Lesson 2: What the Hell Is an IP Address?
If you’re learning hacking from the beginning, one of the first things you need to understand is an IP address. You’re going to see IP addresses constantly. Nmap will ask you for one. Logs will be full of them. Servers have them. Routers have them. Your Kali machine has one. The target in a legal practice lab has one. If you don’t understand what an IP address represents, you’re basically typing numbers into tools and hoping something interesting happens.
An IP address is an address assigned to a device on a network. Think about your house. If somebody wants to send you a package, they need an address that tells the delivery company where that package needs to go. Networks work on a similar idea. When one computer needs to send information to another computer, it needs to know where that computer is on the network. That’s one of the jobs of an IP address.
You’ve probably seen an address that looks something like this:
That’s an IPv4 address. IPv4 addresses contain four numbers separated by periods, with each number ranging from 0 to 255. Underneath the human-readable format, it’s a 32-bit number. You don’t need to start doing binary math on day one, but you should understand that 192.168.1.25 isn’t just some random ID somebody made up. It represents an address that networking equipment can use to route traffic.
Here’s where beginners usually get confused: private and public IP addresses are not the same thing. Your laptop might have an address like 192.168.1.25, while websites on the internet see a completely different public IP associated with your internet connection. That 192.168.x.x address normally only means something inside your local network. Millions of completely unrelated networks can use the same private addresses without conflicting with each other.
The main IPv4 private address ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Don’t worry if /8, /12, and /16 look like alien shit right now. That’s CIDR notation, and we’ll get to subnetting later. For now, start recognizing 10.x.x.x, 172.16.x.x through 172.31.x.x, and 192.168.x.x as addresses commonly used on private networks.
So how does your computer get one? On most home and office networks, DHCP handles that automatically. When your laptop connects to Wi-Fi, it can basically say, “Yo, I’m here. Give me network settings.” A DHCP server—usually your router on a home network—can respond with an IP address, subnet mask, default gateway, DNS servers, and some other information. That’s why you normally don’t have to manually configure an IP every time you connect to Wi-Fi.
Now we need to talk about the default gateway, because this is another thing you’re going to see constantly. Your computer knows how to communicate with devices on its local network, but what happens when it needs to reach something outside that network? It sends the traffic toward its default gateway. On a typical home network, that gateway is your router. If your computer is 192.168.1.25, your router might be something like 192.168.1.1.
If you’re on Linux, open a terminal and run:
ip addr
Don’t attack anything. Just look at your own machine. Find the network interface you’re currently using and look for a line containing inet. You might see something like 192.168.1.25/24. That is your machine's IPv4 address on that interface, followed by the network prefix.
Next run:
ip route
You should see something resembling default via 192.168.1.1. That tells you where your machine sends traffic when the destination isn’t on a more specifically known route. Congratulations—you’re already doing something more useful than blindly opening Metasploit. You’re asking the operating system how it actually sees the network.
There’s another address you need to recognize immediately: 127.0.0.1. This is the IPv4 loopback address, commonly called localhost. When software connects to 127.0.0.1, it’s communicating with the local machine rather than going out across the physical network. This becomes extremely important later because services can be configured to listen only on localhost, on one network interface, or more broadly.
Try this:
ping 127.0.0.1
Then try pinging your gateway using the address you found with ip route. For example:
ping -c 4 192.168.1.1
You’re not hacking anything here. You’re learning how your own machine communicates. ping commonly uses ICMP to test reachability and measure response time. Also remember that a failed ping does not automatically mean a machine is offline. Firewalls and network policies can block ICMP while allowing other traffic. That little distinction becomes important when you eventually start doing network reconnaissance in your own lab.
And this is where hacking starts becoming less mysterious. Later, when you run a scanner against an authorized lab target and see something like 192.168.56.105, you shouldn't just see four numbers. You should immediately start asking questions. Is that a private address? What subnet am I on? Is the target local to me? What's my gateway? Which route will traffic take? Which services are listening on that host? Those questions are what turn you from somebody who knows hacking commands into somebody who actually understands what the commands are doing.
Before moving on, make sure you can explain IP address, private IP, public IP, localhost, DHCP, and default gateway in your own words. Don't worry about memorizing every networking concept yet. Get the mental model right first.
Source: r/DaemoncoreAcademy · by /u/ChameleonCRM