Practical Lab: Networking Fundamentals · Complete Computer Internals

Objective

Find out how your own PC is connected: its network card, MAC address, IP address, gateway, DNS, neighbours, open sockets and the path to the Internet. You only look. Nothing in this lab changes any setting.

Time: 30–40 minutes
You need: A Windows PC on a network you own or are allowed to use (home Wi-Fi or a cable). No extra software is required. (One free optional tool is named in Part 7.)

Safety rules for this lab.

Only look at your own PC and network. Do not scan other people's networks or other people's devices. Scanning machines you do not own can be treated as an attack and may be illegal.

Use ping and tracert only against your own router or normal public sites such as example.com.

Do not run ipconfig /release, /renew or /flushdns, and do not change router, DNS or firewall settings.

What to Open

Tool	How to open it
PowerShell	Press `Win`, type `PowerShell`, press Enter (normal, not admin)
Command Prompt	Press `Win`, type `cmd`, press Enter
Task Manager	Press `Ctrl + Shift + Esc`, open the Performance tab
Resource Monitor	Press `Win + R`, type `resmon`, press Enter, open the Network tab

Part 1: My Network Card (Section 1)

Get-NetAdapter
getmac /v

Name of my active adapter (Status = Up; Wi-Fi or Ethernet): ________________
MAC address (six hex pairs): ________________
Link speed (for example 1 Gbps or 866.7 Mbps): ________________
First half of the MAC (the OUI): ________________ (it names the chip's maker)

Now open Task Manager → Performance and click Ethernet or Wi-Fi.

Do you see the adapter name and IPv4 address shown there? ________________
Open a video or download a file and watch the Send / Receive graph move: ________________

Part 2: My Addresses (Section 2)

ipconfig
ipconfig /all

On the line for your active adapter, write down:

IPv4 Address: ________________
Subnet Mask: ________________
Default Gateway: ________________
DHCP Enabled / DHCP Server: ________________
Lease Obtained / Lease Expires: ________________
DNS Servers: ________________
Is your IPv4 address in a private range (10.x, 172.16-31.x, 192.168.x)? ________________
Do you have an IPv6 address, and does the link-local one start with fe80::? ________________

Do the maths (Section 2.3). If your mask is 255.255.255.0 (/24):

Network address: ________________ Broadcast address: ________________
Number of usable hosts: ________________ (answer: 254)

The same facts in PowerShell:

Get-NetIPConfiguration

Part 3: My Neighbours, ARP (Section 3)

arp -a

Find your gateway's IP in the list. What is its MAC address? ________________
Does it match the MAC of your router (usually printed on the router's label)? ________________

Now make ARP work for you. Replace 192.168.1.1 with your gateway:

ping 192.168.1.1
arp -a

Did a new entry appear, or did a "dynamic" entry stay? ________________
What are the entries with ff-ff-ff-ff-ff-ff and 01-00-5e-...? ________________ (broadcast and multicast)

Part 4: DNS (Section 4)

nslookup example.com
Resolve-DnsName example.com
Resolve-DnsName example.com -Type AAAA
Resolve-DnsName example.com -Type MX

Which server answered (first lines of nslookup)? Is it your gateway? ________________
What IPv4 address does example.com have? ________________
In Resolve-DnsName, what is the TTL in seconds? ________________
Run the same Resolve-DnsName example.com again. Did the TTL go down? ________________ (a cached answer counts down)

Now look at your PC's DNS cache:

ipconfig /displaydns

Find a Record Name you recognise. What Time To Live does it show? ________________

Part 5: Sockets and Ports (Sections 6 and 7)

netstat -ano

How many lines have the state LISTENING? ________________
Find a line with ESTABLISHED. What is the foreign port (often 443)? ________________
What is the PID on that line? ________________ Look it up in Task Manager → Details (the PID column). Which program is it? ________________
Which listening lines use 127.0.0.1 (local only) and which use 0.0.0.0 (all addresses)? ________________

Open Resource Monitor → Network tab. Look at TCP Connections and Listening Ports.

Which program uses the most network data right now? ________________

For one ESTABLISHED line, write the 5-tuple (Section 7.2):

Protocol: ____ Source IP: ____ Source port: ____ Destination IP: ____ Destination port: ____

Part 6: Routing and the Path Out (Section 8)

route print
tracert example.com

In route print (IPv4 section), find the row 0.0.0.0 0.0.0.0. What gateway is shown? ________________ Does it match Part 2?
Which row covers your own network (say 192.168.1.0) and says On-link? ________________
In tracert, how many hops did it take? ________________ Is hop 1 your gateway? ________________
Did any hop show * * *? ________________ Did later hops still answer?

Test the troubleshooting ladder from Section 8.3:

ping 127.0.0.1
ping 192.168.1.1
ping 8.8.8.8
ping example.com
Test-NetConnection example.com -Port 443

Which step is the first to fail (if any)? ________________
What does TcpTestSucceeded : True tell you about TCP? ________________

Part 7 (Optional): Watch Packets with Wireshark

Wireshark is a free third-party packet viewer (not part of Windows). Download it only from the official Wireshark website. It also installs a capture driver, so install it only if you are comfortable doing so.

Start Wireshark and double-click your active adapter (Wi-Fi or Ethernet).
Type dns in the filter bar and press Enter.
In a browser, open any page. Watch the Standard query and Standard query response lines appear.
Click one packet and expand Ethernet II, Internet Protocol Version 4, User Datagram Protocol and Domain Name System in the lower pane, as in Figure 27.6.
Stop the capture when you are done.

Capture only your own network. Listening to traffic on a network you do not own or have no permission to monitor can be illegal.

What is the destination port of a DNS query? ________________
What is the source port, and why is it so high (Section 7.1)? ________________

What Should Happen

Part 1 and 2 show your adapter, MAC, IP, mask, gateway, DHCP server and DNS.
Part 3 shows your gateway's MAC in the ARP cache.
Part 4 shows a name turning into an IP, and a TTL that counts down.
Part 5 shows many LISTENING sockets and a few ESTABLISHED ones, each with a PID.
Part 6 shows the default route and a first hop equal to your gateway.

Interpretation Guide

What you see	What it means
IPv4 address `169.254.x.x`	DHCP failed (APIPA, Section 5)
Address `192.168.x.x`, mask `255.255.255.0`	A normal home /24 network
Default gateway empty	No route to other networks; no Internet
Link speed 100 Mbps on a cable	Possibly a bad cable or an old port (Section 1.4)
Gateway MAC missing from `arp -a`	Not on the same network, or the router did not answer
`nslookup` says "Non-authoritative answer"	The answer came from a cache, which is normal
`ping 8.8.8.8` works but `ping example.com` fails	DNS problem
`tracert` hop 1 is your gateway	Your PC sends outside traffic to the router, as in Section 8.3
`* * *` on one hop	A router that does not reply; not necessarily broken
Many `LISTENING` entries on `0.0.0.0`	Services waiting for requests; the firewall decides who may reach them
Foreign port 443 on ESTABLISHED	An HTTPS connection (web, or an app using HTTPS)
TcpTestSucceeded : False	Blocked, closed port, or server down (Section 6.3)

Follow-Up Questions

Your PC's IP is 192.168.1.25 and the mask is 255.255.255.0. Is 192.168.1.200 on the same network? Is 192.168.2.5?
Why does your PC ARP for the gateway's MAC when it visits a website, and not for the website's MAC?
Why does the TTL in Resolve-DnsName shrink on the second run?
Why does your browser use an ephemeral source port, but the web server uses port 443?
A friend says "I opened port 3389 on my router, so I can reach my PC from anywhere." Name two things from Sections 9 and 10 that you would want them to think about first.