Cyber Network Packet & ACL Lab

Hiring managers demand hands-on networking fluency before penetration testing. Inject packets across subnets, inspect Layer 2–7 headers, test stateful firewall ACLs, and isolate threat vectors.

System Ready: IDLE
Sent: 0 Status: Ready

Layer 2 Data Link Ethernet II

Src MAC: 52:54:00:12:34:56
Dst MAC: 52:54:00:99:AA:01
EtherType: 0x0800 (IPv4)

Layer 3 Network IPv4

Src IP: 192.168.1.50
Dst IP: 10.0.0.80
Subnet: Cross-Subnet (Routed)
TTL: 64 | Protocol: 6 (TCP)

Layer 4 Transport TCP

Src Port: 51842 (Ephemeral)
Dst Port: 443 (HTTPS)
Flags: SYN [Seq=0]
Window Size: 65535

Layer 7 Application Payload

TLS Client Hello / SNI: portal.corp.internal
Payload Hash: SHA256: 9e1a...
Inspection: Valid Protocol Signature
Ready to simulate. Choose a preset or craft a custom packet.

Core Networking Concepts for Security Professionals

Why security hiring managers insist you understand building networks before trying to break them.

Subnetting & Gateway Routing

When a host transmits data, it performs a bitwise AND on its IP address and subnet mask. If the destination is outside its local broadcast domain (e.g., 192.168.1.50 contacting 10.0.0.80), the packet must be addressed at Layer 2 to the default gateway's MAC address while keeping the destination Layer 3 IP intact.

  • Workstation LAN: 192.168.1.0/24 (Gateway 192.168.1.1)
  • DMZ Subnet: 10.0.0.0/24 (Segmented from Corporate LAN)
  • Routing decisions decrement TTL to eliminate routing loops

Stateful vs. Stateless Firewalls

Stateless firewalls filter solely on static headers (IPs and Ports) for each individual packet. Stateful firewalls maintain a connection table, tracking TCP 3-way handshakes (SYN, SYN-ACK, ACK) so return traffic from legitimate outbound sessions is automatically permitted.

  • Implicit Deny: Unmatched packets default to DROP
  • First-Match-Wins: Strict ordering of ACL rules is vital
  • Port scans exploit open listening ports without completion

TCP Handshake & Exploit Mechanics

Understanding exploits begins at the transport layer. A SYN flood exhausts half-open state buffers, while unauthorized database connections on default port 5432 or 3306 bypass host defenses if egress filtering is not enforced.

  • Layer 4 determines service demultiplexing via ports
  • Layer 7 contains credentials, SQL queries, or TLS certificates
  • DNS over UDP 53 can be weaponized for data exfiltration
Enjoy this tool? Build your own with Super