This document discusses various network commands used for network reconnaissance and security assessment, including ipconfig/ifconfig to view network layout, ping to test connectivity, traceroute/tracert to trace the route to a destination, route to view the routing table, and ARP to resolve IP addresses to MAC addresses. It explains that network reconnaissance tools scan a network to find open ports and vulnerabilities, and security assessment determines how secure an organization is by testing security policies and controls. The commands covered help understand network architecture, connectivity, routing, and device identification.

1. Friendly Tip: Please take notes to better remember concepts
In this video we will
learn about
Commands used in
Assessing Network
layout & Security
Core Cyber Security Concepts

2. Network Reconnaissance Tools
Network reconnaissance is a term for testing for potential
vulnerabilities in a computer network.
Network reconnaissance tools are used to scan the network
to probe for open ports and other vulnerabilities that can be
taken advantage of to gain access to the network.

3. What is Organizational
Security assessment?
Organizational security assessment is the process of
testing & analyzing an organization's security policy
and security controls in place to determine how
secure the organization is from Cyber Attacks.

4. " The first step of performing security
assessment is to identify the network
layout. It is vital to understand the
network architecture and the
security controls in place "
Network
Layout
Detection

5. To understand & see the network layout we can use the following
commands with respect to the operating system.
In computers running windows OS we can use the code ipconfig in
command prompt to view the device's IP address and Subnet
mask.
Similarly In computers
operating on Linux OS, we
can use the code ifconfig
in terminal to view the
network layout.
ipconfig/ifconfig command

6. Ping
command
Ping command is
used to test the
connectivity/ reach-
ability between
devices. It is used to
test/verify the
connection b/w the
host and the target
machine.

7. How does ping command work?
The ping command operates by sending/pinging Internet Control
Message Protocol (ICMP) Echo Request messages to the destination
computer and waits for a response., to hear back from the target
computer. The two major pieces of information that the ping command
provides are how many ICMP echo responses are returned and how
long it took for them to return.
For example, you might find no responses when pinging a network
printer, only to find out that the printer is offline and its cable needs
replaced. Or maybe you need to ping a router to verify that your
computer can connect to it to, so you don't have to worry about a
potential networking issue

8. -> ping command options

9. -> ping command example
C:Userslearningwithray>www.google.com
In this example, the
ping command is used
to ping the target
google.com
By default 4 ICMP
requests are sent to
www.google.com and
in this case we heard
back from all the
requests and the time
it took to hear back
from the target is
mentioned below

10. route command
In computing, route is a command used to view and manipulate the IP
routing table in Unix-like and Microsoft Windows operating systems.

11. trace route command
The Traceroute command (tracert on Windows) is a small network
diagnostic software that you have built-in on your device and
servers for tracing the route, hop by hop to a target.To access the
traceroute, you will need to use the Terminal (Linux and macOS) or
the Command Prompt
You can use the Traceroute and see the full route that the packets take
to their destination (domain or IP address). Apart from that, you will see
the hostnames and IPs of the routers on the way and the latency, the
time it takes for each device to receive and resend the data.

12. With trace route command You will be able to see all the routers on
the way, with their IP addresses and the time it took. You can better
understand the network and check if you can reach target device.
You can see how much
time it took in each
hop. So you can see a
spot that significantly
slows your network.
You can fix the
problem or add more
presence in the area.

13. ARP protocol in short is a procedure that connects an ever-changing
Internet Protocol (IP) address to a fixed/permament physical
machine address, known as a media access control (MAC) address,
in a local-area network (LAN).
Address Resolution Protocol
To put it simply, what happens is , in a LAN connection there are
devices with different IP addresses and MAC addresses. The router
allots the dynamic/ever changing IP addresses to the connected
devices mac addresses. Within the LAN, each device forwards its
data request to the router and router fetches the results.

14. But the problem is, even after fetching the results how is the router
supposed to know how and who to send the data packets without a
means of identifying who/what device requested for which info.
ARP protocol addresses this issue. The router forwards an internet
request, put forward by the connected devices and fetches the
requests from the internet.

15. After receiving all the information requests, the router
broadcasts/asks the ARP program to find a MAC address that
matches the destination IP address, where the network traffic is
supposed to go to.
After the request is made by the router within the LAN,
asking/inquiring who has the particular dynamic IP address linked to
their MAC address, and the device with the requested/matching IP
address steps forward, claiming it has the MAC address that
matches the destination IP address.
Only then the router transfers the data requested by the device.

16. ARP broadcasts a request packet to all the machines on the LAN and
asks if any of the machines are using that particular IP address.
When a machine recognizes the IP address as its own, it sends a
reply to the broadcast, so ARP can update the cache for future
reference and proceed with the communication i.e transfer data
packets/network traffic.
To sum it up :
A table called the ARP cache maintains a record of each IP address
and its corresponding MAC address.

17. ARP Table is used to keep the record of the IP address and MAC
address of the devices (source and destination device). For the
communication between two devices, it is necessary that the IP
address and the MAC address of the source and the destination
device should be stored in an ARP table.
If there is no record in the table, an ARP broadcast is sent by the
source to all the devices in a network. All the devices compare their
own IP address with the IP address of the destination device. When
the IP address of the device matches with each other, that device
sent the response, which is then updated in an ARP table.

18. Sources:
https://www.lifewire.com/ping-command-2618099
https://www.fortinet.com/resources/cyberglossary/what-is-arp
https://www.techtarget.com/searchnetworking/definition/Addre
ss-Resolution-Protocol-ARP
https://www.javatpoint.com/arp-table
https://www.geeksforgeeks.org/route-command-in-linux-with-
examples/
https://www.cloudns.net/blog/traceroute-command-tracert/