The most important idea to remember is this.
651:11
Speaker A
Security should be considered when the network is designed, not only after an attack happens. We have now designed the structure of the network, but architecture alone is not enough. A secure network needs visibility.
651:28
Speaker A
Security professionals need to know what systems are communicating, when are they communicating, what traffic is normal, what changed, and what should be investigated.
651:40
Speaker A
That leads us to the next lesson. In video 51, network monitoring and logging, we will learn how professionals collect and use network activity information to understand what is happening inside an environment. We are moving from architecture to visibility
652:02
Speaker A
and that is where security monitoring begins. A secure network can still have a problem.
652:12
Speaker A
A device could start communicating with an unusual server. A user could suddenly generate a large amount of traffic. A system could begin making repeated connection attempts. But how would a security professional know that something changed? You cannot investigate what you cannot see. That is
652:32
Speaker A
why network monitoring and logging are so important. Welcome to video 51 of networking for cyber security. beginner to pro. In video 49, we learned how firewall rules control network traffic.
652:49
Speaker A
In video 50, we moved one level higher and designed secure network architecture. We separated systems into different zones and discussed how communication should be controlled. But architecture and security controls are only part of the picture. We also need visibility.
653:11
Speaker A
We need to know what is happening across the network. That brings us to network monitoring and logging. What you will learn in this video. You will learn what network monitoring means. What network logs are. The difference between monitoring and logging. What information
653:32
Speaker A
security professionals look for. How monitoring helps detect unusual activity and how Linux tools can give us a basic view of network activity. The simple idea.
653:46
Speaker A
Let's start with a simple example. Imagine you manage a company network. Normally an employee workstation communicates with a few internal services and approved internet destinations. Then suddenly that workstation starts making hundreds of connections or it begins communicating with an unfamiliar external address.
654:10
Speaker A
Something has changed. The important question is how do we know? Network monitoring gives us visibility into network activity. It helps us observe things such as connections, traffic volume, protocols, source and destination addresses, ports, network performance. Monitoring is like
654:32
Speaker A
continuously watching the network for changes. Logging is different. Logging means recording important events so they can be reviewed later. So monitoring helps us see what is happening. Logging helps us keep a record of what happened.
654:50
Speaker A
The real networking concept. Network monitoring can operate at different levels. At a basic level, we may monitor network interfaces and connections. At a deeper level, organizations may collect information from firewalls, routers, switches, servers, DNS systems, IDS and IPS systems, authentication systems,
655:15
Speaker A
endpoint security tools. For example, a firewall might record source IP address, then destination IP address, then destination port, then protocol, and finally the action taken. A DNS system may record client, then domain, then DNS response. A server may record client,
655:38
Speaker A
then application, then request, then result. These individual records can become useful when combined. One event may not tell us much, but hundreds of related events can reveal a pattern.
655:54
Speaker A
This is why cyber security professionals care about both individual events and patterns over time. How monitoring and logging work. Let's imagine a simple network. A user connects to an internal application.
656:11
Speaker A
The traffic passes through network infrastructure. Different security and networking systems can observe parts of that communication. The firewall may record whether traffic was allowed or blocked. The server may record the application request. The network monitoring system may record connection
656:32
Speaker A
information. If something suspicious happens, investigators can compare these records. For example, a workstation connects to an unusual destination. The firewall records the connection. The DNS logs show that the workstation recently resolved an unfamiliar domain. The endpoint system reports unusual
656:57
Speaker A
activity. Now we have multiple pieces of evidence pointing to the same event. This is much more useful than looking at one log entry by itself.
657:08
Speaker A
Visualize normal versus unusual activity. One of the most important ideas in monitoring is understanding normal behavior. Suppose a company's application server normally receives traffic from employee networks. That is expected. But imagine the same server suddenly starts receiving connections
657:31
Speaker A
from an unexpected network segment. That does not automatically mean an attack occurred. It means the activity deserves investigation.
657:42
Speaker A
Other examples include a sudden increase in connection attempts, repeated connections to unusual ports, unexpected communication between network segments, large changes in traffic volume, a system contacting many destinations in a short period, repeated authentication failures combined with unusual network
658:05
Speaker A
activity. These are signals. They are not automatically proof of malicious activity. Context matters. A software update, backup job, system migration or legitimate business activity can also create unusual traffic. This is why monitoring is not simply about finding something unusual. It is about
658:28
Speaker A
observing, analyzing and verifying. Practical observation. We can perform a simple observation on Linux. Start with ss-tun.
658:40
Speaker A
This command shows active network sockets. The -ash t option displays tcp connections. The -ash u option displays UDP sockets. The - ein option tells SS to show numeric addresses and ports instead of trying to resolve names. Now look at the information provided. You
659:00
Speaker A
may see a local address and port. You may also see a remote address and port.
659:06
Speaker A
For TCP connections, you may see states such as E STAB, which means an established connection.
659:16
Speaker A
You may also see other states depending on what your system is doing at that moment. The exact output will vary from system to system. Now, let's look at interface statistics. Run IP- Slink. The - S option asks IP to display
659:35
Speaker A
statistics. You can observe information such as received and transmitted packets and bytes. This gives us a basic picture of network activity on the local system.
659:46
Speaker A
These commands are not a complete enterprise monitoring system. They are simple observation tools, but they teach an important principle. Before you can investigate network behavior, you need visibility into that behavior. Cyber security connection. Now connect this to everything we have learned. In video 49,
660:09
Speaker A
we learned about firewall rules. In video 50, we designed secure network architecture. Now monitoring gives us visibility into what is actually happening inside that architecture. For example, architecture defines where systems belong. Firewall rules define what communication should be allowed.
660:33
Speaker A
Monitoring helps us observe the communication. Logging gives us records that can be investigated later. This creates a powerful security workflow.
660:45
Speaker A
Observe detect investigate correlate verify, and respond. Imagine a workstation suddenly connecting to an unusual external server. Monitoring reveals the connection. Logs provide timestamps and connection details. DNS logs may show how the destination was resolved. Firewall logs may show whether
661:11
Speaker A
the connection was allowed. Endpoint logs may provide additional evidence. Now the security professional can correlate these events and investigate what happened. [clears throat] This is the beginning of real security monitoring.
661:27
Speaker A
Recap. Let's summarize. Network monitoring gives us visibility into network activity. Logging records important events so they can be investigated later. Monitoring can show connections traffic protocols ports and activity patterns. Logs from different systems become more useful when they are correlated and most
661:52
Speaker A
importantly unusual activity is a signal to investigate not automatic proof of an attack. We now have the architecture. We have security controls and we have visibility into network activity. But there is another important question.
662:11
Speaker A
What happens when we capture the actual network traffic? Can we use packet level evidence to identify suspicious behavior? In video 52, attack detection with wireshark, we will take the packet analysis skills from level three and level four and use them for security
662:31
Speaker A
detection. We are moving from monitoring to packet level detection. And now the traffic itself becomes evidence.
662:43
Speaker A
Imagine your monitoring system tells you that a workstation is behaving strangely. You know something unusual is happening. But now you need evidence. What exactly is the computer communicating with which protocol is being used? Which ports are involved? How often are the connections
663:06
Speaker A
happening? And does the traffic actually look suspicious? This is where packet analysis becomes extremely useful.
663:15
Speaker A
Welcome to video 52 of networking for cyber security beginner to pro. In video 51 we learned about network monitoring and logging. We learned that monitoring gives us visibility while logs provide records that can be investigated.
663:33
Speaker A
Now we are going one level deeper. Instead of only looking at connection records, we can examine the actual packets traveling across a network. And one of the most useful tools for this is Wireshark. You already learned Wireshark in level three. You also learned packet
663:52
Speaker A
analysis for security in video 48. So this is not another Wireshark beginner lesson. This time we are using those skills for a specific purpose. Detecting and investigating potentially suspicious network behavior. What you will learn in this video you will learn how Wireshark
664:15
Speaker A
can support security investigations. What network indicators can appear in packet captures. How to identify unusual communication patterns. How to use filters to focus on relevant traffic and how to avoid confusing unusual traffic with confirmed malicious activity. The simple idea. Let's start with the basic
664:40
Speaker A
idea. A packet capture is a record of network traffic. Instead of simply knowing this computer connected to another computer, we can potentially see more details. For example, source, then destination, then protocol, then port, then time, and finally packet size. This
665:04
Speaker A
gives a security professional evidence to examine. Suppose a workstation suddenly starts communicating with many different systems. That could be normal, it could be software discovery, it could be an update, or it could be suspicious activity. The packet capture helps us
665:22
Speaker A
investigate the behavior instead of guessing. That is the important idea. Packets provide evidence about what actually happened on the network. The real networking concept. When investigating traffic, we are interested in patterns. For example, we may notice repeated connection attempts. A system
665:45
Speaker A
repeatedly attempts to contact different ports or destinations. Unexpected protocols. A workstation suddenly generates traffic using a protocol that is unusual for that environment. Unusual DNS activity. A system makes a large number of DNS queries or contacts. Unexpected domains.
666:08
Speaker A
Unexpected internal communication. A workstation communicates with a server or network segment that it normally does not access. These observations can become investigation signals. But remember something important from video 48. Unusual does not automatically mean malicious. For example, a vulnerability
666:31
Speaker A
scanner, software update, backup system, or monitoring tool can generate unusual traffic. The packet capture gives us evidence. We still need context. How wireshark helps. Wireshark allows us to move from all traffic to relevant traffic. And finally, specific evidence.
666:51
Speaker A
For example, if we are investigating DNS activity, we can use DNS. If we are investigating TCP traffic, TCP. If we are investigating CMP, ICMP.
667:04
Speaker A
We can also investigate a particular host using a display filter such as IP adder equals 1 192.168.1.2.
667:16
Speaker A
Oh, this tells Wireshark to show packets where that IP address appears as either the source or destination. The important point is that filters do not create evidence. They simply help us focus on the evidence that already exists in the
667:33
Speaker A
capture. Visualize a security investigation. Imagine we have a workstation with the address 1 92.168.1.2 and we notice that it is communicating with an unfamiliar external server. We could begin by filtering for that host.
667:52
Speaker A
IP. Equals=1 192.168.1.2. Oh. Then we can inspect what destinations it contacted, which protocols were used, which ports were involved, when the communication occurred, how frequently packets were exchanged.
668:14
Speaker A
Suppose we discover repeated TCP connections to many different destinations. That could be a sign worth investigating.
668:23
Speaker A
But we should not immediately conclude this is an attack. Instead, we ask what application created the traffic. Was this expected behavior? Does the user normally use this service? Do firewall or DNS logs support the same observation?
668:42
Speaker A
This is professional packet analysis. Step five, practical observation. Let's perform a safe packet analysis exercise on our own system or an authorized lab.
668:54
Speaker A
Open Wireshark and capture traffic from the appropriate interface. Then generate simple traffic. Ping- C48.8.8.8.
669:06
Speaker A
The - C4 option tells ping to send four echo requests. Stop the capture after the traffic has completed. Now apply this wireshark filter.
669:19
Speaker A
You should see the MP traffic generated by the command. Select one packet and examine the layers. You may see frame then Ethernet then internet protocol then internet control message protocol.
669:36
Speaker A
This should look familiar from our earlier Wireshark lessons. Now let's apply another filter. IP adder equals 8.8 8.8.8.
669:47
Speaker A
This focuses on packets involving that address. What we are practicing is not simply capturing packets. We are practicing a security investigation method. Focus, then inspect, then interpret, and finally correlate. And in a real investigation, the capture would normally be combined with other
670:11
Speaker A
evidence. Cyber security connection. Now let's connect this to the larger security workflow. Imagine monitoring detects unusual activity from a workstation.
670:23
Speaker A
Network monitoring gives us the initial signal. Logs give us timestamps and connection information. Wireshark can provide packet level evidence. Firewall logs can show whether connections were allowed or blocked. DNS logs can show which domains were resolved. Endpoint logs can help identify the process or
670:47
Speaker A
application responsible. This is why packet analysis is powerful. But it is also important to understand its limitations.
670:57
Speaker A
A packet capture does not automatically tell us who is behind an activity or why it happened. Encrypted traffic may hide application content. A single packet can rarely provide the complete story.
671:12
Speaker A
Security professionals therefore correlate multiple sources of evidence. The workflow becomes observe, filter, analyze, correlate, verify, and respond.
671:23
Speaker A
Recap. Let's summarize. First, Wireshark can provide packet level evidence during security investigations. Second, filters help us reduce large amounts of traffic to relevant packets. Third, repeated connections, unusual protocols, unexpected destinations, and unusual DNS behavior can become investigation signals. Fourth, unusual traffic is not
671:51
Speaker A
automatically malicious. Context and correlation are required. And finally, professional packet analysis combines network traffic with logs and other security evidence. We have now learned how to investigate traffic at the packet level. But there is another important question. What happens when you type a
672:13
Speaker A
website address into your browser? How does that request travel from your computer through your local network through routers across the internet and finally reach a web server? In video 53, how a web request travels across the internet. We will follow that journey
672:33
Speaker A
from beginning to end. We are moving from packet level detection to end to end web communication.
672:41
Speaker A
And this time we will connect almost everything we have learned throughout the course. You type a website address into your browser. You press enter. A moment later the website appears. It feels almost instant. But behind that simple action,
673:03
Speaker A
your computer may perform DNS resolution, establish a network connection, negotiate encryption, create HTTP requests, send packets through your local network, pass through a gateway, cross multiple routters, reach a remote server, and then receive the response back. So, what actually happens between
673:26
Speaker A
pressing enter and seeing a web page? In this video, we are going to follow that journey from beginning to end.
673:36
Speaker A
Welcome to video 53 of networking for cyber security beginner to pro. We are now going to connect many of the concepts we have already learned into one complete communication flow. Earlier in this course, we studied DNS. We studied HTTP and HTTPS.
673:56
Speaker A
We studied TLS. We studied packets and frames. We learned encapsulation. We learned routting,NAT, default gateways, firewalls, Wireshark, and packet analysis. Now, we are going to put those pieces together. We are not learning each concept again from the beginning. Instead, we are going to
674:19
Speaker A
follow one web request and see where each concept becomes useful. This is important because cyber security professionals often need to understand communication as a complete process, not as isolated topics. What you will learn by the end of this video, you will
674:39
Speaker A
understand how a browser starts a web request, how DNS helps find the destination, how the connection is established, where TLS fits into HTTPS, how the HTTP request is created, how traffic moves through the local network and routters, whereNNAT and firewalls
675:01
Speaker A
can become involved, how the server sends the response back, and how security professionals can observe different stages of this journey. Let's follow the request. The simple idea.
675:14
Speaker A
Imagine you want to visit https colon/example.com. You enter the address into your browser. At this point, your computer knows the name of the website. But a name likeample.com is not enough for the network to deliver traffic. Your computer needs to
675:35
Speaker A
communicate with an IP address. This is where DNS becomes important. You already learned in video 13 that DNS translates domain names into information such as IP addresses. So, conceptually the beginning of the journey looks like this. The browser needs the destination.
675:58
Speaker A
DNS helps provide that information. But DNS is only the beginning. Once the destination is known, the computer needs to communicate with that destination.
676:10
Speaker A
For HTTPS traffic, this normally involves a connection to TCP port 443. You already learned about ports in level one and TCP in several later lessons.
676:24
Speaker A
So, we can now connect those concepts together. The simple idea is domain name then IP address then connection then HTTPS request and finally server response. That is the journey we are going to follow the real networking concept. Let's make the process more
676:44
Speaker A
technical. Suppose your computer wants to access https colon/example.com. First, it may need to resolve the domain name using DNS.
676:58
Speaker A
The DNS response provides an address that the system can use to reach the destination. The exact address can vary.
677:07
Speaker A
Web services may use multiple IP addresses, load balancing, CDNs, or other infrastructure. So, do not think of a website as necessarily being one computer with one permanent IP address.
677:22
Speaker A
Once the destination is known, the computer needs to send traffic toward it. If the destination is outside the local network, the computer uses its default gateway. You learned this in video 23. The local system decides, is this destination on my local network? If
677:43
Speaker A
it is not, the traffic is sent toward the default gateway. The router then uses its routing table to decide where to forward the traffic. You learned this in video 20. If the connection is leaving a private network, NAT or PAT
677:59
Speaker A
may also translate the internal address and port as the traffic passes through the network gateway. You learned this in video 21. A firewall may then evaluate the traffic according to its rules. You explored firewall policy in videos 35
678:17
Speaker A
and 49. So already several lessons from this course are becoming part of one communication path. How it works? Now let's follow the request in logical order. Imagine this simplified flow.
678:32
Speaker A
User then browser then DNS then gateway then routters and finally web server. Let's start with DNS.
678:44
Speaker A
The computer asks a DNS resolver for information about the domain. The resolver responds with an IP address.
678:52
Speaker A
The computer now knows where it needs to send the web traffic. Next comes the connection. For traditional HTTPS over TCP, the client establishes a TCP connection with the server. You already learned the TCP 3-way handshake in video 30. S Y N S Y N A C K A C. After the TCP
679:19
Speaker A
connection is established, https can negotiate TLS. You learned in video 17 that TLS provides encryption and helps authenticate the server through certificates. So conceptually TCP connection then TLS negotiation then encrypted HT TTPS communication after that the browser can
679:44
Speaker A
send an HTTP request through the protected connection for example conceptually get/http/1.1 the actual request contains additional information such as headers and modern websites may use HTTP/2 or HTTP/3 instead. The important point is that HTTP describes the web communication.
680:12
Speaker A
TLS protects the communication when HTTPS is being used. TCP can provide the transport connection in traditional HTTPS over TCP and the network sends the resulting data toward the destination.
680:29
Speaker A
Now the traffic leaves the computer. The local network carries it toward the gateway. The gateway may perform NAT or PAT. Routers along the path examine destination information and forward the traffic toward the next network. The exact path depends on routting.
680:49
Speaker A
Eventually the traffic reaches infrastructure serving the website. The server processes the request. It may retrieve information from an application, database, cache or other internal system. Then the response travels back. So the complete simplified journey becomes browser then D N S then
681:09
Speaker A
T CP then T L S then HTTP request then local network then gateway or NAT then routters then server then HTTP response then back through the network and finally browser. This is the same networking knowledge we have been
681:32
Speaker A
building throughout the course. Now working together visualize the complete journey. Let's visualize the entire process. On the left we have the user device. Inside it the browser then the local network. Then the default gateway then NAT and firewall. then several
681:54
Speaker A
internet routers and finally the web server or cloud infrastructure. The response then travels back through the same network path. Use restrained blue network lines with directional arrows.
682:08
Speaker A
Show small packet representations moving along the path. Remember the internet is not one single cable connecting two computers. It is a collection of interconnected networks. Now let's zoom in to the user's computer. Here we can see D N S then T CP then T L S then HT
682:30
Speaker A
TTP. Now zoom back out and follow the connection through the gateway routters and finally to the server. Now notice something important. Different parts of the journey can be observed at different locations. A DNS log can show the domain
682:45
Speaker A
lookup. A firewall can show traffic being allowed or blocked. A NAT device can record address and port translations.
682:56
Speaker A
A packet capture can show network packets. A server log can show the incoming request. And an endpoint can show which application created the connection. This is exactly why monitoring and logging became important in videos 51 and 52.
683:16
Speaker A
There is rarely one single source that tells the entire story. Security professionals often combine evidence from multiple points. Practical observation.
683:28
Speaker A
Now let's observe part of this process from Linux. We will use a safe request to a public website. For example, curl-v https colon/google.com.
683:42
Speaker A
The curl command makes a web request from the terminal. The -v option means verbose. It asks curl to show additional information about the connection process. Now run. The exact output will vary depending on your system, DNS configuration, network, and the website.
684:03
Speaker A
But you may see information showing that curl resolves the host name, connects to an IP address, establishes a connection, performs TLS negotiation, and then sends an HTTP request. You may see lines showing something similar to trying an IP address, then connected, then TLS
684:24
Speaker A
information, and later get/http/2. Do not worry if your output looks different. The important thing is to understand what each stage represents.
684:37
Speaker A
First, hostname resolution. The system needs to determine where the domain should be reached. Next, connection. The client establishes communication with the destination. For HTTPS over TCP, this includes the TCP connection we studied earlier. Then, TLS, the client and server establish
685:00
Speaker A
protected communication. Then HTTP the client sends the web request. Finally response the server sends data back to the client. This one command gives us a useful high-level observation of several stages that we have already studied individually. If you want to
685:22
Speaker A
inspect the local network configuration involved in this journey, you can also run IP route. This shows the systems routting information. Look for the default route. You may see something similar to default via 10.115.178.179 devo.
685:45
Speaker A
The exact address and interface will vary. Here the important part is default via 10.115.178.179.
685:56
Speaker A
that tells us where traffic without a more specific route can be sent. You can also inspect your IP configuration with IP adinar. This helps you understand which interfaces and addresses your system is using. So even before looking at the remote server, we can observe
686:16
Speaker A
part of the journey from our own machine cyber security connection. Now let's look at why this matters to cyber security. A web request is not just I opened a website. It is a chain of network events. A security professional
686:33
Speaker A
can investigate different points in that chain. For example, DNS can reveal which domains a system is attempting to reach.
686:43
Speaker A
Firewall logs can show whether traffic was allowed or blocked. NAT logs can help connect a private internal address and source port to an external connection. Packet captures can show communication patterns.
686:58
Speaker A
TLS information can provide useful connection metadata even when application content is encrypted. Server logs can show requests received by the application. Endpoint logs can show which process created a connection and network monitoring can reveal unusual communication patterns. Imagine an
687:21
Speaker A
organization notices that one workstation is communicating with an unfamiliar external service. A security professional does not immediately conclude. This is malicious. Instead, they investigate. They might ask what domain was resolved, what IP address was returned, which process created the
687:44
Speaker A
connection, which port and protocol were used, was the connection allowed by the firewall, was NAT involved, how frequently did the system communicate, was the traffic expected for that application, what does the server side evidence show? This is professional
688:03
Speaker A
network reasoning. It is about connecting evidence and this connects directly to everything we learned in level five. In video 50, we studied secure architecture. In video 51, we studied monitoring and logging. In video 52, we studied packet level detection.
688:24
Speaker A
Now we can see how a normal web request moves through that architecture and creates observable evidence along the way. The important security mindset is observe analyze correlate verify and respond. Do not treat one unusual packet, one unfamiliar IP address, or
688:45
Speaker A
one unexpected DNS response as automatic proof of an attack. Recap. Let's quickly review the complete journey. First, the user enters a domain name. DNS helps resolve that domain to an address. Then the client establishes communication with the destination for HTTPS
689:06
Speaker A
over TCP. TCP establishes the connection and TLS provides protected communication. The browser sends an HTTP request. The traffic moves through the local network and toward the default gateway. Routting determines how traffic moves between networks.NAT NAT or PAT may translate the internal address and
689:29
Speaker A
port. Firewalls may enforce security policy along the path. The request reaches the server. The server processes it and sends a response back and the response travels through the network until it reaches the user's browser. So remember this simplified model. domain
689:46
Speaker A
then DNS then connection then T L S then HTTP then network then routting then server and finally response and from a cyber security perspective communication then visibility then evidence and finally investigation we have now followed one known web
690:13
Speaker A
request across the internet. But a security professional often starts from a different position. Instead of already knowing the destination, they may be looking at an unfamiliar network. They need to understand what systems exist, what networks are present, what services
690:32
Speaker A
are exposed, how are those systems connected, and what can legitimately be observed. That brings us to the next lesson. Video 54. How a security professional discovers a network. We will take everything we have learned about IP addresses, routting, ports,
690:52
Speaker A
scanning segmentation firewalls, monitoring, and packet analysis and use it to understand how professionals build a picture of a network in an authorized environment.
691:07
Speaker A
Imagine you are a security professional and you are given access to a new network. You do not know every device connected to it. You do not know which systems are servers. You do not know which addresses are in use and you do not know which
691:26
Speaker A
services are exposed. So where do you start? You do not immediately attack anything. You start by building a map.
691:35
Speaker A
You observe. You identify, you verify, and gradually you build a picture of the network. In this video, we are going to look at how a security professional discovers a network in an authorized environment.
691:52
Speaker A
Welcome to video 54 of networking for cyber security beginner to pro. We are now deep into level five. In the previous video, we followed a web request across the internet. We connected many concepts we had already learned DNS, TCP,
692:12
Speaker A
TLS HTTP packets, routing, NAT and network infrastructure. Now we are going to look at the network from a different perspective. Instead of asking how does traffic travel, we are going to ask what exists on the network. This is the
692:33
Speaker A
beginning of network discovery. Network discovery is the process of identifying systems addresses devices and services that exist within a network or an authorized scope. For cyber security professionals, this is an important part of understanding the environment before deeper analysis begins. But there is an
692:57
Speaker A
important rule. Everything we demonstrate in this lesson should be performed only against systems we own, local lab environments, virtual machines or networks where we have explicit authorization.
693:12
Speaker A
The goal is not unauthorized access. The goal is understand, observe, identify, verify, and analyze. What you will learn by the end of this video, you will understand what network discovery means, why security professionals perform discovery, what information can be
693:34
Speaker A
discovered, how IP addresses help identify systems, how a local machine can observe its network configuration, how tools such as IP, IP root, ping, and SS can provide useful information. The difference between discovery and exploitation and how discovery prepares us for the
693:56
Speaker A
next stages of security assessment. The simple idea. Let's begin with a simple example. Imagine you enter a large office building. Before you can understand the building, you need to know what is inside it. You might identify different rooms, different
694:16
Speaker A
departments, different entrances, different systems, and different areas with different purposes. A network is similar. A security professional first needs to understand what systems exist and how they are connected. For example, a small network might contain a router, several computers, a printer, a file
694:40
Speaker A
server, a web server, a wireless access point, and other network connected devices. The first goal is not to break into these systems. The first goal is simply to answer what is here. This is what makes discovery important. Before
694:59
Speaker A
you can properly analyze security, you need to understand the environment you are analyzing. The real networking concept. Network discovery is not one single command or one single technique. It is a process of collecting information about a network.
695:20
Speaker A
Depending on the environment and authorization, that information can include IP address ranges, active hosts, network gateways, DNS information, open services, operating system clues, network paths, and relationships between systems. Remember what we learned earlier. An IP address identifies a
695:44
Speaker A
device or network interface at the network layer. A port identifies a communication endpoint. A router connects different networks. A switch connects devices within a local network.
695:59
Speaker A
And protocols define how those systems communicate. All of these concepts now become useful. For example, imagine a lab network using 1 192.168.1.0/24.
696:15
Speaker A
This represents a subnet containing a range of IPv4 addresses. A security professional working inside this authorized network may first determine which addresses are actually in use. But discovering an IP address does not automatically mean discovering everything about the system. That is an
696:39
Speaker A
important distinction. Discovery happens in layers. You may first discover that a host exists. Then you may determine which services are available. Then you may identify additional technical details. And only after sufficient evidence is collected can you properly analyze the security of that system. How
697:02
Speaker A
it works? Let's look at the discovery process conceptually. Imagine our authorized lab contains several systems. The first thing we need is context. What network are we connected to? What is our local IP address? What subnet are we using? What
697:23
Speaker A
is our default gateway? These are questions we already know how to answer from earlier lessons. Once we understand our own network position, we can determine what is within the authorized scope. From there, discovery can move toward identifying active systems. A
697:43
Speaker A
host that responds to an appropriate connectivity check may indicate that a system is reachable. Then we can investigate what services are exposed.
697:53
Speaker A
For example, a web service may use port 80 or 443. SSH commonly uses port 22. DNS commonly uses port 53. But remember a port number alone does not prove exactly what software is running. It is an observation that requires verification.
698:16
Speaker A
This is an important professional mindset. Do not immediately assume. Observe first then verify. That mindset is especially important in cyber security because incorrect assumptions can lead to incorrect conclusions.
698:33
Speaker A
Visualize it. Let's visualize the process. Imagine an unknown network. At the beginning, all we see is network. We do not yet know what is inside. Then we identify the network range. For example, 1 192.168.1.0/24.
698:52
Speaker A
Now we begin identifying active systems. We might discover 1 192.168.1.1 gateway 192.168.1.10. 1 Workstation 1 192.168.1.2 O Workstation 1 192.168.1.5 O server 1 192.168.1.1 O printer. Now the network is starting to make sense. Next we may observe services associated with a particular
699:29
Speaker A
host. for example 1 192.168.1.5 O port 222 SSH port 80 HTTP port 44 43 HTTPS Notice the progression we did not begin with exploitation we began with visibility network then IP range then active hosts then services then information and finally analysis This
700:00
Speaker A
this is the basic reasoning pattern behind network discovery. Practical observation. Now let's observe some of these concepts on a Linux system. We will use our own Linux machine or an authorized virtual machine. First we can inspect the network interfaces. Run IP address. This
700:22
Speaker A
displays the network interfaces and their assigned addresses. You may see an entry similar to inet 10.37.8472/24.
700:36
Speaker A
Your address will probably be different. The important part is understanding what the output tells us. The address 10.37.8472 is the IPv4 address assigned to that interface. The slash 24 tells us the CIR prefix length.
700:59
Speaker A
From our subnetting lessons, we know that /24 commonly corresponds to the network 10.37.8472/24. So immediately one command has given us useful network context. Now let's inspect the routting information. run ip route. You may see something similar to this. The exact interface name and
701:27
Speaker A
addresses will depend on your system. The first important line is the default route. For example, default via 10.37.8472.
701:42
Speaker A
This tells us that traffic without a more specific route is sent toward 10.37.84.1 84.172 which is our next hop gateway. The second line tells us about the directly connected network 10.37.84/24.
702:03
Speaker A
So now we know three important pieces. Our local IP, our local network and our default gateway. We can also observe nearby network information using IP nay.
702:17
Speaker A
This displays the kernel's neighbor table. You may see entries containing IP addresses and MAC addresses. The exact output will be different. This is useful because it can show systems that the local machine has recently interacted with or learned about at the local
702:35
Speaker A
network level. Notice how our earlier lessons are now connecting. IP addresses identify network layer end points. MAC addresses are used for local network communication and the neighbor table connects these two pieces of information. We can also inspect active
702:56
Speaker A
network sockets using SS- TULN. This shows listening TCP and UDP sockets. You may see entries such as listen 0.0.0.0 colon 22. The important part here is colon 22 which indicates a listening TCP port associated with SSH on many Linux
703:22
Speaker A
systems. The exact services on your machine may be completely different. Again, do not assume. Observe the output and interpret what it actually tells you. This is an important lesson about professional discovery. A security professional does not depend on one
703:42
Speaker A
command. Different commands provide different pieces of evidence. IP address gives interface and address information.
703:51
Speaker A
IP routt shows routting information. IP nay provides local neighbor information. SS shows local listening and network socket information. Together, these observations help build a clearer picture of the system and its network position. But remember the scope. These commands are being used on our own
704:15
Speaker A
system or an authorized environment when discovery extends beyond your own machine. You must have permission to examine the target network. Cyber security connection. Now let's connect network discovery to cyber security.
704:32
Speaker A
Discovery is important because defenders and security professionals need visibility. If an organization does not know what systems exist on its network, it becomes much harder to understand its security exposure.
704:49
Speaker A
Discovery can help answer questions such as which systems are present, which addresses are being used, which services are exposed, which systems communicate with each other, which devices belong to different network segments, and which systems require further security review.
705:08
Speaker A
For a security professional, this information can support several activities. It can help with asset inventory. It can support vulnerability assessment. It can help during incident investigation. It can help identify unexpected systems and it can provide context when analyzing suspicious
705:29
Speaker A
network traffic. But there is another important distinction. Discovery is not exploitation. Finding a host does not mean you have compromised it. Finding an open port does not mean you have compromised the service. Finding a service does not automatically mean that the service is
705:50
Speaker A
vulnerable. These are different stages. A professional approaches discover, verify, enumerate, analyze, and assess. And when performing authorized security testing, the scope always comes first.
706:07
Speaker A
This is also where the concepts from earlier videos become extremely valuable. Our understanding of IP addresses CID routting ports protocols DNS firewalls, packets, and network architecture allows us to interpret discovery results correctly. Without that foundation, discovery can become
706:31
Speaker A
nothing more than a list of addresses and ports. With networking knowledge, those results become meaningful evidence.
706:39
Speaker A
Recap. Let's summarize. First, network discovery is the process of identifying systems, addresses, services, and other useful information within an authorized network scope. Second, discovery starts with understanding your own network position, including your IP address, subnet, and default gateway. Third,
707:04
Speaker A
Linux tools such as IP address, IP root, IP nay and SS can provide useful network information. Fourth, discovery is about building visibility and understanding the environment. And finally, discovery is not exploitation. A security professional observes first, verifies information, and then performs deeper
707:29
Speaker A
analysis within an authorized scope. Now we know how a security professional can begin discovering a network. But discovery is only the beginning. Once we know what systems exist, the next question becomes, what happens when we move from discovery into a complete
707:49
Speaker A
security workflow? How do reconnaissance, scanning, enumeration, exploitation, and detection connect together? That is exactly what we will explore in the next video.
708:02
Speaker A
In video 55, we will connect the full process. Reconnaissance, then scanning, then enumeration, then exploitation, and finally detection. And we will see how networking knowledge supports every stage of that workflow.
708:26
Speaker A
A security professional does not usually begin with exploitation. Before attempting to exploit anything, they need to understand the environment.
708:36
Speaker A
What systems exist? What services are available? What technologies are being used? What looks normal? And what deserves further investigation.
708:47
Speaker A
This creates a much more useful security workflow. recon, scanning, enumeration, exploitation, and detection. In this video, we are going to connect these stages into one complete security process. Welcome to video 55 of networking for cyber security, beginner to pro. We are now deep into level five
709:12
Speaker A
where the goal is to combine the networking and security concepts we have learned throughout the course. Earlier we studied reconnaissance and network discovery concepts. We learned about ports and protocols. We studied TCP connections. We learned how scanning works. We looked at service discovery.
709:34
Speaker A
We analyzed packets with Wireshark. And we learned how security professionals monitor and investigate network activity. Now we are going to connect those ideas into one complete workflow.
709:49
Speaker A
The important point is that these stages are connected. Each stage produces information that can support the next stage. And throughout this lesson, all practical examples will remain inside systems you own. Virtual machines, intentionally vulnerable labs, or environments where you have explicit
710:11
Speaker A
authorization. What you will learn. By the end of this video, you will understand what reconnaissance means, how scanning differs from reconnaissance, what enumeration adds to the investigation, where exploitation fits into the workflow, how defenders can detect activity associated with these stages,
710:34
Speaker A
how the stages connect together, and how a security professional can reason through the entire process.
710:42
Speaker A
Reconnaissance. Let's begin with reconnaissance. Reconnaissance means gathering information about a target environment before deeper testing or investigation.
710:54
Speaker A
At this stage, the goal is not exploitation. The goal is understanding. For example, imagine you are responsible for a small company network. Before testing its security, you may need to understand what systems exist, what domains are associated with the
711:14
Speaker A
organization, what network ranges are in scope, what services are expected, what technologies are being used, and what systems are important to the business.
711:26
Speaker A
Reconnaissance can involve information from different sources. Some information may come from documentation, asset inventories, DNS records, network diagrams or other authorized sources.
711:41
Speaker A
The important idea is reconnaissance. Then understand the environment. You are building a map of what you are dealing with. This is why reconnaissance comes before more focused technical testing, scanning.
711:58
Speaker A
Once we have an idea of the environment, the next question is which systems are actually reachable. This is where scanning becomes useful. We already discussed scanning in video 33 and service discovery in video 47. So we do not need to rebuild those lessons. Here
712:19
Speaker A
we are using them as part of a larger workflow. Scanning can help identify things such as reachable hosts, open ports, closed ports, filtered ports, potential network services. For example, suppose an authorized test environment contains server A, server B, server C. A
712:40
Speaker A
scan may show that server A has TCP port 443 reachable. Server B may have TCP port 22 reachable. Service C may have no visible services. That information changes what we investigate next. The important distinction is scanning tells us what appears reachable. It does not
713:04
Speaker A
automatically tell us whether something is vulnerable. An open port is not the same thing as a security vulnerability.
713:13
Speaker A
It is simply another piece of information. Enumeration. Now we move one layer deeper. Scanning may tell us that a port is open.
713:25
Speaker A
Enumeration tries to learn more about what is behind that port. For example, what service is running? What application is responding? What version or technology might be present? What configuration information is exposed?
713:40
Speaker A
What authentication mechanism is being used. This gives us a more detailed understanding of the system.
713:48
Speaker A
Think about the difference like this. Scanning port 44 43 appears open. Enumeration an HTTPS service is responding on port 443 and we are collecting authorized information about that service.
714:06
Speaker A
Enumeration reduces uncertainty. Instead of simply knowing that communication is possible, we start understanding what is actually communicating.
714:17
Speaker A
This is especially important in cyber security because different services have different security considerations. A web server has different risks from an SSH server. A DNS server has different behavior from a database server.
714:35
Speaker A
Understanding the service helps determine what should be investigated next. Exploitation. Now we reach the stage that many people associate with hacking, exploitation.
714:49
Speaker A
But exploitation should not be treated as the first step. It comes after information has been gathered and the environment has been understood. In a legitimate security assessment, exploitation means demonstrating that a specific weakness can actually be abused.
715:10
Speaker A
For example, an authorized test may identify a vulnerable service or application. The security professional can then use a controlled proof of concept to determine whether the weakness is real and what impact it could have. The important word here is validation. The goal is not
715:32
Speaker A
simply to cause damage. The goal is to verify a security weakness and understand its impact within the authorized scope. And sometimes exploitation is not necessary at all. If the available evidence is already sufficient, a professional may stop before exploitation.
715:52
Speaker A
This is an important security mindset. More activity does not automatically mean better testing. The objective is to collect enough evidence to understand the security issue while minimizing unnecessary impact.
716:08
Speaker A
Practical observation. Now let's connect these stages using a small authorized lab. Use your own Linux machine, a virtual machine or an intentionally vulnerable system that you are authorized to test. First we can observe our own system with IP address.
716:29
Speaker A
This shows the interfaces and IP addresses assigned to the machine. Then we can inspect listening services with SS-LN TU. Here L shows listening sockets. Dash N displays addresses and ports numerically. T shows TCP. U shows U DP and P can show the process associated
716:52
Speaker A
with a socket when permitted. This gives us a local view of the attack surface.
716:57
Speaker A
For an authorized lab containing another test machine, a controlled scanner can then be used to identify reachable services. For example, NM map authorized lab IP. The exact results depend on the lab. Before we finish, there is one important thing I want you to know. This
717:19
Speaker A
complete networking course contains 60 videos across five levels. However, due to YouTube's video upload duration limit, I could not include all 60 videos in this single upload. That is why this video contains videos 1- 55, while the final five videos are available
717:41
Speaker A
separately in the ACW 360 playlist titled networking for ethical hackers beginner to pro. I sincerely apologize for this inconvenience and I appreciate your understanding.
717:57
Speaker A
This was not my intention but a limitation I had to work around. Let me quickly show you how to find the remaining five videos. Open the description below this video and click the course playlist link. Once the playlist opens, scroll to the final
718:16
Speaker A
section to find the remaining lessons starting with video 56 and continue through video 60. You do not need to miss any lesson. All five levels are available for you to complete the entire course. Thank you for learning with
718:35
Speaker A
ACW360. Keep practicing, keep learning, and keep building your cyber security skills.
Topics: networking ethical hacking Linux IP address OSI model TCP handshake DNS packet capture tcpdump cyber security

Get More with the SozAI App

Transcribe recordings, audio files, and YouTube videos — with AI summaries and speaker detection. 30 minutes free.

App Store Google Play
Or transcribe another YouTube video here →

Free tools: TXT to SRT · SRT Validator · Merge SRT · Subtitle to Text · All tools

Related Transcripts

View All
7 Best Netflix Movies to Watch Right Now 2026! — Transcript 7:25
7 Best Netflix Movies to Watch Right Now 2026! — Transcript
Select10
875 1 English
Top 5 BEST NEW Netflix Movies Released in 2026! — Transcript 5:16
Top 5 BEST NEW Netflix Movies Released in 2026! — Transcript
Select10
626 1 English
7 Best Netflix Movies to Watch Right Now 2026! — Transcript 5:54
7 Best Netflix Movies to Watch Right Now 2026! — Transcript
Select10
703 1 English
Homemade Catapult Goes Wrong | Fascinating Horror — Transcript 9:24
Homemade Catapult Goes Wrong | Fascinating Horror — Transcript
Fascinating Horror
749 1 English
Payton Preslee on How She Became a Bop, Insane Facial Expressions & More — Transcript 33:13
Payton Preslee on How She Became a Bop, Insane Facial Expressions & More — Transcript
PLUG TALK PODCAST
7,511 1 English
How to Be a Great Listener | Maegan Stephens, Nicole Lowenbraun | TED — Transcript 11:46
How to Be a Great Listener | Maegan Stephens, Nicole Lowenbraun | TED — Transcript
TED
2,820 1 English
The Art of Active Listening | The Harvard Business Review Guide — Transcript 7:40
The Art of Active Listening | The Harvard Business Review Guide — Transcript
Harvard Business Review
1,161 1 English
The science behind dramatically better conversations | Charles… — Transcript 12:51
The science behind dramatically better conversations | Charles… — Transcript
TEDx Talks
2,519 1 English
4 things all great listeners know — Transcript 4:45
4 things all great listeners know — Transcript
TED-Ed
668 1 English
Resep Kue Jongkong, Dessert Khas Indonesia — Transcript 3:29
Resep Kue Jongkong, Dessert Khas Indonesia — Transcript
Cooking with Hel
99 1 English
Hubble’s Inside the Image: Lensed Supernova Refsdal — Transcript 4:37
Hubble’s Inside the Image: Lensed Supernova Refsdal — Transcript
NASA Goddard
828 1 English
An Introduction to the James Webb Space Telescope Mission — Transcript 3:44
An Introduction to the James Webb Space Telescope Mission — Transcript
NASA Goddard
416 1 English