Operator On The Wire
Waitlist
← Back to Knowledge Base
OOTW / Chapter I - Foundation / 03. Networking / 04. Route

Route

So far we have discussed:

  • OSI Model
  • TCP/IP Model
  • Network Segmentation
  • DMZs
  • Isolated Networks

We now understand how networks are organized.

The next question is:

How does a device actually connect to a network?

And:

How does traffic know where to go?

The answer lies in:

  • Network Interfaces
  • Routing

Physical Interfaces

Examples:

Ethernet Port
Wi-Fi Adapter
Fiber Adapter

Example:

Laptop
    │
    │
Ethernet Cable
    │
    │
Switch

The Ethernet port is the network interface.

Virtual Interfaces

Modern systems frequently use virtual interfaces.

Examples:

VPN Interfaces
Docker Networks
Hyper-V Adapters
VMware Adapters
TUN/TAP Devices
Loopback Interfaces

Example:

OpenVPN

creates a virtual interface.

tun0

on Linux.

Every Interface Has An Address

Interfaces typically receive an IP address.

Example:

Ethernet Adapter

192.168.1.10

This address identifies the interface on the network.

Not the computer.

The interface.

Multiple Interfaces

A single machine may have multiple interfaces.

Example:

Laptop

Ethernet
192.168.1.10

Wi-Fi
10.10.10.15

VPN
172.16.50.5

Visualized:

          Ethernet
         192.168.1.10
               │

Laptop ──────────────

               │
         Wi-Fi
         10.10.10.15

               │
         VPN
         172.16.50.5

One machine.

Multiple networks.

Viewing Interfaces

Windows:

ipconfig

or

Get-NetIPAddress

Linux:

ip addr

or

ifconfig

Example:

eth0
192.168.1.10

wlan0
192.168.1.20

lo
127.0.0.1

The Loopback Interface

Every operating system contains a special interface.

Loopback

Windows:

127.0.0.1

Linux:

127.0.0.1

Hostname:

localhost

Traffic sent here never leaves the machine.

Example:

Browser
    │
127.0.0.1
    │
Web Server

Entirely local.

This is typically used for deploying tools locally (we'll do that a lot).

In offensive operations however, they become targets, as often times custom tooling may be subject to misconfigurations.

What is Routing?

Suppose:

PC
192.168.1.10

wants:

8.8.8.8

The PC cannot reach Google directly.

Instead:

PC
 │
 ▼
Router
 │
 ▼
Internet
 │
 ▼
Google

The router forwards traffic.

The Default Gateway

Every system typically has a default gateway.

Example:

IP Address:
192.168.1.10

Gateway:
192.168.1.1

Visualized:

192.168.1.10
        │
        ▼
192.168.1.1
        │
        ▼
Internet

When the destination is unknown:

Send to gateway.

Routing Tables

Every operating system maintains a routing table.

Think of it as:

A map.

Example:

Destination      Next Hop

192.168.1.0/24   Local
10.10.10.0/24    VPN
0.0.0.0/0        Gateway

The OS consults this table before sending traffic.

Viewing Routes

Windows:

route print

Linux:

ip route

Example:

default via 192.168.1.1

192.168.1.0/24 dev eth0

10.10.10.0/24 dev tun0

Routing And Security

Many security controls depend on routing.

Examples:

Firewalls
VPNs
Network Segmentation
DMZs
Proxy Servers

These technologies often make decisions based on:

Source Network
Destination Network

Operator Notes

Network interfaces are how systems connect to networks.

Routing determines how traffic moves between networks.

Whenever you see:

ipconfig
ip addr
route print
ip route

you are looking at:

  • Interfaces
  • Addresses
  • Routes

Understanding these three things often explains:

  • Why communication works
  • Why communication fails
  • Which networks are reachable
  • Which networks may become reachable after compromise

For operators, routing tables are often one of the first places to look after gaining access to a system because they reveal where the machine can communicate and what opportunities may exist deeper in the environment.