Networking

Packet Analysis Quiz

  1. Which OSI layer does a Router primarily operate at when making forwarding decisions?

    1. Layer 2 (Data Link)

    2. Layer 3 (Network)

    3. Layer 4 (Transport)

    4. Layer 7 (Application)

  2. In a TCP three-way handshake, what is the correct sequence of flags sent?

    1. SYN, SYN-ACK, ACK

    2. SYN, ACK, SYN-ACK

    3. PSH, ACK, FIN

    4. RST, SYN, ACK

  3. What does a “Time to Live” (TTL) value of 0 in an IPv4 header signify?

    1. The packet should be prioritized.

    2. The packet has reached its destination.

    3. The packet should be fragmented.

    4. The packet must be discarded and an ICMP Time Exceeded message sent.

  4. Which protocol uses a 4-step termination process (FIN, ACK, FIN, ACK)?

    1. UDP

    2. ICMP

    3. TCP

    4. ARP

  5. When analyzing a packet capture, you see an ARP Request. What is the destination MAC?

    1. 00:00:00:00:00:00

    2. FF:FF:FF:FF:FF:FF

    3. The MAC address of the default gateway.

    4. 127.0.0.1

  6. Which field in the UDP header provides a way to verify data integrity?

    1. Sequence Number

    2. Window Size

    3. Acknowledgement Number

    4. Checksum

  7. A TCP “Reset” (RST) flag typically indicates what?

    1. The connection is being closed gracefully.

    2. The receiver is ready for more data.

    3. An immediate abortion of the connection.

    4. The start of a new session.

  8. Which port number is commonly associated with encrypted HTTPS traffic?

    1. 80

    2. 21

    3. 53

    4. 443

  9. In Wireshark, what filter shows traffic for a specific IP regardless of direction?

    1. ip.addr == 192.168.1.5

    2. tcp.port == 192.168.1.5

    3. eth.dst == 192.168.1.5

    4. ip.src != 192.168.1.5

  10. What is the primary difference between a Hub and a Switch?

    1. Hubs use IP addresses; Switches use MAC addresses.

    2. Hubs broadcast all traffic; Switches forward to specific ports.

    3. Switches are slower than hubs.

    4. Hubs operate at the Application layer.

Answer key with explanations

1. Layer 3 Answer: B Routers utilize IP addresses (Layer 3) to determine the logical path through a network.

2. TCP Handshake Answer: A The SYN (Synchronize) starts the request, SYN-ACK acknowledges it and requests synchronization back, and the final ACK (Acknowledge) confirms the setup.

3. Time to Live Answer: D TTL prevents infinite loops. If it hits 0, the router drops the packet and notifies the sender via ICMP.

4. Termination Answer: C TCP ensures both sides have finished sending data. Each side must independently send a FIN and receive an ACK.

5. ARP Addressing Answer: B Because the sender doesn’t know the destination MAC, it uses the broadcast address (FF:FF:FF:FF:FF:FF) so all devices on the segment hear the request.

6. UDP Integrity Answer: D The Checksum is the only field in the UDP header used to verify that the bits haven’t been flipped during transit.

7. The RST Flag Answer: C An RST (Reset) is an ungraceful termination. It is sent when a host receives a packet for a connection it doesn’t recognize or to reject a connection.

8. Common Ports Answer: D Port 443 is the standard for Secure HTTP (HTTPS), while Port 80 is for standard HTTP.

9. Wireshark Syntax Answer: A The ip.addr display filter is a shorthand that matches the specified IP in either the source or destination fields.

10. Hubs vs. Switches Answer: B Hubs repeat data to every port (Collision Domain), while Switches maintain a MAC address table to forward data only to the relevant recipient.

SIEM Tools

What is a SIEM?

SIEM (pronounced “sim”) stands for Security Information and Event Management.

How It Works

A SIEM follows a simple four-step process to keep the network safe:

  1. Collection: It gathers “logs” (digital footprints) from every device.

  2. Normalization: It translates different data formats into one “language.”

  3. Correlation: It looks for patterns (e.g., someone logging in from New York and Paris at the same time).

  4. Alerting: It sends an emergency notification to the security team.

Key SIEM Tools

In the “real world,” companies use these popular platforms:

  • Splunk: The most powerful (and expensive) tool for big data.

  • Microsoft Sentinel: A cloud-based tool that uses AI to find threats.

  • LogRhythm: Great for helping companies follow security laws.

Comparison: SIEM vs. SOAR

SIEM vs. SOAR

Term

Simple Definition

SIEM

The “Fire Alarm” that detects the smoke.

SOAR

The “Firefighter” that automatically puts out the fire.

Summary

Without a SIEM, hackers could hide for months. With it, we can catch them in seconds by connecting the dots between small, suspicious events.

Note

If you want to practice, try looking up Wazuh. It’s an open-source SIEM that you can use for free.

System Hardening

Abstract

System hardening is the process of eliminating as many security risks as possible by removing unnecessary programs, functions, and access. This technical guide moves beyond basic checklists to explore the fundamental mechanics of an enterprise-grade secure environment.

Memory and Process Protection

At the lowest level, hardening seeks to prevent an attacker from executing arbitrary code in system memory.

Address Space Layout Randomization (ASLR)

ASLR is a technique that involves randomly arranging the positions of key data areas of a program, including the base of the executable and the positions of the stack, heap, and libraries. By making memory addresses unpredictable, an attacker cannot easily jump to a specific exploited function in memory.

No-Execute (NX) / Data Execution Prevention (DEP)

This hardware and software-based technology marks certain sectors of memory as non-executable. This ensures that even if an attacker successfully injects code into a “data” part of memory (like a user input buffer), the CPU will refuse to execute it.

Kernel Hardening and Runtime Integrity

The kernel is the most privileged part of the OS. Hardening the kernel reduces the “Blast Radius” of a local exploit.

Restricting Kernel Module Loading

Many rootkits function by loading a malicious kernel module. Hardening policy should involve setting kernel.modules_disabled = 1 via sysctl after the system has finished its boot cycle. This prevents any further changes to the running kernel.

Disabling Legacy Protocols

Modern systems often ship with legacy support for protocols like SMBv1 or AppleTalk. These protocols lack modern encryption and are frequent targets for worm-style exploits (e.g., EternalBlue).

The Mandatory Access Control (MAC) Framework

Standard Linux or Windows permissions (DAC) allow the owner of a file to change its security. In a hardened environment, this is insufficient.

SELinux and AppArmor

These systems enforce MAC, where the system security policy is defined by the administrator and cannot be overridden by users or hijacked processes. Even if a web server process is compromised, a MAC policy can prevent that process from reading the /home directory or initiating outgoing network connections.

Filesystem and Mount Hardening

Hardening the way disks are mounted can stop many automated exploit scripts.

  • nosuid: Prevents “Set User ID” bits from being honored, stopping users from gaining root privileges via an executable on that partition.

  • nodev: Prevents the interpretation of character or block special devices on the filesystem.

  • noexec: Prevents binaries from being executed on specific partitions (e.g., /tmp or /var), which are common targets for dropping malware.

Quiz

1: ASLR and DEP Architecture

Why is the combination of ASLR (Address Space Layout Randomization) and DEP (Data Execution Prevention) more effective than either one alone?

A. Because DEP prevents code execution in data segments, while ASLR makes it difficult for an attacker to locate the executable code they wish to target.

  1. Because they both encrypt the hard drive at the same time.

C. Because they increase the clock speed of the processor to process security threats faster.

  1. Because they replace the need for a firewall.

2: Kernel Network Tuning

In a hardened Linux environment, what is the primary security benefit of setting net.ipv4.conf.all.accept_source_route = 0?

  1. It prevents the system from receiving any incoming web traffic.

  2. It enables the use of Telnet for remote administration.

  3. It speeds up the local area network.

D. It stops an attacker from using “Source Routing” to bypass firewalls or reach internal IPs by specifying the packet’s path.

3: Mandatory Access Control (MAC)

Which of the following best describes the “Mandatory” aspect of MAC systems like SELinux?

  1. It is mandatory for the user to change their password every 30 days.

B. The security policy is centrally controlled and cannot be modified by the owner of an object (file/process).

  1. It is mandatory for the system to have an internet connection.

  2. The hardware must have a TPM chip to function.

4: Partition Hardening

If you mount the /tmp directory with the noexec option, what is the immediate security result?

  1. Users can no longer save files to the /tmp directory.

  2. The system will delete all files in /tmp every hour.

C. Any script or binary downloaded and placed in /tmp cannot be executed, stopping many automated attacks.

  1. It encrypts the /tmp partition using AES-256.

Answer key with explanations

Answer to Question 1

Correct Answer: A

Explanation: ASLR and DEP provide “Defense in Depth” for memory. If an attacker knows where a function is (No ASLR), DEP stops them from running their own code there. If they can run code (No DEP), ASLR stops them from finding the location to inject it.

Answer to Question 2

Correct Answer: D

Explanation: Source routing allows a sender to “map” the path a packet takes. Attackers use this to trick a router into thinking a packet is coming from a trusted internal source when it actually originated from the outside.

Answer to Question 3

Correct Answer: B

Explanation: In Discretionary Access Control (DAC), if I own a file, I can chmod it to 777 (public). In Mandatory Access Control (MAC), the OS checks the policy first; even if I try to make it public, the OS will block access if it violates the hardening policy.

Answer to Question 4

Correct Answer: C

Explanation: Many exploits download a malicious script to /tmp because it is globally writable. By using the noexec mount flag, the OS kernel will refuse to run any file located in that directory, regardless of permissions.

Network Security Assessment

Abstract

Network Security Assessment is the process of evaluating a network’s security posture by identifying vulnerabilities, misconfigurations, and potential attack paths. It combines scanning, enumeration, analysis, and reporting to determine how easily an attacker could compromise systems or move laterally within an environment.

Unlike passive monitoring, security assessment is an active process that simulates attacker behavior in a controlled and authorized manner.

Asset Discovery and Enumeration

The first step in any network security assessment is identifying what exists on the network.

This includes discovering:

  • Live hosts

  • Open ports

  • Running services

  • Operating systems

  • Exposed applications

Tools like Nmap are commonly used to map the attack surface and identify entry points.

Port Scanning and Service Identification

Port scanning reveals which services are exposed to the network.

Open ports may indicate:

  • Unnecessary services running

  • Misconfigured applications

  • Outdated or vulnerable software

Service identification goes further by determining the exact version of a service, which helps map it to known vulnerabilities (CVEs).

Vulnerability Assessment

Once services are identified, the next step is vulnerability analysis.

This involves:

  • Comparing service versions against vulnerability databases

  • Running automated vulnerability scanners

  • Identifying weak configurations (e.g., anonymous FTP access)

  • Checking for missing patches

Common tools include Nessus, OpenVAS, and Qualys.

Exploitation and Validation

In a controlled assessment, vulnerabilities are validated through safe exploitation techniques.

This step confirms whether a vulnerability is:

  • Actually exploitable

  • Impactful in a real-world scenario

  • Limited by existing security controls

The goal is not destruction, but verification of risk.

Lateral Movement Analysis

After initial access is simulated or achieved, analysts evaluate how far an attacker could move within the network.

This includes testing:

  • Credential reuse

  • Privilege escalation paths

  • Trust relationships between systems

  • Internal segmentation weaknesses

A poorly segmented network allows attackers to move freely between critical systems.

Network Defense Evaluation

A security assessment also examines defensive controls such as:

  • Firewalls and ACLs

  • Intrusion Detection/Prevention Systems (IDS/IPS)

  • Network segmentation (VLANs, subnets)

  • Logging and monitoring coverage

Weak or misconfigured controls can significantly increase attack exposure.

Wireless Security Assessment

Wireless networks are often overlooked but provide a common entry point.

Key checks include:

  • Encryption type (WPA2 vs WPA3)

  • Weak or default passwords

  • Rogue access points

  • Signal leakage outside physical boundaries

Poor wireless security can bypass physical perimeter defenses entirely.

Reporting and Risk Scoring

The final phase of a network security assessment is documentation.

Reports typically include:

  • Executive summary

  • Technical findings

  • Risk severity ratings (Critical, High, Medium, Low)

  • Proof of concept evidence

  • Remediation recommendations

Clear reporting ensures that technical findings translate into actionable security improvements.

Quiz

1: Asset Discovery

What is the primary goal of the asset discovery phase in a network security assessment?

  1. To identify all live hosts, services, and exposed attack surfaces

  2. To shut down unused network devices immediately

  3. To encrypt all network traffic

  4. To patch all systems automatically

2: Vulnerability Assessment

What is the purpose of comparing service versions to CVE databases?

  1. To assign IP addresses

  2. To block all incoming traffic

  3. To identify known security vulnerabilities in running services

  4. To increase network speed

3: Lateral Movement

What does “lateral movement” refer to in a network security context?

  1. Encrypting internal traffic

  2. Moving data between cloud providers

  3. Installing antivirus software

  4. Expanding access from one compromised system to others

4: Network Defense Evaluation

Which of the following is an example of a network defense control?

  1. CPU overclocking

  2. Firewalls and intrusion detection systems

  3. File compression

  4. Disk defragmentation

Answer key with explanations

Answer to Question 1

Correct Answer: A

Explanation: Asset discovery identifies all devices, services, and systems present in the network to understand the attack surface.

Answer to Question 2

Correct Answer: C

Explanation: Mapping service versions to CVEs allows analysts to determine whether known vulnerabilities exist in the environment.

Answer to Question 3

Correct Answer: D

Explanation: Lateral movement refers to an attacker expanding access across systems after gaining initial entry.

Answer to Question 4

Correct Answer: B

Explanation: Firewalls and IDS/IPS systems are core components of network defense, controlling and monitoring traffic flow.

Firewalls and Virtual Private Networks

Abstract

Firewalls and Virtual Private Networks (VPNs) are the dual pillars of network perimeter security. While firewalls act as gatekeepers, controlling what traffic enters or leaves a network, VPNs provide secure, encrypted tunnels for data to travel across untrusted networks like the internet.

Together, these technologies ensure that network resources are protected from unauthorized access and that communications remain private and untampered.

Firewall Fundamentals

A firewall is a security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules.

The primary types of firewalls include:

  • Packet Filtering: Inspects packets and blocks them based on IP addresses, protocols, or ports.

  • Stateful Inspection: Tracks the state of active connections to determine which network packets are allowed through.

  • Next-Generation Firewalls (NGFW): Adds deep packet inspection (DPI), intrusion prevention (IPS), and application-level filtering.

Firewalls create a “barrier” between a trusted internal network and untrusted external networks.

VPN Concepts and Encryption

A Virtual Private Network (VPN) extends a private network across a public network. It allows users to send and receive data as if their computing devices were directly connected to the private network.

Core VPN components include:

  • Encapsulation: Wrapping a packet within another packet for transport.

  • Encryption: Scrambling data so it cannot be read without the correct key.

  • Tunneling: Creating a logical path through which encrypted data flows.

Common protocols used are IPsec (Internet Protocol Security) and OpenVPN (SSL/TLS-based).

Site-to-Site vs. Remote Access VPNs

VPNs are generally deployed in two main configurations:

  • Remote Access VPN: Allows individual users to connect to a centralized organizational network (e.g., employees working from home).

  • Site-to-Site VPN: Connects entire networks to each other (e.g., connecting a branch office to a corporate headquarters).

Site-to-site VPNs often use hardware-based VPN gateways to maintain a permanent, always-on connection.

Intrusion Prevention and Deep Packet Inspection

Modern firewalls do more than just look at headers; they perform Deep Packet Inspection (DPI).

This allows the firewall to:

  • Identify and block specific applications (e.g., blocking BitTorrent while allowing HTTPS).

  • Detect malware signatures within the data payload.

  • Prevent SQL injection or Cross-Site Scripting (XSS) attacks.

This transformation from a simple gatekeeper to an intelligent security appliance is the hallmark of a Next-Generation Firewall.

Access Control Lists (ACLs)

Firewalls use Access Control Lists to define traffic “allow” or “deny” logic. An ACL entry typically consists of:

  • Source/Destination IP: Who is talking to whom.

  • Protocol: TCP, UDP, or ICMP.

  • Port Number: Which service is being accessed (e.g., Port 443 for HTTPS).

  • Action: Permit or Deny.

Rules are usually processed from top to bottom, with an “Implicit Deny” at the end—meaning anything not explicitly allowed is blocked.

VPN Security and Authentication

The security of a VPN is only as strong as its authentication method. Because a VPN grants access to internal resources, it is a high-value target for attackers.

Critical security measures include:

  • Multi-Factor Authentication (MFA): Requiring a code in addition to a password.

  • Endpoint Compliance: Ensuring the connecting device has up-to-date antivirus before allowing it on the network.

  • Split Tunneling: Deciding whether all traffic goes through the VPN or only traffic destined for the office.

Network Segmentation and DMZs

Firewalls enable network segmentation by creating a Demilitarized Zone (DMZ).

A DMZ is a physical or logical subnetwork that contains and exposes an organization’s external-facing services (like web servers) to the internet. It adds an extra layer of security; even if a server in the DMZ is compromised, the internal network remains protected behind a second firewall layer.

Quiz

1: Firewall Functionality

What is the primary difference between a stateful firewall and a simple packet filter?

  1. Stateful firewalls are hardware-based only

  2. Stateful firewalls track the context and state of active connections

  3. Packet filters encrypt data, while stateful firewalls do not

  4. Packet filters are used only for VPNs

2: VPN Encapsulation

In the context of a VPN, what does “tunneling” refer to?

  1. Wrapping a private network packet inside a public network packet

  2. Physically burying network cables underground

  3. Deleting data to save bandwidth

  4. Increasing the clock speed of a router

3: DMZ Purpose

Why would an organization place a web server in a DMZ?

  1. To make the server run faster

  2. To hide the server from the internet

  3. To avoid paying for a firewall license

  4. To isolate external-facing services from the sensitive internal network

4: Access Control

What does the “Implicit Deny” rule at the end of a firewall ACL ensure?

  1. That all traffic is allowed by default

  2. That any traffic not explicitly permitted is blocked

  3. That the firewall will automatically update itself

  4. That users must change their passwords every 30 days

Answer key with explanations

Answer to Question 1

Correct Answer: B

Explanation: Stateful inspection monitors the state of connections (e.g., recognizing that an incoming packet is a response to an authorized outgoing request), whereas simple packet filtering looks at packets in isolation.

Answer to Question 2

Correct Answer: A

Explanation: Tunneling is the process of encapsulating a packet within another protocol to transport it securely across a transit network.

Answer to Question 3

Correct Answer: D

Explanation: A DMZ provides a buffer zone. If the web server is hacked, the attacker is still separated from the internal database and user workstations by another firewall.

Answer to Question 4

Correct Answer: B

Explanation: Implicit Deny is a fundamental security principle. If a traffic type is not specifically defined as “Permit,” the firewall defaults to “Deny” to prevent unauthorized access.