A single computer can store data, execute programs, and perform calculations.

A network allows computers to communicate.

Modern environments depend heavily on networking.

Examples:

Browsing websites
Accessing cloud services
Sending email
Connecting to databases
Accessing file shares
Authenticating to Active Directory
Communicating with Command & Control servers

What Is Networking?

Networking is the exchange of information between systems.

Example:

Laptop
   │
   ▼
Router
   │
   ▼
Internet
   │
   ▼
Website

Data travels through networks to reach its destination.

Examples:

Your browser -> Google
Your workstation -> File server
Your workstation -> Domain Controller
Malware -> C2 Server

Network Interface Cards (NICs)

A computer requires one or more network interfaces to communicate on a network.

These interfaces are commonly referred to as:

Network Interface Card (NIC)

Examples:

Ethernet adapters
Wireless adapters
Virtual adapters
VPN adapters

A system may contain multiple NICs simultaneously.

Examples:

Type	Example
Physical	Ethernet
Physical	Wi-Fi
Virtual	Hyper-V Adapter
Virtual	VPN Adapter

They can be observed with the command:

ip a

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet 10.255.255.254/32 brd 10.255.255.254 scope global lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1280 qdisc mq state UP group default qlen 1000
    link/ether 00:15:5d:f1:b9:f2 brd ff:ff:ff:ff:ff:ff
    inet 172.26.138.216/20 brd 172.26.143.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::215:5dff:fef1:b9f2/64 scope link
       valid_lft forever preferred_lft forever

Notice the special interface:

lo

This is the loopback interface and is used for communication with the local system itself.

Every Linux system contains a loopback interface. It is essentially the interface for:

127.0.0.1 / localhost

IP Addresses

Computers require addresses to communicate.

These addresses are known as:

IP Addresses

Examples:

192.168.1.10
10.10.10.50
172.16.1.100

An IP address identifies a system on a network.

Conceptually:

Real World	Networking
Home Address	IP Address
Resident	Device
Postal System	Network

Without an address, communication cannot occur reliably.

Public vs Private Addresses

Private addresses are commonly used inside internal networks.

Examples:

10.0.0.0/8
172.16.0.0/12
192.168.0.0/16

Public addresses are routable across the Internet.

Examples:

8.8.8.8
1.1.1.1

DNS

Humans prefer names.

Computers prefer IP addresses.

DNS bridges this gap.

Example:

google.com

becomes:

142.250.x.x

DNS is often described as:

The phonebook of the Internet.

Without DNS, users would need to remember IP addresses.

Linux systems commonly store DNS resolver configuration in:

/etc/resolv.conf

Example:

nameserver 8.8.8.8
nameserver 1.1.1.1

Hosts File

The exact resolution order depends on system configuration (because /etc/nsswitch.conf ultimately controls this), but /etc/hosts is commonly consulted before DNS.

/etc/hosts

Example:

192.168.1.10 fileserver
192.168.1.20 dc01

This allows local hostname overrides.

Operators frequently inspect this file during investigations.

Questions:

Has traffic been redirected?
Has a malicious entry been added?
Is local resolution behaving unexpectedly?

Routing

Knowing an address is not enough.

A system must also know:

Where should traffic be sent?

Routing provides this answer.

Example:

Laptop
   │
   ▼
Router
   │
   ▼
Internet

Routes determine the path traffic follows.

Without routing:

External systems cannot be reached
Network communication fails
Applications stop functioning

Default Gateway

Most systems contain a route known as the:

Default Gateway

This is typically:

192.168.1.1

or similar.

When a destination is unknown, traffic is sent to the gateway for forwarding.

The gateway acts as a network exit point.

Connectivity Testing

Common questions:

Is the host reachable?
Is DNS working?
Is routing functioning?
Is the service responding?

Common tools include:

Tool	Purpose
ping	Reachability
traceroute	Path discovery
curl	Application testing
dig	DNS queries
nslookup	DNS queries

These tools are commonly used during administration and investigations.

Operator Perspective

When approaching an unfamiliar Linux system, Operators commonly ask:

Identity

What IP addresses exist?
What hostnames exist?
How many NICs are there?

DNS

What DNS servers are configured?
Does name resolution work?
Does /etc/hosts contain unusual entries?

Routing

What routes exist?
What is the default gateway?

Connectivity

Can external systems be reached?
Can internal systems be reached?

Security

What systems communicate?
What destinations appear unusual?
What external services are contacted?

Many investigations begin with network questions.

Key Takeaways

Networking enables communication between systems.
NICs provide network connectivity.
IP addresses identify systems.
DNS converts names into IP addresses.
/etc/hosts provides local hostname resolution.
Routing determines where traffic is sent.
The default gateway acts as a network exit point.
Connectivity testing is a core operational skill.
Networking underpins nearly every modern technology.
Understanding networking is essential for both defensive and offensive operations.

The next lesson explores services and how Linux applications operate in the background.