IP Addresses and Ports

IP addresses and ports are the foundation of network communication—they're like the street address and apartment number that ensure data reaches the correct destination. Understanding how they work is essential for cybersecurity professionals, whether you're scanning a network, configuring a firewall, or exploiting a vulnerable service. Every network attack involves manipulating or targeting specific IPs and ports.

What You'll Learn

IPv4 and IPv6 addressing
Public vs private IP addresses
IP address classes and ranges
What ports are and how they work
Well-known, registered, and dynamic ports
Common ports and their services
Port scanning and enumeration
How to identify services by port
Firewall rules based on IPs and ports

IP Addresses: The Digital Address

An IP address is a unique identifier assigned to every device on a network.

Think of it like:

Real World:          Network:
─────────────        ─────────────
Street Address   →   IP Address
Apartment #      →   Port Number

Example:

192.168.1.100:80
│             │
│             └─ Port 80 (Web server)
└─ IP Address (Which computer)

IPv4 Addresses

Format:

32 bits (4 bytes)
Written as four octets separated by dots
Each octet: 0-255

192.168.1.100
│   │   │  │
│   │   │  └─ 4th octet (100)
│   │   └──── 3rd octet (1)
│   └──────── 2nd octet (168)
└──────────── 1st octet (192)

Binary Representation:

192.168.1.100 in decimal

11000000.10101000.00000001.01100100 in binary
│       │       │       │
192     168     1       100

Total possible IPv4 addresses: 2³² = 4,294,967,296 (~4.3 billion)

Problem: We've run out! That's why IPv6 was created.

IPv4 Address Classes (Historical)

IPv4 addresses were originally divided into classes:

Class A: Large Networks

Range: 1.0.0.0 to 126.255.255.255
Default Mask: 255.0.0.0 (/8)
Networks: 128
Hosts per network: 16,777,214
First bit: 0

Example: 10.0.0.0/8

Class B: Medium Networks

Range: 128.0.0.0 to 191.255.255.255
Default Mask: 255.255.0.0 (/16)
Networks: 16,384
Hosts per network: 65,534
First bits: 10

Example: 172.16.0.0/16

Class C: Small Networks

Range: 192.0.0.0 to 223.255.255.255
Default Mask: 255.255.255.0 (/24)
Networks: 2,097,152
Hosts per network: 254
First bits: 110

Example: 192.168.1.0/24

Class D: Multicast

Range: 224.0.0.0 to 239.255.255.255
Purpose: Multicast groups
First bits: 1110

Class E: Reserved

Range: 240.0.0.0 to 255.255.255.255
Purpose: Experimental
First bits: 1111

Note: Classful addressing is mostly obsolete. We now use CIDR (Classless Inter-Domain Routing).

Private vs Public IP Addresses

Private IP Addresses (Non-routable)

Cannot be accessed directly from the Internet. Used for internal networks.

RFC 1918 Private Ranges:

10.0.0.0      - 10.255.255.255    (10.0.0.0/8)      - Class A
172.16.0.0    - 172.31.255.255    (172.16.0.0/12)   - Class B
192.168.0.0   - 192.168.255.255   (192.168.0.0/16)  - Class C

Use case: Home networks, corporate LANs

Example:

Your home:
- Router: 192.168.1.1
- Laptop: 192.168.1.100
- Phone: 192.168.1.101
- Smart TV: 192.168.1.102

All use private IPs internally
Router has public IP for internet access

Public IP Addresses (Routable)

Can be accessed from anywhere on the Internet. Must be globally unique.

Assigned by:

Internet Service Provider (ISP)
Regional Internet Registry (RIR)

Example: 8.8.8.8 (Google's DNS)

NAT (Network Address Translation)

How private IPs access the internet:

Internal Network          Router (NAT)           Internet
─────────────────         ────────────           ────────
192.168.1.100:45678  →    203.0.113.5:45678  →  8.8.8.8:53
(private IP)              (public IP)            (Google DNS)

Response:
8.8.8.8:53  →  203.0.113.5:45678  →  192.168.1.100:45678

Router remembers which internal device made the request.

Special IP Addresses

0.0.0.0

Meaning: "Any address" or "default route"
Use: Binding services to all interfaces

# Web server listening on all interfaces
python3 -m http.server --bind 0.0.0.0 8080

127.0.0.1 (Loopback)

Meaning: "This computer" (localhost)
Use: Testing network services locally

# Access local web server
curl http://127.0.0.1:8080
curl http://localhost:8080  # Same thing

Full loopback range: 127.0.0.0/8

255.255.255.255 (Broadcast)

Meaning: "All devices on local network"
Use: DHCP discovery, ARP

169.254.0.0/16 (APIPA)

Meaning: Automatic Private IP Addressing
Use: Self-assigned when DHCP fails

If your computer has 169.254.x.x:
→ DHCP server not reachable
→ Can only communicate with others on 169.254.0.0/16

IPv6 Addresses

Why IPv6?

IPv4 exhaustion: We ran out of addresses
IPv6 space: 2¹²⁸ = 340 undecillion addresses
Enough for: Every grain of sand on Earth... many times over

Format:

128 bits (16 bytes)
Written as eight groups of four hex digits
Separated by colons

2001:0db8:85a3:0000:0000:8a2e:0370:7334

Shortening Rules:

1. Remove leading zeros:

2001:0db8:85a3:0000:0000:8a2e:0370:7334
↓
2001:db8:85a3:0:0:8a2e:370:7334

2. Replace consecutive zeros with :: (only once):

2001:db8:85a3:0:0:8a2e:370:7334
↓
2001:db8:85a3::8a2e:370:7334

Common IPv6 Addresses:

::1                  - Loopback (like 127.0.0.1)
::                   - Unspecified (like 0.0.0.0)
fe80::/10            - Link-local (like 169.254.0.0/16)
2001:db8::/32        - Documentation
ff00::/8             - Multicast

Checking IPv6:

# Linux
ip -6 addr show

# Windows
ipconfig
# Look for "IPv6 Address"

# Ping IPv6
ping6 google.com
ping6 ::1  # Loopback

# Test IPv6 connectivity
curl -6 https://ipv6.google.com

Ports: The Apartment Number

Ports identify specific applications/services on a device.

Port Characteristics:

Range: 0 - 65535 (16-bit number)
Purpose: Allow multiple services on one IP

192.168.1.100:80    - Web server
192.168.1.100:22    - SSH server
192.168.1.100:3306  - MySQL database
      ↑        ↑
      IP      Port

Port Categories

Well-Known Ports (0-1023)

Reserved for common services
Require root/admin privileges to bind (on Unix/Linux)

20/21  - FTP (File Transfer)
22     - SSH (Secure Shell)
23     - Telnet (Insecure remote access)
25     - SMTP (Email sending)
53     - DNS (Domain Name System)
67/68  - DHCP (IP address assignment)
80     - HTTP (Web traffic)
110    - POP3 (Email retrieval)
143    - IMAP (Email access)
443    - HTTPS (Secure web)
445    - SMB (Windows file sharing)
3389   - RDP (Remote Desktop)

Registered Ports (1024-49151)

Assigned to specific services by IANA
Don't require special privileges

1433   - Microsoft SQL Server
1521   - Oracle Database
3306   - MySQL
5432   - PostgreSQL
5900   - VNC (Remote desktop)
6379   - Redis
8080   - HTTP Alternate (common for dev servers)
8443   - HTTPS Alternate
27017  - MongoDB

Dynamic/Private Ports (49152-65535)

Used for client-side connections
Ephemeral ports (temporary)

When you browse a website:
Your computer: 192.168.1.100:54321 (random port)
    ↓
Web server: 93.184.216.34:80

Common Ports Cheat Sheet

Web:

80    - HTTP
443   - HTTPS
8080  - HTTP Alternate
8443  - HTTPS Alternate

Remote Access:

22    - SSH
23    - Telnet
3389  - RDP (Windows)
5900  - VNC

Email:

25    - SMTP
110   - POP3
143   - IMAP
465   - SMTPS (SMTP over SSL)
587   - SMTP Submission
993   - IMAPS
995   - POP3S

File Transfer:

20/21 - FTP
22    - SFTP (SSH File Transfer)
69    - TFTP
445   - SMB/CIFS

Databases:

1433  - MS SQL Server
1521  - Oracle
3306  - MySQL/MariaDB
5432  - PostgreSQL
6379  - Redis
27017 - MongoDB

Network Services:

53    - DNS
67/68 - DHCP
123   - NTP (Time sync)
161   - SNMP

Viewing Open Ports

Linux:

# List all listening ports
ss -tuln
netstat -tuln

# List all connections (including established)
ss -tun
netstat -tun

# Show process using port
ss -tulnp
netstat -tulnp

# Check specific port
ss -tuln | grep :80
lsof -i :80

# Show what's listening on all ports
lsof -i -P -n

Windows:

# List all listening ports
netstat -an

# Show process IDs
netstat -ano

# Filter by state
netstat -an | findstr LISTENING
netstat -an | findstr ESTABLISHED

# Show process names
netstat -ab

# Check specific port
netstat -an | findstr :80

Port Scanning

Port scanning discovers what ports are open (what services are running).

Types of Port Scans:

1. TCP Connect Scan

nmap -sT 192.168.1.5

# Completes three-way handshake
# Most reliable
# Easily detected (logged)

2. SYN Scan (Stealth)

nmap -sS 192.168.1.5

# Sends SYN, receives SYN-ACK, sends RST
# Faster, less obvious
# Requires root/admin

3. UDP Scan

nmap -sU 192.168.1.5

# Scans UDP ports (slower)
# Important for DNS, DHCP, SNMP

4. Service Version Detection

nmap -sV 192.168.1.5

# Identifies service and version
# Example: "OpenSSH 7.9p1"

5. All Ports

nmap -p- 192.168.1.5

# Scans all 65535 ports (slow)
# Default: Top 1000 common ports

6. Specific Ports

nmap -p 80,443,22 192.168.1.5

# Scan specific ports
nmap -p 1-1000 192.168.1.5

# Scan range

Port States:

Open:       Service listening, accepts connections
Closed:     No service listening, but port reachable
Filtered:   Firewall blocking, can't determine state

Example Scan:

nmap -sV -p- 192.168.1.5

# Output:
PORT     STATE  SERVICE   VERSION
22/tcp   open   ssh       OpenSSH 7.9p1 Debian
80/tcp   open   http      Apache httpd 2.4.38
443/tcp  open   ssl/http  nginx 1.14.2
3306/tcp open   mysql     MySQL 5.7.28

Service Enumeration by Port

Once you find open ports, enumerate services:

Port 21 (FTP):

# Check for anonymous access
ftp 192.168.1.5
# Username: anonymous
# Password: [any]

# Banner grab
nc 192.168.1.5 21

# Enumerate with nmap
nmap --script ftp-anon,ftp-bounce,ftp-proftpd-backdoor -p 21 192.168.1.5

Port 22 (SSH):

# Banner grab
nc 192.168.1.5 22

# SSH version
ssh -V 192.168.1.5

# Enumerate with nmap
nmap --script ssh-hostkey,ssh-auth-methods -p 22 192.168.1.5

Port 80/443 (HTTP/HTTPS):

# Check headers
curl -I http://192.168.1.5

# Directory brute force
gobuster dir -u http://192.168.1.5 -w /usr/share/wordlists/dirb/common.txt

# Web vulnerability scan
nikto -h http://192.168.1.5

# Enumerate with nmap
nmap --script http-enum,http-headers,http-methods -p 80 192.168.1.5

Port 445 (SMB):

# List shares
smbclient -L //192.168.1.5

# Enumerate with enum4linux
enum4linux -a 192.168.1.5

# Enumerate with nmap
nmap --script smb-enum-shares,smb-enum-users -p 445 192.168.1.5

Port 3306 (MySQL):

# Connect
mysql -h 192.168.1.5 -u root -p

# Enumerate with nmap
nmap --script mysql-enum,mysql-info -p 3306 192.168.1.5

Firewall Rules and Ports

Firewalls control traffic based on IP addresses and ports.

Example Rules:

# Allow SSH from specific IP
iptables -A INPUT -p tcp -s 192.168.1.100 --dport 22 -j ACCEPT

# Allow HTTP from anywhere
iptables -A INPUT -p tcp --dport 80 -j ACCEPT

# Block specific IP
iptables -A INPUT -s 203.0.113.5 -j DROP

# Allow outbound to specific IP and port
iptables -A OUTPUT -p tcp -d 8.8.8.8 --dport 53 -j ACCEPT

Windows Firewall:

# Allow port 80
New-NetFirewallRule -DisplayName "Allow HTTP" -Direction Inbound -LocalPort 80 -Protocol TCP -Action Allow

# Block IP
New-NetFirewallRule -DisplayName "Block Attacker" -Direction Inbound -RemoteAddress 203.0.113.5 -Action Block

Socket Programming

Socket = IP Address + Port

import socket

# TCP client
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect(('192.168.1.5', 80))
sock.send(b'GET / HTTP/1.1\r\nHost: example.com\r\n\r\n')
response = sock.recv(4096)
print(response.decode())
sock.close()

# TCP server
server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
server.bind(('0.0.0.0', 9999))
server.listen(5)
print("Listening on port 9999...")
client, addr = server.accept()
print(f"Connection from {addr[0]}:{addr[1]}")
client.send(b"Hello!\n")
client.close()

Try It Yourself

Exercise 1: Identify Your IP

# Public IP
curl ifconfig.me
curl icanhazip.com

# Private IP (Linux)
ip addr show
hostname -I

# Private IP (Windows)
ipconfig

Exercise 2: Scan Your Network

# Discover hosts on your network
nmap -sn 192.168.1.0/24

# Scan a specific host
nmap -sV 192.168.1.1  # Your router

Exercise 3: Test Connectivity

# Can you reach this IP?
ping 8.8.8.8

# Can you connect to this port?
nc -vz google.com 80
telnet google.com 80

# What ports are open?
nmap -F google.com  # Fast scan (100 common ports)

# Grab banners from different services
nc 192.168.1.5 21  # FTP
nc 192.168.1.5 22  # SSH
nc 192.168.1.5 80  # HTTP
nc 192.168.1.5 25  # SMTP

# Type after connecting to HTTP port:
GET / HTTP/1.1
Host: example.com

[Press Enter twice]

Port Security Best Practices

1. Close Unnecessary Ports

# Check what's listening
netstat -tuln

# Stop unnecessary services
systemctl stop service_name
systemctl disable service_name

2. Use Firewall

# Allow only necessary ports
ufw allow 22/tcp
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable

3. Change Default Ports (Security by Obscurity)

# SSH on non-standard port
# /etc/ssh/sshd_config
Port 2222

Note: Not real security, but reduces automated scans.

4. Monitor Port Activity

# Watch for suspicious connections
watch -n 1 'netstat -an | grep ESTABLISHED'

# Log connection attempts
tail -f /var/log/auth.log  # SSH attempts

Quick Reference

# View IPs
ip addr show              # Linux (modern)
ifconfig                  # Linux (legacy)
ipconfig                  # Windows

# View ports
ss -tuln                  # Linux (modern)
netstat -tuln             # Linux (legacy)
netstat -an               # Windows

# Test connectivity
ping 8.8.8.8             # ICMP
nc -vz host 80           # TCP port
telnet host 80           # TCP port (interactive)

# Scan ports
nmap -F host             # Fast scan
nmap -p- host            # All ports
nmap -sV host            # Version detection

# Banner grab
nc host port             # Netcat
telnet host port         # Telnet

Resources

Tools:

nmap: Port scanner - nmap.org
netcat: Network Swiss Army knife
ss: Socket statistics (modern netstat)
Wireshark: Packet analysis

Online Tools:

ipinfo.io: IP geolocation
shodan.io: Internet-wide port scanner
censys.io: Internet scanning

Reading:

RFC 791: Internet Protocol (IPv4)
RFC 8200: Internet Protocol Version 6 (IPv6)
IANA Port Registry

Next Steps

Practice port scanning on your own network (with permission!)
Learn subnetting to understand IP ranges
Study NAT and how it affects port forwarding
Master nmap for service enumeration
Understand firewalls and how they filter based on IPs/ports

Every network attack begins with identifying IPs and open ports. Master this, and you're on your way to becoming a skilled penetration tester!

"IP addresses tell you where, ports tell you what—know both to own the network."

IP Addresses and Ports

What You'll Learn

IP Addresses: The Digital Address

Think of it like:

IPv4 Addresses

Format:

Binary Representation:

IPv4 Address Classes (Historical)

Class A: Large Networks

Class B: Medium Networks

Class C: Small Networks

Class D: Multicast

Class E: Reserved

Private vs Public IP Addresses

Private IP Addresses (Non-routable)

Public IP Addresses (Routable)

NAT (Network Address Translation)

Special IP Addresses

0.0.0.0

127.0.0.1 (Loopback)

255.255.255.255 (Broadcast)

169.254.0.0/16 (APIPA)

IPv6 Addresses

Why IPv6?

Format:

Shortening Rules:

Common IPv6 Addresses:

Checking IPv6:

Ports: The Apartment Number

Port Characteristics:

Port Categories

Well-Known Ports (0-1023)

Registered Ports (1024-49151)

Dynamic/Private Ports (49152-65535)

Common Ports Cheat Sheet

Web:

Remote Access:

Email:

File Transfer:

Databases:

Network Services:

Viewing Open Ports

Linux:

Windows:

Port Scanning

Types of Port Scans:

1. TCP Connect Scan

2. SYN Scan (Stealth)

3. UDP Scan

4. Service Version Detection

5. All Ports

6. Specific Ports

Port States:

Example Scan:

Service Enumeration by Port

Port 21 (FTP):

Port 22 (SSH):

Port 80/443 (HTTP/HTTPS):

Port 445 (SMB):

Port 3306 (MySQL):

Firewall Rules and Ports

Example Rules:

Windows Firewall:

Socket Programming

Try It Yourself

Exercise 1: Identify Your IP

Exercise 2: Scan Your Network

Exercise 3: Test Connectivity

Exercise 4: Banner Grabbing

Port Security Best Practices

1. Close Unnecessary Ports

2. Use Firewall

3. Change Default Ports (Security by Obscurity)

4. Monitor Port Activity

Quick Reference

Resources

Tools:

Online Tools:

Reading:

Next Steps