Network theory for incident responders

A subnet is a range of addresses that share a broadcast domain: hosts inside it talk to each other through a switch, without a router ever seeing the traffic. A VLAN is the switch-level construct that keeps those domains apart on shared hardware. The practical consequence for an analyst is blunt — traffic inside one segment is usually invisible to the perimeter, so 'the firewall did not log it' is not evidence that it did not happen.

CIDR notation (10.42.24.0/24) states the network and how many bits of it are fixed. A /24 leaves 254 usable host addresses, a /16 leaves 65 534, and the mask is what a host uses to decide whether a destination is local or has to be handed to the gateway. Recording the CIDR of the seat you worked from is what makes your findings reproducible by the next analyst.

Zones group segments by trust: corporate endpoints, server farm, DMZ, management and OT. Rules are almost always written zone-to-zone rather than host-to-host, which is why identifying the zone of both ends of a flow tells you most of what the rule base will decide.

A host holds a small table: one connected route per interface, and a default route pointing at the gateway. Anything not matching a connected route goes to the gateway, which is a layer-3 switch or router with a leg in each VLAN. That device is where inter-VLAN policy and netflow export usually live, so naming it is a real finding, not trivia.

Traceroute exposes the hops by eliciting responses from each router along the path. In a segmented estate the first hop is the VLAN gateway and the second is often the perimeter firewall — which tells you exactly where a flow would be inspected and logged, and therefore which device's logs will corroborate a host artifact.

Asymmetric paths and policy-based routing break naive assumptions: the path out is not always the path back. When a scan result and a log disagree, the route is the first thing to re-check.

Internal clients normally point at one or two recursive resolvers that are authoritative for the internal zone and forward everything else. Because every client asks the same servers, resolver query logs are the closest thing most estates have to a complete record of intent — including the intent of malware.

Knowing which resolver a host uses is therefore an investigative step, not configuration trivia: it tells you which log to pull, and a host configured to use a different resolver has just declared itself an exception worth explaining.

Attackers exploit this in both directions: they use DNS for command and control because it is rarely blocked, and they subvert resolution — a rogue resolver on the LAN, a poisoned hosts file — to redirect victims without touching the target service at all.

ARP maps an IP address to a hardware address so a switch can deliver the frame. It is unauthenticated by design: any device on the segment can answer for any address, which is what makes adversary-in-the-middle attacks on a LAN so cheap.

For an analyst the neighbor table is a discovery tool. It lists everything the host has recently spoken to on its own segment, complete with hardware addresses, and the vendor prefix of a MAC often identifies the class of device before you fingerprint a single port.

Hardware addresses are also the unit of remediation: shutting a switch port or quarantining a device is keyed on the MAC, not the lease. A finding filed without one leaves the network team nothing to act on.

A rule base is an ordered list: the first statement matching source zone, destination zone, protocol and port decides, and a default deny sits at the bottom. Because matching is first-hit, the order of statements is as important as their content, and a broad permit high in the list quietly overrides everything narrower beneath it.

Analysts usually record denials and forget permits, which is backwards. When an intrusion crosses a boundary it almost always uses a permitted path — the one port the DMZ may use to reach the server farm, the proxy that may reach the internet. Explaining a crossing by the rule that allowed it is what turns an observation into a change request.

Where no specific statement exists, the catch-all deny enforces the boundary. Naming that catch-all in a report distinguishes a deliberate boundary from an accidental one and shows the base terminates safely.