Lab 02 — TCP/IP and Network Connectivity Fundamentals

Mission Information

Item	Details
Lab	02
Lab Name	TCP/IP and Network Connectivity Fundamentals
Track	CompTIA Network+
Difficulty	Beginner
Estimated Time	100–130 minutes
Primary Role	Network Technician / Junior Network Administrator
Environment	Network+ Virtual Lab
Primary Systems	NETPLUS-ADMIN, NETPLUS-CLIENT01, NETPLUS-SERVER01
Primary Tools	Wireshark, ping, traceroute/tracert, netstat, ss, arp, ip, ipconfig, nc
Skills	TCP/IP, Ethernet, ARP, ICMP, TCP, UDP, Ports, Sockets, Packet Analysis, Connectivity Troubleshooting

Mission Objective: Understand how traffic moves from an application through the TCP/IP stack and across the network by generating, capturing, analyzing, and troubleshooting real network communication.

Mission Scenario

You are working as a Junior Network Technician at GHC Enterprise.

Your Network+ lab environment is now operational.

The networking team asks you to move beyond:

Can these systems ping each other?

and understand:

How does the communication actually happen?

You need to investigate:

which protocol is used
which addresses identify systems
which ports identify services
how ARP supports local IPv4 communication
how TCP establishes reliable sessions
how UDP behaves differently
how ICMP supports troubleshooting
how the operating system tracks network connections
how packets appear in Wireshark
how to isolate failures at different layers

The environment remains:

NETPLUS-ADMIN
10.10.10.10

NETPLUS-CLIENT01
10.10.10.20

NETPLUS-SERVER01
10.10.10.30

Mission Objectives

By completing this lab, you will be able to:

understand the TCP/IP networking model
relate TCP/IP to OSI concepts
distinguish Ethernet, IP, TCP, UDP, ICMP, and ARP
identify source and destination MAC addresses
identify source and destination IP addresses
understand TCP and UDP ports
identify sockets and active connections
analyze the TCP three-way handshake
identify TCP flags
inspect TCP connection states
generate UDP traffic
capture and analyze ICMP
capture and analyze ARP
use ping and traceroute
use netstat and ss
test TCP service connectivity
troubleshoot connectivity using a layered approach

1. Review the Lab Topology

Use:

NETPLUS-LAB
10.10.10.0/24
      |
      +-----------------------------+
      |              |              |
      |              |              |
10.10.10.10     10.10.10.20    10.10.10.30
ADMIN            CLIENT01        SERVER01

Verify all systems are online.

2. Verify Current Addressing

On NETPLUS-ADMIN:

ip addr

On NETPLUS-SERVER01:

ip addr

On NETPLUS-CLIENT01:

ipconfig

Confirm:

ADMIN:
10.10.10.10/24

CLIENT01:
10.10.10.20/24

SERVER01:
10.10.10.30/24

3. Understand the TCP/IP Model

A practical TCP/IP model can be represented as:

Application
    ↓
Transport
    ↓
Internet
    ↓
Network Access

Examples:

TCP/IP Layer	Common Examples
Application	HTTP, HTTPS, DNS, SSH
Transport	TCP, UDP
Internet	IPv4, IPv6, ICMP
Network Access	Ethernet, Wi-Fi, ARP-related local delivery

4. Compare TCP/IP with OSI

Conceptually:

OSI                     TCP/IP

Application ┐
Presentation│
Session     ┘          Application

Transport              Transport

Network                Internet

Data Link  ┐
Physical   ┘           Network Access

For Network+ troubleshooting, both models are useful.

5. Understand Encapsulation

When an application sends data:

Application Data
      ↓
TCP / UDP Segment
      ↓
IP Packet
      ↓
Ethernet Frame
      ↓
Bits

At the receiving system:

Bits
 ↓
Ethernet Frame
 ↓
IP Packet
 ↓
TCP / UDP
 ↓
Application Data

This is called:

Encapsulation

and:

Decapsulation

6. Identify the Network Interface

On Linux:

ip link

On Windows:

Get-NetAdapter

Record the adapter connected to:

NETPLUS-LAB

7. Identify MAC Addresses

On Linux:

ip link show

On Windows:

getmac

Record:

ADMIN MAC:
<value>

CLIENT01 MAC:
<value>

SERVER01 MAC:
<value>

8. Review the ARP Cache

On Linux:

ip neigh

On Windows:

arp -a

Record any mappings between:

IPv4 Address
      ↕
MAC Address

9. Generate ARP Activity

From NETPLUS-ADMIN:

ping -c 2 10.10.10.20

Then:

ip neigh

You should see a neighbor entry for:

10.10.10.20

10. Capture ARP with Wireshark

Start Wireshark on NETPLUS-ADMIN.

Select the NETPLUS-LAB interface.

Apply:

arp

Generate traffic to a host whose MAC address is not already cached.

Observe:

ARP Request

and:

ARP Reply

11. Analyze the ARP Request

Look for:

Sender IP:
10.10.10.10

Target IP:
10.10.10.20

Conceptually:

Who has 10.10.10.20?
Tell 10.10.10.10

The request is normally sent using an Ethernet broadcast.

12. Analyze the ARP Reply

The destination responds:

10.10.10.20 is at <MAC>

Now the sender can construct an Ethernet frame to the correct local MAC address.

13. Understand ARP’s Role

IPv4 local communication requires:

Destination IP
      ↓
Determine Local Network
      ↓
Resolve MAC with ARP
      ↓
Build Ethernet Frame
      ↓
Transmit

ARP does not route traffic between networks.

14. Capture ICMP

Apply Wireshark filter:

icmp

From NETPLUS-ADMIN:

ping -c 4 10.10.10.30

Observe:

Echo Request
Echo Reply

15. Analyze ICMP Fields

Select an Echo Request.

Identify:

Source IP:
10.10.10.10

Destination IP:
10.10.10.30

ICMP Type:
Echo Request

Then inspect the reply.

16. Understand Ping

Ping primarily answers:

Can I exchange ICMP traffic with this destination?

It does not prove:

DNS works

Web service works

SSH works

Application is healthy

17. Test the Local Loopback

On each host:

ping 127.0.0.1

The loopback test helps validate the local TCP/IP stack.

18. Test the Local Interface Address

On NETPLUS-ADMIN:

ping -c 2 10.10.10.10

Compare with:

ping -c 2 127.0.0.1

These tests validate different parts of the local networking stack.

19. Understand TCP

TCP provides connection-oriented communication.

Important characteristics include:

Reliable Delivery

Sequencing

Acknowledgements

Flow Control

Retransmission

Connection Establishment

Applications commonly associated with TCP include:

HTTP / HTTPS
SSH
SMTP
RDP
SMB

20. Understand UDP

UDP is connectionless.

Characteristics include:

No Three-Way Handshake

No Built-In Delivery Guarantee

Low Overhead

Useful for Time-Sensitive or Simple Exchanges

Common examples include:

DNS

DHCP

NTP

SNMP

Voice / Streaming scenarios

Some applications can use both TCP and UDP.

21. Understand Ports

A port identifies an application or service endpoint.

Example:

Server IP:
10.10.10.30

TCP Port:
22

Service:
SSH

Conceptually:

IP Address
   ↓
Which Host?

Port
   ↓
Which Application?

22. Understand a Socket

A socket relationship can be represented by:

IP Address + Port

Example:

10.10.10.30:22

A TCP session is more completely identified by:

Source IP
Source Port
Destination IP
Destination Port
Protocol

23. View Listening Ports on Linux

On NETPLUS-SERVER01:

ss -tuln

For process details where permitted:

sudo ss -tulnp

Identify:

Listening TCP ports
Listening UDP ports

24. View Windows Connections

On NETPLUS-CLIENT01:

netstat -ano

Identify columns such as:

Protocol
Local Address
Foreign Address
State
PID

25. Understand TCP Connection States

Common TCP states include:

LISTENING

SYN_SENT

SYN_RECEIVED

ESTABLISHED

FIN_WAIT

TIME_WAIT

CLOSE_WAIT

You will observe several of these during the lab.

26. Prepare a TCP Service

On NETPLUS-SERVER01, use SSH if already installed.

Verify:

sudo ss -ltn | grep :22

If SSH is unavailable, you may use a benign temporary listener for the lab.

Do not expose the listener outside the isolated network.

27. Test TCP Port Connectivity

From NETPLUS-ADMIN:

nc -vz 10.10.10.30 22

If SSH is listening, expect a successful connection.

This validates:

IP Connectivity
+
TCP Connectivity
+
Port Reachability
+
Listening Service

28. Capture the TCP Handshake

Start Wireshark.

Apply:

tcp.port == 22

Run the port test again.

Look for:

SYN
SYN, ACK
ACK

29. Understand the TCP Three-Way Handshake

The process is:

Client
  |
  | SYN
  |-------------------->
  |
  | SYN-ACK
  |<--------------------
  |
  | ACK
  |-------------------->
  |
Server

Connection Established

30. Analyze the SYN Packet

Identify:

Source IP:
10.10.10.10

Destination IP:
10.10.10.30

Source Port:
Ephemeral Port

Destination Port:
22

TCP Flag:
SYN

31. Analyze the SYN-ACK Packet

The server responds:

Source:
10.10.10.30:22

Destination:
10.10.10.10:<ephemeral-port>

Flags:
SYN, ACK

32. Analyze the Final ACK

The client confirms:

ACK

At this point:

TCP Session
=
Established

33. Understand Ephemeral Ports

Clients usually choose a temporary source port.

Example:

CLIENT:
10.10.10.10:51234

SERVER:
10.10.10.30:22

The server listens on a known port.

The client usually does not.

34. Observe an Established Connection

If you establish an SSH session:

ssh <lab-user>@10.10.10.30

then on either host inspect connections.

Linux:

ss -tn

Windows:

netstat -ano

Look for:

ESTABLISHED

35. Identify the Five-Tuple

Record:

Source IP:
Source Port:
Destination IP:
Destination Port:
Protocol:

This is often referred to as the network connection’s:

Five-Tuple

36. Observe TCP Teardown

Close the session.

Capture the traffic.

Look for TCP flags involving:

FIN

ACK

or in some situations:

RST

37. Understand FIN vs RST

Conceptually:

FIN
=
Graceful connection closure

while:

RST
=
Connection reset / abrupt termination

Context determines why a reset occurred.

38. Observe a Closed TCP Port

Choose a port that is not listening on NETPLUS-SERVER01.

For example:

nc -vz 10.10.10.30 65000

Capture:

tcp.port == 65000

You may observe:

SYN
   ↓
RST

depending on host firewall behavior.

39. Compare Open vs Closed Port Behavior

Open Port

SYN
 ↓
SYN-ACK
 ↓
ACK

Closed Port

Commonly:

SYN
 ↓
RST

Filtered Port

May appear as:

SYN
 ↓
No Response

or an ICMP error, depending on filtering behavior.

40. Understand Why This Matters

A failed connection can mean:

Host Offline

Routing Problem

Firewall Filtering

Port Closed

Service Not Running

Application Problem

These are not the same issue.

41. Generate UDP Traffic

On NETPLUS-SERVER01, start a temporary UDP listener inside the lab:

nc -u -l 9999

On NETPLUS-ADMIN:

echo "NetworkPlus UDP Test" | nc -u 10.10.10.30 9999

Only use this inside the isolated lab.

42. Capture UDP

Apply:

udp.port == 9999

Observe the traffic.

Unlike TCP, you should not see:

SYN
SYN-ACK
ACK

before the data.

43. Compare TCP and UDP

Feature	TCP	UDP
Connection-oriented	Yes	No
Handshake	Yes	No
Reliability	Built in	Not built in
Sequencing	Yes	No
Lower overhead	No	Yes
Common examples	SSH, HTTPS	DNS, DHCP

44. Generate DNS Traffic

If internet or DNS access is configured on the appropriate interface, run:

nslookup example.com

or:

dig example.com

Capture:

dns

If the lab has no DNS server yet, you may use a safe temporary internet-facing adapter solely for this exercise.

45. Analyze a DNS Query

Identify:

Source IP

DNS Server

Query Name

Query Type

Response

Common query types include:

A

AAAA

More DNS record types will be covered in Lab 12.

46. Understand Name Resolution vs Connectivity

You may have:

IP Connectivity:
Working

while:

DNS:
Broken

Example:

ping 1.1.1.1

works but:

ping example.com

fails.

That suggests:

Possible DNS Problem

not necessarily a routing problem.

47. Use nslookup

Run:

nslookup example.com

Identify:

DNS Server

Resolved Address

48. Use dig

On Linux:

dig example.com

Review:

QUESTION

ANSWER

SERVER

Query Time

49. Use Traceroute

On Linux:

traceroute <destination>

or:

tracepath <destination>

On Windows:

tracert <destination>

Use a routable test destination only if internet connectivity is available.

50. Understand TTL

IPv4 includes:

TTL

or:

Time To Live

Each router reduces the TTL.

If the value reaches zero, the packet is discarded.

This prevents packets from circulating forever.

51. Understand How Traceroute Uses TTL

Conceptually:

TTL 1
 ↓
Router 1
 ↓
TTL expires

Then:

TTL 2
 ↓
Router 1
 ↓
Router 2
 ↓
TTL expires

This helps reveal the path through routers.

52. Capture Traceroute Traffic

Run traceroute while Wireshark is active.

Depending on OS and implementation, traceroute may use:

ICMP

UDP

TCP

Identify what your system uses.

53. Use netstat

On Windows:

netstat -ano

Useful options include:

-a
All connections/listeners

-n
Numeric addresses

-o
Process ID

54. Map a Windows PID to a Process

Suppose netstat shows:

PID:
1234

Run:

Get-Process -Id 1234

Now you can correlate:

Network Connection
      ↓
Process

55. Use ss on Linux

Run:

ss -tuln

Meaning:

-t
TCP

-u
UDP

-l
Listening

-n
Numeric

For active TCP sessions:

ss -tn

56. Map Linux Connections to Processes

Where authorized:

sudo ss -tunp

Identify:

Process
PID
Local Socket
Remote Socket

57. Understand Listening vs Established

A listening socket means:

Service is waiting for incoming communication

An established connection means:

Two endpoints currently have an active TCP session

58. Test Application Reachability

For a TCP service:

nc -vz <server-ip> <port>

Example:

nc -vz 10.10.10.30 22

This provides a more useful application-path test than ping alone.

59. Compare Common Connectivity Tests

Test	What It Helps Validate
`ping`	IP/ICMP reachability
`arp -a` / `ip neigh`	Local Layer 2 resolution
`traceroute`	Routed path
`nslookup` / `dig`	DNS resolution
`nc -vz`	TCP port reachability
`netstat` / `ss`	Local sockets/connections
Wireshark	Packet-level evidence

60. Troubleshooting Scenario 1 — Wrong IP Address

On NETPLUS-CLIENT01, temporarily set:

10.10.20.20/24

Try:

ping 10.10.10.30

Investigate:

ipconfig

Identify the addressing error.

Restore:

10.10.10.20/24

61. Troubleshooting Scenario 2 — Service Not Running

Stop or choose a non-listening test service on NETPLUS-SERVER01.

Then test the corresponding port.

Example:

nc -vz 10.10.10.30 <port>

Observe the difference between:

Host Reachable

and:

Service Unavailable

62. Troubleshooting Scenario 3 — ICMP Blocked

If safely supported in your lab, configure the endpoint firewall to block ICMP temporarily.

Observe:

ping fails

while a TCP service may still succeed.

This proves:

Ping Failure
≠
Host Necessarily Offline

Restore the firewall configuration afterward.

63. Troubleshooting Scenario 4 — TCP Port Blocked

Temporarily create a lab firewall rule that blocks a safe test port.

Compare:

Ping:
Works

TCP Port:
Fails

This demonstrates protocol-specific filtering.

Restore the firewall rule after testing.

64. Troubleshooting Scenario 5 — DNS Failure

Use a client with deliberately incorrect DNS configuration, or disconnect the test DNS path.

Test:

ping <known-IP>

then:

nslookup <hostname>

Expected:

IP Connectivity:
Working

DNS:
Failing

Restore DNS settings afterward.

65. Apply the Layered Troubleshooting Method

Use:

Layer 1 / Access
Is interface connected and UP?
        ↓
Layer 2
Can local neighbor resolution occur?
        ↓
Layer 3
Is addressing/routing correct?
        ↓
Layer 4
Is the port reachable?
        ↓
Application
Is the service functioning?

66. Build a Connectivity Troubleshooting Decision Tree

Can I reach loopback?
       ↓
No → Local TCP/IP issue

Yes
 ↓
Is interface UP?
       ↓
No → Adapter problem

Yes
 ↓
Correct IP and prefix?
       ↓
No → Addressing problem

Yes
 ↓
Local destination?
       ↓
Yes → Check ARP / Layer 2

No
 ↓
Check gateway / routing
       ↓
Can IP be reached?
       ↓
No → Network path issue

Yes
 ↓
Can TCP/UDP service be reached?
       ↓
No → Port / firewall / service issue

Yes
 ↓
Does application work?
       ↓
No → Application-layer issue

67. Build a Protocol Observation Table

Record:

Protocol	Trigger	Wireshark Filter	Observation
ARP	Ping local host	`arp`	MAC resolution
ICMP	Ping	`icmp`	Echo Request/Reply
TCP	Port test	`tcp`	Handshake
UDP	UDP listener	`udp`	Connectionless traffic
DNS	Name lookup	`dns`	Query/Response

68. Mission Challenge — Identify the Failure Layer

For each scenario, determine the likely layer.

Scenario A

127.0.0.1 fails

Likely:

Local TCP/IP stack

Scenario B

Interface is DOWN

Likely:

Network access/interface problem

Scenario C

Local IP responds but remote network does not

Investigate:

Gateway / Routing

Scenario D

Ping works, TCP/443 fails

Investigate:

Firewall / Port / Service

Scenario E

IP works, hostname fails

Investigate:

DNS

69. Mission Challenge — Analyze a TCP Session

Capture a connection to NETPLUS-SERVER01.

Document:

Source MAC:

Destination MAC:

Source IP:

Destination IP:

Source Port:

Destination Port:

Protocol:

SYN Packet Number:

SYN-ACK Packet Number:

ACK Packet Number:

Connection State:

70. Mission Challenge — Analyze UDP

Generate UDP traffic and document:

Source IP:

Destination IP:

Source Port:

Destination Port:

Handshake Present:
Yes / No

Acknowledgements Present:
Yes / No

Explain how this differs from TCP.

71. Mission Challenge — Explain the Full Packet Journey

Describe what happens when:

NETPLUS-ADMIN
10.10.10.10

connects to:

NETPLUS-SERVER01
10.10.10.30:22

Your sequence should include:

Application requests SSH connection
      ↓
TCP selects destination port 22
      ↓
IP identifies destination 10.10.10.30
      ↓
System determines destination is local
      ↓
ARP resolves server MAC if needed
      ↓
Ethernet frame transmitted
      ↓
TCP three-way handshake
      ↓
Connection becomes ESTABLISHED
      ↓
Application data exchanged

72. Save Packet Captures

Save:

LAB02-ARP.pcapng

LAB02-ICMP.pcapng

LAB02-TCP-HANDSHAKE.pcapng

LAB02-UDP.pcapng

LAB02-DNS.pcapng

under:

~/NetworkPlus-Labs/LAB02/Captures/

73. Create the Lab Workspace

On NETPLUS-ADMIN:

mkdir -p ~/NetworkPlus-Labs/LAB02/{Captures,Screenshots,Configs,Notes}

Create:

touch ~/NetworkPlus-Labs/LAB02/Notes/lab02-notes.md

74. Document Your Findings

Use:

# LAB02 — TCP/IP and Network Connectivity Fundamentals

## Environment

### NETPLUS-ADMIN

IP:
MAC:
Interface:

### NETPLUS-CLIENT01

IP:
MAC:
Interface:

### NETPLUS-SERVER01

IP:
MAC:
Interface:

## ARP

Observed Request:

Observed Reply:

Neighbor Mapping:

## ICMP

Source:

Destination:

Echo Request:

Echo Reply:

## TCP

Source IP:

Source Port:

Destination IP:

Destination Port:

### Three-Way Handshake

SYN:

SYN-ACK:

ACK:

### Connection State

Document findings.

## UDP

Source:

Destination:

Port:

Observation:

## DNS

DNS Server:

Query:

Response:

## Active Connections

Document netstat / ss observations.

## Troubleshooting

### Scenario 1

Problem:

Root Cause:

Fix:

### Scenario 2

Problem:

Root Cause:

Fix:

## Final Assessment

Summarize how TCP/IP communication occurred between the lab systems.

75. Evidence to Capture

Capture:

01-ip-configuration.png
02-mac-addresses.png
03-arp-cache.png
04-arp-request.png
05-arp-reply.png
06-icmp-request.png
07-icmp-reply.png
08-listening-ports.png
09-tcp-syn.png
10-tcp-syn-ack.png
11-tcp-ack.png
12-established-session.png
13-closed-port-test.png
14-udp-capture.png
15-dns-query.png
16-dns-response.png
17-netstat.png
18-ss-output.png
19-traceroute.png
20-layered-troubleshooting.png
21-final-protocol-table.png

76. Validation Checklist

TCP/IP

TCP/IP model reviewed
OSI comparison understood
Encapsulation understood
Decapsulation understood

Layer 2

MAC addresses identified
ARP table reviewed
ARP request captured
ARP reply captured
IP-to-MAC mapping understood

ICMP

Loopback tested
Local host ping tested
Remote lab host ping tested
Echo Request captured
Echo Reply captured
Ping limitations understood

TCP

Listening TCP port identified
TCP port connectivity tested
SYN captured
SYN-ACK captured
ACK captured
Three-way handshake understood
Ephemeral port identified
Five-tuple recorded
Established connection observed
Connection teardown reviewed
Closed-port behavior observed

UDP

UDP listener created safely
UDP traffic generated
UDP captured
TCP and UDP differences understood

DNS

DNS query generated where available
DNS traffic captured
Query and response identified
DNS failure distinguished from IP failure

Tools

ping used
arp / ip neigh used
traceroute / tracert used
netstat used
ss used
nc used
Wireshark filters applied

Troubleshooting

Incorrect-address scenario completed
Service-down scenario understood
ICMP filtering scenario understood
Port filtering scenario understood
DNS failure scenario understood
Layered troubleshooting method applied

Documentation

Protocol observation table completed
Packet captures saved
Evidence screenshots captured
Lab notes completed

77. Mission Review

In this mission, you moved from simply checking:

Can I reach another computer?

to understanding:

How does the communication happen?

The process now looks like:

Application
    ↓
TCP / UDP
    ↓
Ports
    ↓
IP
    ↓
Local or Remote Decision
    ↓
ARP / Gateway
    ↓
Ethernet
    ↓
Network

For a local TCP connection:

Application Request
      ↓
Destination IP + Port
      ↓
ARP Resolution
      ↓
Ethernet Frame
      ↓
TCP SYN
      ↓
SYN-ACK
      ↓
ACK
      ↓
ESTABLISHED
      ↓
Application Data

The key lesson is:

Effective network troubleshooting requires identifying which layer is failing rather than treating every connectivity problem as the same issue.

Skills Developed

After completing this mission, you should be able to:

explain the TCP/IP model
explain encapsulation
differentiate MAC and IP addressing
explain ARP
analyze ICMP
explain TCP and UDP
identify TCP and UDP ports
understand sockets
identify ephemeral ports
analyze the TCP three-way handshake
recognize TCP connection states
distinguish open, closed, and filtered ports
inspect active connections
correlate processes with connections
capture network traffic with Wireshark
distinguish DNS problems from connectivity problems
troubleshoot networks using a layered methodology

What’s Next?

Lab 03 — IPv4 Addressing and Subnetting

You now understand how packets, protocols, ports, and local connectivity work.

The next mission focuses on one of the most important Network+ skills:

IPv4 Subnetting

You will learn to calculate and configure:

IPv4 addresses
subnet masks
CIDR prefixes
network addresses
broadcast addresses
usable host ranges
host capacity
binary subnetting
subnet boundaries
multiple subnets
VLSM fundamentals
enterprise addressing plans
addressing-related troubleshooting

The progression becomes:

IP Address
     ↓
Subnet Mask
     ↓
Network Boundary
     ↓
Host Range
     ↓
Broadcast
     ↓
Subnet Design
     ↓
Enterprise Address Plan

➡️ Next: Lab 03 — IPv4 Addressing and Subnetting