A network allows computers to communicate.

Examples:

• Browsing websites
• Accessing cloud services
• Sending email
• Accessing file shares
• Accessing databases
• Authenticating to Active Directory
• Remote administration
• Communicating with Command & Control servers

---

Network Adapters

A computer requires one or more network adapters to communicate.

Examples:

• Ethernet adapters
• Wireless adapters
• Virtual adapters
• VPN adapters

A system may contain multiple adapters simultaneously.

Examples:

These adapters can be viewed using:

Get-NetAdapter

Example:

Name                      InterfaceDescription
----                      --------------------
Ethernet                  Intel Ethernet Adapter
Wi-Fi                     Intel Wireless Adapter
vEthernet (Default)       Hyper-V Virtual Adapter

---

IP Addresses

Computers require addresses to communicate.

These addresses are known as:

IP Addresses

Examples:

192.168.1.10
10.10.10.50
172.16.1.100

An IP address identifies a system on a network.

Conceptually:

Without an address, communication cannot occur reliably.

---

Public vs Private Addresses

Private addresses are commonly used inside internal networks.

Examples:

10.0.0.0/8
172.16.0.0/12
192.168.0.0/16

Public addresses are routable across the Internet.

Examples:

8.8.8.8
1.1.1.1

---

Hostname

Systems often possess a hostname.

Example:

WS01
DC01
FILESERVER

Humans commonly use hostnames because they are easier to remember than IP addresses.

View hostname:

hostname

---

DNS

Humans prefer names.

Computers prefer IP addresses.

DNS bridges this gap.

Example:

google.com

becomes:

142.250.x.x

DNS is often described as:

The phonebook of the Internet.

Without DNS, users would need to remember IP addresses.

View DNS configuration:

Get-DnsClientServerAddress

Example:

8.8.8.8
1.1.1.1

---

Hosts File

Windows supports local hostname overrides through:

C:\Windows\System32\drivers\etc\hosts

Example:

192.168.1.10 fileserver
192.168.1.20 dc01

This allows local name resolution without DNS.

Operators frequently inspect this file during investigations.

Questions:

• Has traffic been redirected?
• Has a malicious entry been added?
• Is local resolution behaving unexpectedly?

---

Routing

Knowing an address is not enough.

A system must also know:

Where should traffic be sent?

Routing provides this answer.

Example:

Laptop
   │
   ▼
Router
   │
   ▼
Internet

Routes determine the path traffic follows.

Without routing:

• External systems cannot be reached
• Network communication fails
• Applications stop functioning

---

Default Gateway

Most systems contain a route known as the:

Default Gateway

This is commonly:

192.168.1.1

or similar.

When a destination is unknown, traffic is sent to the gateway for forwarding.

The gateway acts as a network exit point.

---

Ports

Many services can run on the same system simultaneously.

Ports help Windows determine which application should receive incoming traffic.

Examples:

Conceptually:

IP Address
↓
Port
↓
Application

Example:

192.168.1.10:443

---

Connections

Processes create network connections.

Example:

chrome.exe
	↓
HTTPS Connection
	↓
google.com

Networking activity is ultimately performed by processes.

This is an important concept for investigations.

---

Viewing Connections

PowerShell:

Get-NetTCPConnection

Command Prompt:

netstat -ano

Example:

TCP    192.168.1.10:49752
       142.250.x.x:443

---

Connectivity Testing

Common questions:

• Is the host reachable?
• Is DNS working?
• Is routing functioning?
• Is the service responding?

Common tools include:

These tools are commonly used during administration and investigations.

---

Windows Firewall

Windows includes a built-in firewall.

The firewall controls which network traffic is permitted or blocked.

Conceptually:

Network Traffic
	↓
Firewall
	↓
Allow or Block

Firewall rules play a significant role in:

• Security
• Troubleshooting
• Incident Response

---

Operator Perspective

When approaching an unfamiliar Windows system, Operators typically ask:

Identity

• What IP addresses exist?
• What hostnames exist?
• How many adapters exist?

DNS

• What DNS servers are configured?
• Does name resolution work?
• Does the hosts file contain unusual entries?

Routing

• What routes exist?
• What is the default gateway?

Connectivity

• Can external systems be reached?
• Can internal systems be reached?

Security

• What ports are listening?
• What processes own those ports?
• What destinations are being contacted?
• What connections appear unusual?

Many investigations begin with network questions.

---

Key Takeaways

• Networking enables communication between systems.
• Network adapters provide connectivity.
• IP addresses identify systems.
• DNS converts names into IP addresses.
• The hosts file provides local hostname resolution.
• Routing determines where traffic is sent.
• The default gateway acts as a network exit point.
• Ports allow multiple services to communicate simultaneously.
• Network activity is ultimately performed by processes.
• Understanding networking is essential for both offensive and defensive operations.

The next lesson explores Services and how Windows applications operate in the background.