Chapter 11 — Networks and protocols
Lesson map
Lesson 11 published. Map, example, EX031.
flowchart TD
N0["Learning outcomes"]
N1["11.1 Layers as observation points"]
N2["11.2 Ports are not services"]
N3["11.3 Denies are data"]
N4["11.3b Protocol families in scope"]
N5["11.4b Capturing only what the ROE allows"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX031"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["11.1 Layers as observation points"]
N2["11.2 Ports are not services"]
N3["11.3 Denies are data"]
N4["11.3b Protocol families in scope"]
N5["11.4b Capturing only what the ROE allows"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX031"]
[Learning outcomes]
|
v
[11.1 Layers as observation points]
|
v
[11.2 Ports are not services]
|
v
[11.3 Denies are data]
|
v
[11.3b Protocol families in scope]
|
v
[11.4b Capturing only what the ROE allows]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX031]
Learning outcomes
You will (1) describe what an authorized observer can learn from each OSI layer without attacking it; (2) define port and protocol scope precisely; (3) interpret a deny as a successful control, not a failed test.
11.1 Layers as observation points
Link-layer captures need access to a segment; network-layer routing data need a vantage; application-layer evidence often needs credentials. An assessment that only has application credentials should not claim link-layer visibility. State the vantage in the method section.
Credentials for an app say nothing about frames on the wire. Claiming a broader vantage than you held invents coverage. Naming the layer in the method write-up lets a reviewer match each finding to what could actually be seen. Sam refuses to file link-layer claims when the engagement only held an application account.
11.2 Ports are not services
Port 443 often means TLS and HTTPS, but it can carry other protocols. Scope that says "web ports" must list numbers and, if needed, expected application protocols. A finding that "HTTPS was open" is incomplete without the certificate subject, auth method and whether the service was the expected one.
Listing port numbers removes the fuzzy phrase 'web ports' from the ROE. Confirming the certificate subject and auth method stops a finding that mistakes a different service on 443 for the expected portal. Sam's notes always include what protocol was observed, not only that the port answered.
11.3 Denies are data
A closed port, a refused TCP handshake or a WAF block is evidence that a control worked for that probe. Report it as coverage of a planned check, not as a failure to "get in". PulseMap's covered/planned-not-seen distinction (Chapter 29) depends on this.
"""Rank synthetic assets for authorized engagement scoping."""
assets = [
("public-web-portal", 3, 3, 3), # exposure, data_sensitivity, blast_radius 1-3
("staging-admin-ui", 2, 3, 2),
("corp-vpn-edge", 3, 2, 3),
("internal-wiki", 1, 2, 1),
("printer-fleet", 2, 1, 1),
("lab-jump-host", 1, 1, 2),
]
print(f"{'asset':20} score exposure data blast")
for name, e, d, b in sorted(assets, key=lambda x: -(x[1]+x[2]+x[3])):
print(f"{name:20} {e+d+b:5} {e:8} {d:4} {b:5}")
Expected output:
asset score exposure data blast
public-web-portal 9 3 3 3
corp-vpn-edge 8 3 2 3
staging-admin-ui 7 2 3 2
internal-wiki 4 1 2 1
printer-fleet 4 2 1 1
lab-jump-host 4 1 1 2
Synthetic case — Riverstone Transit. The inventory ranked public-web-portal highest (score 9). Sam scheduled it first under the ROE and deferred printer-fleet, which scored 4 and was out of the week's window.
Coverage metrics become honest when a block counts as a completed check. Chasing only open paths biases the report toward failure and hides controls that worked. PulseMap's planned-not-seen bucket exists so a quiet deny is still recorded. Sam lists blocked probes next to successful ones in the daily digest.
11.4 Errors and limits
Scanners fingerprint banners; banners lie. Confirm with an application-level check before writing a finding. Do not scan the public Internet from the course environment.
A banner that claims a product version can be copied from a template or left stale after an upgrade. An application-level check, such as reading a health page under authorization, confirms what is really there. Course environments stay off the public Internet so students never become an unwelcome scanner on someone else's network. Sam's lab machines have no route there.
11.3b Protocol families in scope
Scope documents should name protocol families explicitly: "TCP 443 with HTTPS application data" is clearer than "443". If TLS interception is forbidden, say so. If only TLS 1.2+ is eligible for testing, say so. Ambiguity here becomes an argument during the engagement when someone wants to try a legacy cleartext port "just to see".
Naming HTTPS on TCP 443 leaves no room for a cleartext experiment on the same number. Forbidding TLS interception up front avoids a mid-test argument with privacy and legal teams. Legacy cleartext ports stay closed unless the ROE lists them. Sam reads the protocol paragraph aloud with the client contact before kickoff.
11.4b Capturing only what the ROE allows
Packet captures taken during an authorized test often contain data outside the engagement's purpose, such as staff credentials or passenger records in Riverstone Transit's case. Sam's capture plan names the interfaces, a filter limited to in-scope hosts, a retention period and who may open the files, and the capture is deleted on schedule.
Filters and short retention shrink how much staff or passenger data can linger after the test. Naming who may open the files stops casual browsing of a capture that happened to include a login. Deletion on schedule is checked, not assumed. Sam's close-out includes a ticket showing the capture was wiped.
Exercises
- EX031 — Vantage. Match three evidence types to the minimum vantage needed. Rubric: 3 = correct mapping (e.g. ARP table → link access; TLS cert → TCP to port; API field → authenticated session); 2 = two; 1 = one; 0 = none.
- EX032 — Scope ports. Rewrite "all web stuff" as a port set and an application note for Riverstone. Rubric: 3 = {80,443,8080} plus "only HTTP(S) to fare and staff apps"; 2 = ports only; 1 = vague; 0 = none.
- EX033 — Inventory. Which two assets would you schedule first from the lab and why? Rubric: 3 = public-web-portal and corp-vpn-edge with score/exposure reasons; 2 = correct without reasons; 1 = one; 0 = wrong.
Synthesis
Networks give you a vantage and a port set. Scope them; treat blocks as results.
Continue studying — chapter 11 of 50
← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →