Introductory Networking : TryHackMe
Task 1 : Introduction
The topics that we’re going to cover in this room are:
- The OSI Model
- The TCP/IP Model
- How these models look in practice
- An introduction to basic networking tools
Task 2 : The OSI Model: An Overview
The OSI (Open Systems Interconnection) Model is a standardised model which we use to demonstrate the theory behind computer networking.
- Which layer would choose to send data over TCP or UDP?
2. Which layer checks received packets to make sure that they haven't been corrupted?
3. In which layer would data be formatted in preparation for transmission?
4. Which layer transmits and receives data?
5. Which layer encrypts, compresses, or otherwise transforms the initial data to give it a standardised format?
6 . Which layer tracks communications between the host and receiving computers?
7. Which layer accepts communication requests from applications?
8. Which layer handles logical addressing?
9. When sending data over TCP, what would you call the "bite-sized" pieces of data?
Ans: TCP — Segments / UDP — Datagrams
10. [Research] Which layer would the FTP protocol communicate with?
11. Which transport layer protocol would be best suited to transmit a live video?
Ans : UDP
TCP would usually be chosen for situations where accuracy is favoured over speed (e.g. file transfer, or loading a webpage), and UDP would be used in situations where speed is more important (e.g. video streaming).
Task 3: Encapsulation
- How would you refer to data at layer 2 of the encapsulation process (with the OSI model)?
Ans : Frames
In layers 7,6 and 5, the data is simply referred to as data. In the transport layer the encapsulated data is referred to as a segment or a datagram. Network Layer, the data is referred to as a packet. When the packet gets passed down to the Data Link layer it becomes a frame, and by the time it’s transmitted across a network the frame has been broken down into bits.
2. How would you refer to data at layer 4 of the encapsulation process (with the OSI model), if the UDP protocol has been selected?
Ans : Datagrams
3. What process would a computer perform on a received message?
Ans : De-encapsulation
4. Which is the only layer of the OSI model to add a trailer during encapsulation?
Ans : Data Link
5. Does encapsulation provide an extra layer of security (Aye/Nay)?
Ans : Aye
Task 4 : The TCP/IP Model
- Which model was introduced first, OSI or TCP/IP?
Ans : TCP/IP
2.Which layer of the TCP/IP model covers the functionality of the Transport layer of the OSI model (Full Name)?
Ans : Transport
3. Which layer of the TCP/IP model covers the functionality of the Session layer of the OSI model (Full Name)?
Ans : Application
4. The Network Interface layer of the TCP/IP model covers the functionality of two layers in the OSI model. These layers are Data Link, and?.. (Full Name)?
Ans : Physical
5. Which layer of the TCP/IP model handles the functionality of the OSI network layer?
Ans : Internet
6. What kind of protocol is TCP?
Ans : Connection-based
7. What is SYN short for?
Ans : Synchronise
8.What is the second step of the three way handshake?
Ans : SYN/ACK
9. What is the short name for the “Acknowledgement” segment in the three-way handshake?
Ans : ACK
Task 5 : Wireshark
- What is the protocol specified in the section of the request that’s linked to the Application layer of the OSI and TCP/IP Models?
Ans : Domain Name System
2. Which layer of the OSI model does the section that shows the IP address “172.16.16.77” link to (Name of the layer)?
Ans : Network
3. In the section of the request that links to the Transport layer of the OSI and TCP/IP models, which protocol is specified?
Ans : user datagram protocol
4. Over what medium has this request been made (linked to the Data Link layer of the OSI model)?
Ans : Ethernet II
5. Which layer of the OSI model does the section that shows the number of bytes transferred (81) link to?
Ans : Physical
6. [Research] Can you figure out what kind of address is shown in the layer linked to the Data Link layer of the OSI model?
Ans : MAC
Task 6 : [Networking Tools] Ping
- What command would you use to ping the bbc.co.uk website?
Ans : ping bbc.co.uk
2. Ping muirlandoracle.co.uk
What is the IP address?
Ans : 188.8.131.52
3. What switch lets you change the interval of sent ping requests?
Ans : -i
4. What switch would allow you to restrict requests to IPV4?
Ans : -4
5. What switch would give you a more verbose output?
Ans : -v
Task 7 : [Networking Tools] Traceroute
- Use traceroute on tryhackme.com
Can you see the path your request has taken?
Ans :No Ans. Needed
2. What switch would you use to specify an interface when using Traceroute?
Ans : -i
3. What switch would you use if you wanted to use TCP requests when tracing the route?
Ans : -t
4. [Lateral Thinking] Which layer of the TCP/IP model will traceroute run on by default?
Ans : Internet
Task 8 : [Networking Tools] WHOIS
- Perform a whois search on facebook.com
- Ans : No Ans. Needed
2. What is the registrant postal code for facebook.com?
Ans : 94025
3. When was the facebook.com domain first registered?
Ans : 29/03/1997
4. Perform a whois search on microsoft.com
Ans : No Ans. Needed
5. Which city is the registrant based in?
Ans : Redmond
6. [OSINT] What is the name of the golf course that is near the registrant address for microsoft.com?
Ans : Bellevue Golf Course
7. What is the registered Tech Email for microsoft.com?
Ans : email@example.com
Task 9 : [Networking Tools] Dig
- What is DNS short for?
Ans : Domain Name System
2. What is the first type of DNS server your computer would query when you search for a domain?
Ans : Recursive
3. What type of DNS server contains records specific to domain extensions (i.e. .com, .co.uk, etc)? Use the long version of the name.
Ans : Top-level Domain
4. Where is the very first place your computer would look to find the IP address of a domain?
Ans : Local Cache
5. [Research] Google runs two public DNS servers. One of them can be queried with the IP 184.108.40.206, what is the IP address of the other one?
Ans : 220.127.116.11
6. If a DNS query has a TTL of 24 hours, what number would the dig query show?
Ans : 86400
TTL is given in seconds. The typical default value is usually 12 hours (43200 seconds) or 24 hours (86400 seconds). For example — a website moves to a new server; or, you add a new URL to your server. It takes 12–24 hours for the new DNS changes to take effect.
Thank you :)