A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
An IP address identifies an interface endpoint, not a service. A TCP port identifies an application endpoint within that host context. CIDR notation combines an address with a prefix length such as `/24`, which defines the network portion. Security scripts that handle targets need to validate which of these concepts they are receiving instead of accepting any string that merely “looks host-like.”
`ss` reports local and peer addresses plus state. `LISTEN` means a socket is accepting new connections; `ESTAB` means a connection is currently established. UDP does not have the same connection state model. Parsing output without knowing the protocol is a common source of false positives.
When `ipcalc` is installed, this makes the network/prefix relationship easy to inspect; it is an optional convenience tool. The useful habit here is to treat the command output as evidence about one system fact, not as a magical diagnosis.
Tool choice is situational. Start with the narrowest command that answers the question, then escalate to a heavier tool only when the first observation leaves a real gap.
Port numbers alone carry weak meaning. TCP/22 often suggests SSH, but applications can be configured elsewhere, and a port can be occupied by an unexpected process. Enumeration should discover the service identity rather than trust a port-to-service assumption.
Shows the basic host:port notation a script might carry between pipeline stages. Read the result in context: the same command can be correct yet insufficient if a permission boundary, alternate configuration, or different backend changes what it reports.
Queries the local services database for the conventional SSH service name and port mapping. In a production workflow, save the raw result when the observation contributes to a finding. That keeps later analysis honest and makes troubleshooting reproducible.
A practitioner’s checkpoint: compare the observed behavior with the assumption your script is about to make. If the assumption is broader than the evidence, narrow the rule. If the evidence is incomplete, report the uncertainty instead of converting it into a confident finding.
Lab discipline: stay inside the declared course environment, prefer read-only checks for learning exercises, and preserve the original output of security tools before transforming it.
Finish the lesson once you have worked through the material. This awards ★ 35 XP.