Networking Basics
The internet is built on layers of abstraction. To exploit it, you must peel back these layers.
The OSI Model
The Open Systems Interconnection (OSI) model describes how computer systems communicate. Hackers use this to categorize attacks (e.g., "Layer 7 DDoS" vs "Layer 2 ARP Spoofing").
Memory Trick
| Layer | Name | Function | Protocols | Attack Examples |
|---|---|---|---|---|
| 7 | Application | End-user processes | HTTP, SSH, FTP, DNS, SMTP | SQLi, XSS, RCE |
| 6 | Presentation | Data formatting/encryption | SSL/TLS, JPEG, ASCII | SSL Stripping, Padding Oracle |
| 5 | Session | Connections between apps | NetBIOS, RPC, SMB | Session Hijacking |
| 4 | Transport | End-to-end connections | TCP, UDP | SYN Flood, Port Scanning |
| 3 | Network | Routing and addressing | IP, ICMP, IPSec | IP Spoofing, Smurf Attack |
| 2 | Data Link | Physical addressing | Ethernet, ARP, Wi-Fi | ARP Spoofing, MAC Flooding |
| 1 | Physical | Raw bit stream | Cables, Hubs, Radio | Wiretapping, Jamming |
IP Addressing (Layer 3)
An IP address is a logical identifier for a device on a network. Unlike MAC addresses, IPs can be changed and are used for routing across networks.
IPv4
32-bit address, written as 4 octets (0-255 each).
192.168.1.1
~4.3 billion addresses (exhausted)
IPv6
128-bit address, hexadecimal notation.
2001:0db8:85a3::8a2e:0370:7334
340 undecillion addresses
Private IP Ranges (RFC 1918)
These addresses are NOT routable on the public internet. You'll see them on every internal network.
| Class | Range | CIDR | Hosts | Common Use |
|---|---|---|---|---|
| A | 10.0.0.0 - 10.255.255.255 | 10.0.0.0/8 | 16M+ | Large enterprises |
| B | 172.16.0.0 - 172.31.255.255 | 172.16.0.0/12 | 1M+ | Medium organizations |
| C | 192.168.0.0 - 192.168.255.255 | 192.168.0.0/16 | 65K | Home/Small office |
Pentest Tip
10.x.x.x often means a large corporate network with many subnets to explore. 192.168.x.x is typically a smaller, flatter network.
MAC Addresses (Layer 2)
A Media Access Control (MAC) address is a hardware identifier burned into the network interface card (NIC). It is used for communication within the same local network segment (LAN).
Useful Commands
ip link show # Linux
ipconfig /all # Windows
ifconfig # macOSarp -a # All platforms
ip neigh show # Linux modernip link set dev eth0 down
ip link set dev eth0 address XX:XX:XX:XX:XX:XX
ip link set dev eth0 upHacker Note
ARP: The Bridge Between L2 and L3
Address Resolution Protocol (ARP) maps IP addresses to MAC addresses. When a device wants to communicate with another on the LAN, it asks: "Who has IP X.X.X.X? Tell me your MAC."
ARP Spoofing Attack (Man-in-the-Middle)
- Attacker sends fake ARP replies:
"192.168.1.1 is at AA:BB:CC:DD:EE:FF"(attacker's MAC) - Victim's ARP cache is poisoned - traffic intended for the gateway goes to the attacker
- Attacker forwards traffic to the real gateway (invisible interception)
- All victim traffic can now be sniffed, modified, or blocked
arpspoof -i eth0 -t 192.168.1.100 192.168.1.1
Related Tools
MAC Analyzer
Look up vendor information from OUI.
Wireshark Cheatsheet
Capture and analyze network traffic.
Evidence Collection
A layer-2 claim is only as good as the table you read and the moment you read it. Keep:
The neighbour table as read:
The full ip neigh show or arp -a output from the host you made the claim from - gateway, target and any duplicate MAC for the same IP still visible in the same screen.
The switch view:
The show mac address-table excerpt for the ports in scope, with the port each MAC was learned on, so a single MAC appearing on two ports is provable rather than inferred.
The capture and its hash:
The pcap or pcapng holding the ARP request and reply pair, its sha256sum, and the first and last frame timestamps so the window can be replayed.
Vantage point: Which subnet or VLAN the capture was taken from, and whether the port was a trunk or a mirror. A layer-2 observation from the wrong segment is worth nothing.
False Positive Identification
- Static entries and legitimate duplication: A permanent ARP entry does not respond to a forged reply, and teamed NICs, cloned VMs and hypervisor vNICs legitimately share a MAC address. Neither is evidence of poisoning.
- Traffic that never crossed the segment: Routed layer-3 traffic never appears in the broadcast domain you are sitting in. An empty capture from a host that only ever talked off-subnet is a vantage problem, not a negative finding.
- Lab-only configuration: Permissive proxy ARP, MAC filtering or a flat management VLAN in a lab environment says nothing about production, and MAC filtering is not a control anyone should be credited for.
Remediation & Defense
Layer-2 attacks are stopped on the switch and by segmenting the plane, not on the endpoint.
Device-native controls
- • Dynamic ARP inspection on every access port, paired with DHCP snooping so the binding table is authoritative.
- • Port security with a sticky-MAC limit and violation action, plus storm control and BPDU guard on user-facing ports.
- • Disable unused ports and put access ports in access mode explicitly; do not let a user port negotiate a trunk.
Segmentation
- • Keep management, data and user planes on separate VLANs with layer-3 ACLs between them, so poisoning one segment does not reach the next.
- • Use private VLANs or port isolation where hosts on the same segment have no reason to talk to each other.
- • Treat MAC filtering, static ARP and switch port stickiness as hygiene, never as an authorisation control.