Deep dive: TCP, subnets, and Active Directory — the fundamentals a penetration tester must master

Further on I will switch a little bit focus I need to learn more about networking

Short summary:
A comprehensive, defensive-minded deep dive into TCP/IP internals, subnetting, packet-level reverse engineering, and the Active Directory concepts a network penetration tester needs to understand. This post focuses on concepts, analysis techniques, and learning paths (including HTB Academy modules) — no exploit recipes or step-by-step instructions to break into systems.

Table of contents

1. Why these fundamentals matter
2. TCP/IP & OSI: mental models you must own
3. TCP internals (deep, but safe)
4. IP addressing, subnets & routing (practical CIDR math)
5. Network packet capture & reverse engineering techniques
6. Active Directory: network-level architecture & protocols
7. Putting it together: lab path & HTB Academy resources
8. Further reading & references

Why these fundamentals matter

Network-level tests and AD-focused assessments are about understanding state, intent and trust boundaries — how hosts establish connections, how sessions are maintained, what protocols carry identity information (and how), and how segmentation is enforced. Mastering TCP/IP internals and being able to reverse-engineer network traffic will let you identify design weaknesses, misconfigurations, and risky trust relationships without relying on prebuilt exploit tooling.

TCP/IP & OSI: mental models you must own

Two commonly used models:

• OSI (7 layers): good for talking about conceptual responsibilities (physical → application).
• TCP/IP (4 layers): maps more directly to real stacks you observe in pcap analysis (Link, Internet, Transport, Application).

Key mapping reminders:

• Link layer: MAC addresses, ARP, switches, VLAN tags.
• Internet layer: IPv4/IPv6 — routing and fragmentation.
• Transport layer: TCP (reliable stream), UDP (datagrams), ICMP (control).
• Application layer: HTTP, LDAP, SMB, Kerberos, etc.

Always think in state and transition — e.g., TCP is a stateful transport; IP is stateless routing. These different properties change how you detect, record, and analyze interactions in the network.

TCP internals (deep, but safe)

Understanding TCP's mechanics is essential to interpret captures and reverse-engineer network behavior.

Key concepts

• Three-way handshake: SYN → SYN/ACK → ACK establishes connection and initializes sequence numbers.
• Sequence and acknowledgement numbers: used to order bytes; from a capture you can reconstruct the byte stream.
• Flow control / windowing: sender/receiver windows determine throughput; large windows + long RTT → high throughput.
• Retransmission and timers: timeouts, duplicate ACKs, and reordering patterns reveal congestion, packet loss, or middleboxes interfering with traffic.
• TCP options: MSS, Window Scale, SACK permitted — fingerprinting options helps identify OS / middlebox behavior.

What to look for in captures

• Abrupt connection resets (RST): can indicate errors, filtering, or active intervention.
• Repeated SYNs without ACKs: indicates unreachable hosts or firewall drops.
• Unusual window sizes or TCP options: may hint at virtualization, NAT, or proxying devices.

Note: reconstructing streams from pcap files and analyzing protocol payloads is a defensive and research activity; do not use such analyses for unauthorized access.

IP addressing, subnets & routing (practical CIDR math)

To reason about segmentation and reachability you must be comfortable with CIDR and subnet math.

Quick CIDR rules (examples)

• 192.168.1.0/24 → mask 255.255.255.0 → 256 addresses (254 usable hosts).
• 10.0.0.0/8 → mask 255.0.0.0 → 16,777,216 addresses.

How to think about subnets and segmentation

• VLANs create Layer 2 containment; routers or L3 firewalls are needed to route between VLANs/subnets.
• ACLs and firewall rules define allowed flows — look for explicit allow rules for management protocols (RPC, SMB, LDAP, Kerberos) that may expand lateral movement risk.
• Default gateway behavior: hosts send traffic to gateway when destination is outside local subnet — understanding gateway policies helps explain why cross-subnet traffic does or doesn’t appear.

(If you want, include a small cheat-sheet of CIDR sizes in your personal notes — it’s handy when triaging network layouts.)

Network packet capture & reverse engineering techniques

This is where theory meets evidence. The goal: turn raw packets into a succinct description of what happened on the wire.

Tools (analysis, not attack)

• Wireshark — GUI inspection, protocol parsers, TCP stream follow.
• tcpdump — fast capture/filters; raw pcap creation.
• tshark — CLI version of Wireshark for scripted inspection.
• Zeek (formerly Bro) — network analysis framework that extracts metadata and generates logs for large captures.

Workflow & techniques

1. Scope the capture: filter by IP, MAC, or TCP/UDP ports to reduce noise.
   Example (tcpdump read-only):

   bash Copy

   tcpdump -r capture.pcap host 10.0.0.5 and tcp