IP, Ports & Subnets

Every device on a network has an IP address. Every service on that device runs on a port. Subnets define which devices are in the same network segment.

These three concepts are the foundation of everything in networking.

IP Addresses

An IPv4 address is four numbers from 0–255, separated by dots. Example: 192.168.1.10

Private ranges — not routable on the public internet:

If you see an IP in these ranges, it is a private address — on a local network or a VM.

IPv6 is longer and looks like 2001:db8::1. It is increasingly common. The concepts are the same.

Subnets and CIDR

A subnet groups IPs together. CIDR notation (/24) tells you how many bits are fixed.

/24 is the most common subnet you will see in home and small office networks.

A subnet calculator is your friend. Use this one.

Ports

A port is a number from 0–65535. It tells the OS which application should receive a packet.

Well-known ports (0–1023):

Any process can use ports above 1024. Finding unexpected services on high ports is a common finding in pentests.

Why Can’t I Reach It

Four questions answer most connectivity problems. Ask them in order.

Is the service listening on the right address? A service bound to 127.0.0.1 accepts connections only from the same machine. Bound to 0.0.0.0, it accepts connections from anywhere.

ss -tulnp        # the Local Address column shows 127.0.0.1:port or 0.0.0.0:port

Is there a route? Your machine needs a default gateway to reach any other network.

ip r             # look for "default via <gateway>"

Is it TCP or UDP? They are different protocols that share the same port numbers. nmap scans TCP unless you ask for UDP.

nmap -sU -p 53,161 10.10.10.5    # UDP scan: slow, and it needs root

Is something in between dropping it? A firewall drops packets silently. ping fails, nmap says “host down”, and nothing is wrong with the host. See nmap -Pn on the tools page.

One more: a VM on NAT networking can reach out, but nothing can reach in. That is the hypervisor, not the target. See Virtual Machines.

Real-World Context

When scanning a network or a target host, you are looking for open ports. Each open port is a potential entry point. Each service running behind that port has its own attack surface.

The first step in almost every engagement is a port scan.

In CTF Environments

Every CTF engagement starts with the same question: what is running and where? IP, ports, and subnets are how you answer it.

Standard recon sequence for an HTB/THM box:

# You are given one IP. Start there.
TARGET=10.10.10.5

# Fast port sweep — all 65535 ports, high rate
nmap -p- --min-rate 5000 -T4 $TARGET -oN allports.txt

# Extract open ports into a variable
PORTS=$(grep "open" allports.txt | cut -d'/' -f1 | tr '\n' ',' | sed 's/,$//')

# Deep scan: version detection + default scripts on open ports only
nmap -sV -sC -p$PORTS $TARGET -oN detailed.txt

Doing -sV -sC against all 65535 ports wastes time. Do the fast sweep first, then go deep on what is open.

Identifying interesting ports fast:

CCDC — subnet enumeration after first foothold:

CCDC gives you a scored network with many hosts. After you understand your subnet layout, you can identify which hosts are yours to defend and which belong to the red team.

# Discover hosts in your subnet
nmap -sn 192.168.x.0/24 -oN hosts.txt

# Check all hosts for open management ports (SSH, RDP, WinRM)
nmap -p 22,3389,5985 192.168.x.0/24 --open

Subnetting gotcha in competitions:

CTF machines and CCDC environments often use /24 subnets. If your machine has IP 10.10.10.15 with a /24 mask, the gateway is probably 10.10.10.1 and the target range is 10.10.10.0/24. Do not scan past your subnet without confirming you have permission.

References

• Subnet Calculator
• RFC 1918 — Private Address Space
• IANA Port Assignments