Essential Linux CLI Commands
File System Navigation
- ls - List directory contents
- cd - Change directory
- pwd - Print working directory
Permissions & Security
- chmod - Change file permissions
- sudo - Execute as superuser
- passwd - Change user password
Network Commands
- ifconfig - Configure network interfaces
- netstat - Network statistics
- ssh - Secure shell remote login
System & Utilities
- grep - Search text patterns
- iptables - Firewall configuration
- ps - Process status
MAC Address Fundamentals
What is a MAC Address?
A Media Access Control (MAC) address is a unique hardware identifier assigned to network interfaces. It operates at Layer 2 (Data Link) of the OSI model.
Key Characteristics:
- 48-bit address (e.g., 00:1A:2B:3C:4D:5E)
- Burned into the network interface card (NIC)
- Used for local network communication
- Essential for Ethernet frame delivery
MAC Address Traffic Flow
IP Address Fundamentals
What is an IP Address?
An Internet Protocol (IP) address is a logical network identifier assigned to devices. It operates at Layer 3 (Network) of the OSI model.
Key Concepts:
- IPv4: 32-bit address (e.g., 192.168.1.100)
- IPv6: 128-bit address (e.g., 2001:0db8:85a3::8a2e:0370:7334)
- Assigned statically or via DHCP
- Used for end-to-end communication
Example IPv4 Configuration
This configuration allows communication within the 192.168.1.0/24 network.
TCP 3-Way Handshake & Port Scanning
TCP 3-Way Handshake
- SYN: Client sends SYN packet to server
- SYN-ACK: Server responds with SYN-ACK
- ACK: Client sends final ACK to establish connection
Port Scanning Basics
Port scanners like Nmap use this handshake to determine which ports are open:
- Open port: Responds with SYN-ACK
- Closed port: Responds with RST
- Filtered port: No response
Basic Nmap Examples
nmap -sT 192.168.1.1 # TCP connect scan
nmap -sS 192.168.1.1 # SYN stealth scan (root)
nmap -A 192.168.1.1 # Aggressive scan
Common Ports & Services
Note: The ports below are commonly scanned during security assessments. Understanding these helps identify potential attack surfaces.
| Port | Protocol | Service | Description |
|---|---|---|---|
| 20/21 | TCP | FTP | File Transfer Protocol |
| 22 | TCP | SSH | Secure Shell |
| 80 | TCP | HTTP | Hypertext Transfer Protocol |
| 443 | TCP | HTTPS | HTTP Secure |
| 3389 | TCP | RDP | Remote Desktop Protocol |
TCP/IP Stack Overview
Layer 2: Data Link (MAC)
Frame addressed to next hop: 00:1A:2B:3C:4D:5E (default gateway)
Responsible for local network delivery using MAC addresses.
Layer 3: Network (IP)
Packet addressed to: 203.0.113.45
Handles logical addressing and routing between networks.
Layer 4: Transport (TCP/UDP)
Segment addressed to port: 443 (HTTPS)
Manages end-to-end communication and reliability.
Layer 7: Application
HTTP GET request for: /index.html
Contains the actual application data and protocols.
Complete Communication Flow:
- Application creates HTTP request (Layer 7)
- TCP segment created with port 443 (Layer 4)
- IP packet addressed to destination IP (Layer 3)
- Ethernet frame addressed to next hop MAC (Layer 2)