■ LINUX FOR HACKERS
Networking — How Computers Talk
MODULE 2 OF 5 · NETWORKING FUNDAMENTALS
Networking 101
Every hacker MUST understand how networks work. Whether you're intercepting traffic,
scanning for open ports, or exploiting a service — it all comes back to networking basics.
This module covers the concepts and Linux tools you need.
Key Concepts
■ IP Address — unique number identifying a device (IPv4: [Link] IPv6: fe80::1)
■ Subnet Mask — defines which part of the IP is 'network' vs 'host' (e.g. [Link] =
/24)
■ Gateway — the router that forwards traffic outside your local network
■ DNS — translates hostnames ([Link]) into IP addresses
■ MAC Address — hardware-level identifier burned into your network card
■ Port — a numbered endpoint for a service (HTTP=80, HTTPS=443, SSH=22, FTP=21)
■ TCP vs UDP — TCP: reliable, handshake-based. UDP: fast, fire-and-forget
The OSI Model (Cheat Sheet)
Layer Name Example Protocols
7 Application HTTP, FTP, SSH, DNS, SMTP
6 Presentation SSL/TLS, JPEG, MP4
5 Session NetBIOS, RPC
4 Transport TCP, UDP
3 Network IP, ICMP, ARP
2 Data Link Ethernet, Wi-Fi (802.11)
1 Physical Cables, Radio waves, Fiber
■ Hackers say: 'All People Seem To Need Data Processing' (mnemonic layers 7→1)
Linux for Hackers · Page 1 For educational purposes only — hack ethically!
Network Interface Commands
COMMAND WHAT IT DOES
ip a Show all network interfaces and IP addresses
ip r Show routing table (find your gateway)
ip link set eth0 up Bring interface eth0 online
ifconfig Older command — still useful on many systems
iwconfig Wireless interface settings
nmcli dev status NetworkManager: show connection status
ss -tuln List all open ports and listening services
netstat -tulnp Same as ss but older (may need net-tools)
Testing Connectivity
COMMAND WHAT IT DOES
ping [Link] Send ICMP echo to Google DNS — are you online?
ping -c 4 host Send exactly 4 packets
traceroute [Link] Show every hop to destination
mtr [Link] Real-time traceroute (install mtr)
nslookup [Link] Query DNS for an IP address
dig [Link] Advanced DNS lookup (more detail)
dig -x [Link] Reverse DNS lookup — IP to hostname
whois [Link] WHOIS registration info for a domain
Packet Analysis with tcpdump
tcpdump is a command-line packet sniffer. It captures raw network traffic — essential for
understanding protocols and spotting anomalies.
COMMAND WHAT IT DOES
tcpdump -i eth0 Capture packets on interface eth0
tcpdump -i eth0 -n No name resolution (show raw IPs)
tcpdump port 80 Only capture HTTP traffic
tcpdump host [Link] Only packets to/from this host
tcpdump -w [Link] Save capture to file (open in Wireshark)
tcpdump -r [Link] Read and display a saved capture
Linux for Hackers · Page 2 For educational purposes only — hack ethically!
■■ Only sniff networks you own or have permission to monitor!
Useful Ports to Memorise
Port Protocol Notes
21 FTP File Transfer — often cleartext (avoid!)
22 SSH Secure remote shell — encrypted
23 Telnet Insecure remote shell — avoid
25 SMTP Email sending
53 DNS Domain name resolution
80 HTTP Unencrypted web traffic
443 HTTPS Encrypted web traffic (TLS)
3306 MySQL Database — should NOT be internet-facing
3389 RDP Windows Remote Desktop
8080 HTTP-alt Common web dev / proxy port
Lab Exercises
■ Lab 1: Run ip a and record your machine's IP, subnet mask, and MAC address.
■ Lab 2: Ping [Link] with 5 packets. Then try pinging a hostname that doesn't exist —
what error do you get?
■ Lab 3: Use dig to find the IP addresses for [Link] and also retrieve its MX records:
dig [Link] MX
■ Lab 4: Run ss -tuln and list every listening service. Google any port numbers you don't
recognise.
■ Lab 5: Capture 20 HTTP packets with tcpdump on port 80, then use strings to find
readable data.
Linux for Hackers · Page 3 For educational purposes only — hack ethically!