45. Practice Exercises with Hints
45.2 Networking Foundations – Quick Fire
Chapters 1–3 revise: private vs public IP, CIDR idea, well-known ports, TCP 3-way, UDP use-cases, OSI vs TCP/IP mapping for security.
| Exercise | Task | Hint |
|---|---|---|
| E1 | Is 10.0.5.20 public or private? Why does NAT matter for attackers? |
RFC 1918 private; NAT hides many hosts behind one public IP – scan public face first |
| E2 | Port 22 vs 80 vs 443 vs 3306 – service + risk one-liner each | SSH / HTTP / HTTPS / MySQL; never expose 3306 to 0.0.0.0/0 |
| E3 | Explain SYN flood idea in two lines – defence angle only | Half-open sockets; SYN cookies / rate limits / firewall – no attack recipe |
| E4 | Map "DNS" and "TLS" to OSI-ish layers students mix up | DNS often app/related; TLS encrypts above transport – interview: be clear, not pedantic |
| E5 | Sahyadri Traders Pune office: which ports must stay closed on the public Elastic IP? | DB, RDP if unused, random high admin panels; allow 443 (+22 from your IP only) |
| E6 | TCP vs UDP for DNS – when does each appear? | UDP 53 common queries; TCP 53 for large / zone transfers – restrict zone transfer |
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Port-scans public EIP looking for 22/3389/3306 open | Security group least privilege; alert on mass SYN; close unused ports |
| Abuses open DNS zone transfer | Disable AXFR to world; monitor; split DNS |
Ravindra Bagale's Tip
Students rattle off "OSI layer numbers" but forget that "port 3306 open to the public = disaster". In interviews, risk language > layer bingo. Got it?
Ravindra Bagale's Tip – मराठी
Students "OSI layer number" पटापट सांगतात पण "port 3306 public = disaster" विसरतात. Interview मध्ये risk language > layer bingo. समजले का?
Ravindra Bagale's Tip – हिंदी
Students "OSI layer number" फटाफट बोल देते हैं पर "port 3306 public = disaster" भूल जाते हैं. Interview में risk language > layer bingo. समझ आया?
Lab
On OWN EC2: sudo yum install nmap (Amazon Linux) if needed; from Kali host-only or your laptop against your EIP only: nmap -sS -T2 -p 22,80,443,3306 <YOUR_EIP>. Expect 3306 filtered/closed. Screenshot SG rules.
Real incident: Equifax breach (2017)
Public reporting (US congressional / company statements and major press) described attackers exploiting a known vulnerability in a web component (Apache Struts – patch available before the intrusion window, as reported) and then accessing large volumes of personal data. Weakness themes: unpatched internet-facing software + detection lag. Defence mindset for this exercise set: know your public ports, patch edge apps, monitor. Source: Equifax public statements and contemporaneous major reporting (verify; say "reported" for record counts – no invented numbers here).