OSI Model, Reconnaissance, and Network Discovery

Week 2 · Week 2: OSI Model, Reconnaissance, and Network Discovery · Download .docx

Objectives

Map each OSI layer to its function, protocol examples, and primary attack surface
Distinguish passive reconnaissance from active reconnaissance with examples of each
Interpret DNS record types and explain what a misconfigured zone transfer exposes
Identify well-known, registered, and ephemeral port ranges and common service port numbers
Explain how SYN scans differ from full TCP connect scans and why the distinction matters

Key terms

OSI model: Seven-layer framework: Physical (1), Data Link (2), Network (3), Transport (4), Session (5), Presentation (6), Application (7) — each layer adds protocol headers during encapsulation.
TTL: Time To Live — decremented by each router hop; packet is discarded at zero, preventing routing loops.
Passive reconnaissance: Intelligence gathering using only public sources — WHOIS, DNS, social media — without sending packets to the target.
Active reconnaissance: Intelligence gathering that sends packets directly to the target — riskier and potentially detectable by IDS.
WHOIS: Public lookup service returning domain registration data including registrant, registrar, nameservers, and expiry.
DNS zone transfer: A mechanism replicating all DNS records; if misconfigured, exposes the complete internal hostname and IP map.
Google dorking: Using advanced Google operators (site:, filetype:, intitle:) to find sensitive information indexed by search engines.
Shodan: A search engine for internet-connected devices that indexes service banners from open ports passively.
Banner grabbing: Connecting to an open port to read the service response — reveals software type and version.
SYN scan: A half-open TCP scan that sends SYN then resets with RST after SYN-ACK — avoids completing a logged connection.
ARP: Address Resolution Protocol — maps IP addresses to MAC addresses on the local network segment at Layer 2.

The concept

The OSI (Open Systems Interconnection) model is the conceptual framework that organizes how network communication works across seven layers. Understanding the OSI model is not just an exam topic — it is the map security professionals use to identify where attacks originate and where defenses must be placed.

Layer 1 (Physical) handles raw bit transmission over cables and wireless signals. Layer 2 (Data Link) frames data for local delivery using MAC addresses — this is where ARP operates and where ARP poisoning attacks occur. Layer 3 (Network) routes IP packets between networks — the layer where IP spoofing and routing attacks happen. Layer 4 (Transport) manages TCP (reliable, connection-oriented) and UDP (unreliable, connectionless) — port scanning and denial-of-service flooding target this layer. Layers 5–7 handle session management, data formatting, and application protocols — HTTP, HTTPS, DNS, and SMTP all operate at or near Layer 7.

Reconnaissance is the first technical phase of the ethical hacking methodology, and its core distinction is passive versus active. Passive reconnaissance collects intelligence from public sources without sending any packets to the target: WHOIS database lookups reveal domain registration metadata; DNS queries for A, MX, NS, and TXT records reveal the target's infrastructure; job postings reveal technology stacks; Shodan reveals pre-indexed service banners. A skilled attacker can build a detailed target profile without the target's systems ever seeing a single probe.

Active reconnaissance sends packets directly to the target. Ping sweeps discover live hosts. Traceroutes map the routing path. Port scans enumerate open services. Banner grabbing reads service version information from open ports. Active techniques carry IDS detection risk — this distinction matters when scoping a test or evaluating what the target can detect.

DNS is a high-value reconnaissance target. A misconfigured DNS zone transfer returns every record in the zone — every hostname, internal IP address, mail server, and subdomain. Defenders restrict zone transfers to authorized secondary nameservers. The DNS record types to know: A (hostname → IPv4), AAAA (hostname → IPv6), MX (mail exchange), NS (nameserver), TXT (SPF, DKIM, verification strings), PTR (reverse lookup), CNAME (hostname alias).

Port ranges: well-known ports 0–1023 (HTTP 80, HTTPS 443, SSH 22, DNS 53, FTP 21, SMTP 25, RDP 3389), registered ports 1024–49151 (vendor-specific services), ephemeral/dynamic ports 49152–65535 (outbound client connections).

Standards: Maryland Blueprint Pillar 3 · EC-Council CEH v12 Domain 2 (Footprinting) + Domain 3 (Scanning Networks) · PGCC INT-2681 Outcomes 1, 2, 4.

Worked examples

Example 1: [object Object]

Example 2: [object Object]

Common mistakes

Treating Shodan as an active reconnaissance tool. Shodan indexes service banners itself; the tester reads pre-indexed data without sending any packets to the target.
Confusing port 443 with security. HTTPS encrypts the transport channel but does not validate the trustworthiness of the site operator.
Assuming a SYN scan is invisible. Modern IDS systems detect SYN scan patterns from the burst of unanswered SYN packets or SYN-RST pairs.
Forgetting that DNS zone transfers reveal internal hostnames and IPs. Restricting zone transfers to authorized secondaries is a high-priority hardening step.

Self-check

Try each one before you look. A miss here costs nothing and tells you exactly what to reread.

1. Which DNS record type maps a hostname to an IPv4 address?

2. Shodan is classified as a passive reconnaissance tool because:

3. The ARP protocol operates at which OSI layer and does what?

Canvas is the official record. This companion enhances the PGCC curriculum; it does not replace it. Last name and class year only. Students with a 504 plan or IEP: your accommodations apply.

↑ Back to top