Home > Network Pentesting

TCP/IP Fundamentals

TCP/IP is the core communication model used in all modern networks. It defines how data is created, transmitted, routed, and delivered across devices. Understanding TCP/IP is essential for network pentesting because every scan, connection, exploit, and packet relies on these protocols.

TCP/IP Model Overview

The TCP/IP model has four layers. Each layer handles specific tasks during communication. Together, they move data from one device to another reliably and efficiently.

Application Layer

This layer contains protocols that applications use for communication. It includes HTTP, DNS, SMTP, SSH, and many others. These protocols define how data is formatted and exchanged at the software level.

Pentesters analyze these protocols for misconfigurations, outdated services, and insecure settings.

Transport Layer

The transport layer controls how data is delivered. It uses two main protocols:

  • TCP: reliable, connection-oriented communication

  • UDP: fast, connectionless communication

TCP ensures data arrives correctly using sequence numbers, acknowledgments, retransmissions, and flow control. UDP sends data without checking delivery, making it useful for DNS, VoIP, and streaming.

Understanding TCP and UDP behavior helps pentesters interpret scan results and packet responses.

Internet Layer

This layer handles logical addressing and routing. It includes the Internet Protocol (IP), which defines how packets move across networks. Routers use IP addresses to forward traffic toward its destination.

Pentesters use this layer to understand routing paths, subnets, and reachable services.

Network Access Layer

This layer deals with physical addressing, frames, and hardware-level communication. Ethernet, Wi-Fi, ARP, and MAC addresses are part of this layer.

Pentesters analyze ARP behavior, MAC spoofing, and LAN-level attacks at this layer.

IP Addressing

IP addresses identify devices on a network. There are two main versions:

  • IPv4: 32-bit format (e.g., 192.168.1.10)

  • IPv6: 128-bit format (longer, newer, more scalable)

IPv4 uses subnetting to divide networks into smaller segments. Pentesters calculate subnets to understand reachable hosts and scan ranges.

Private IP ranges include:

  • 10.0.0.0/8

  • 172.16.0.0/12

  • 192.168.0.0/16

These ranges appear in internal pentests.

Ports and Protocols

Ports identify services running on a device. TCP and UDP ports range from 0 to 65535.

Common ports include:

  • 22: SSH

  • 53: DNS

  • 80: HTTP

  • 443: HTTPS

  • 3306: MySQL

Pentesters scan ports to find open services and potential attack vectors.

TCP Handshake

The TCP three-way handshake establishes a reliable connection:

  1. Client sends SYN

  2. Server responds with SYN-ACK

  3. Client sends ACK

Pentesters use handshake analysis to detect service behavior, identify firewall filtering, and confirm live hosts.

If the server sends RST instead of SYN-ACK, the port is closed but reachable. If there is no response, a firewall may be blocking traffic.

Understanding these responses is crucial for interpreting Nmap results.

TCP Flags

TCP communication uses flags to control connection state. Important flags include:

  • SYN: initiate connection

  • ACK: acknowledge packets

  • FIN: close connection

  • RST: reset connection

  • PSH: push data

  • URG: urgent data

Pentesters examine flags during packet analysis to detect firewalls, IDS rules, and unusual traffic.

Packet Structure

TCP/IP communication is built from packets. Each packet contains:

  • Headers for routing and delivery

  • Payload containing application data

Pentesters inspect packet headers to understand how systems communicate and to detect anomalies.

Why TCP/IP Matters in Pentesting

Every pentesting action interacts with TCP/IP. This includes scanning networks, fingerprinting devices, analyzing responses, exploiting services, and reviewing packets. Strong knowledge of TCP/IP allows pentesters to understand why a system behaves a certain way and how to manipulate traffic for deeper testing.

Intel Dump

  • TCP/IP has four layers: application, transport, internet, network access

  • TCP provides reliable connections, UDP provides fast connectionless traffic

  • IP addresses identify hosts; subnetting defines network structure

  • Ports represent services; scanning reveals attack paths

  • TCP handshake and flags help interpret host responses

  • Packet analysis reveals protocol behavior and anomalies

  • Understanding TCP/IP is essential for accurate and effective pentesting

HOME LEARN COMMUNITY DASHBOARD