Step 6. Checking the Network — Inspecting My Computer’s Outside Lines

Level 0 — Understanding Computer Operation and Structure | Difficulty ★★☆☆☆ | Estimated time: 2–3 hours

Prerequisite: Step 5. Use Windows PowerShell 5.1 or PowerShell 7 on Windows, with internet access.

• Scope: inspect your PC’s configuration and connections, and send a few diagnostic ICMP, DNS, and TCP requests to the named targets below. Do not alter network settings or explore arbitrary address ranges.
• Deliverable: address, gateway, and DNS notes, plus network-report.txt containing successes and failures.
• Core idea: distinguish IP, default gateway, and DNS. One test cannot certify or diagnose the entire internet connection.

Checking where a PC communicates is a starting point for fault and incident investigation. Addresses or counts alone cannot identify malicious traffic. Practice explaining what you observed and what the test actually established. Follow the permitted targets and policies on work or school networks. Keep real IP, MAC, and device details local; mask them in shared captures.

1. Learning Objectives

• Find and explain your IP address, default gateway, and DNS servers.
• Read ICMP responses, DNS queries, and TCP tests separately.
• Interpret local and remote endpoints and TCP state in netstat.
• Build a report that preserves both successful observations and an expected name-query failure.

2. Background Knowledge — Addresses and Routes

2-1. IP and Private Addresses

192.168.0.15 is an IPv4 example. IPv6 uses a different notation, such as ::1. Addresses belong to interfaces, and a PC can have several. Private IPv4 ranges are 10.0.0.0/8, 172.16.0.0/12 (172.16 through 172.31), and 192.168.0.0/16. These are used in homes, companies, labs, and networks connected through VPNs.

In a typical home IPv4 NAT setup, the router translates internal addresses for outside communication. Another NAT at the provider can mean the router’s outside address is not public. Tailscale can use 100.64.0.0/10, a shared-address range distinct from RFC 1918 private space; this does not mean every address beginning with 100.

2-2. Default Gateways and DNS

A default gateway is the next hop used when no more specific route applies. It is often the home router, but its address varies. Multiple adapters and VPNs can select different paths for different destinations.

DNS queries records for names. A records contain IPv4 addresses; AAAA records contain IPv6 addresses. Multiple answers and differences by time, region, or VPN DNS configuration are possible. A successful ping by name may use a cached address, so it does not prove a fresh query to a DNS server. Browser secure-DNS settings can also differ from OS name resolution.

2-3. Ports and Test Scope

TCP and UDP ports identify transport endpoints. Port 443 commonly serves HTTPS and 22 commonly serves SSH, but a port number does not establish application identity or safety. ICMP has no equivalent TCP/UDP port.

3. Follow Along

Before you begin. Probe results apply to the selected address, protocol, port, and time. ICMP failure does not prove that a host or a web application is unavailable.

3-1. Inspect Addresses, Gateways, and DNS

ipconfig /all

Note the adapter name alongside its IPv4 address, default gateway, and DNS servers. These are fictional example values. Labels vary with Windows language and adapter type:

IPv4 address:   192.168.0.15
Default gateway: 192.168.0.1
DNS server:      192.168.0.1

A private address does not prove internet access. Check interface state, gateway, and destination route together. A MAC address is a link-layer address that can be changed or randomized, not a permanent device serial number.

3-2. Inspect PowerShell Objects

Get-NetIPAddress -AddressFamily IPv4 | Select-Object IPAddress, InterfaceAlias, PrefixLength, AddressState

Selecting properties explicitly produces the table we want. Get-NetIPAddress alone does not collect gateway and DNS information; also use:

Get-NetIPConfiguration

127.0.0.1 is IPv4 loopback inside this PC. localhost is a name and may also resolve to IPv6 loopback ::1. Multiple vEthernet or VPN interfaces can be part of a valid configuration. An address alone is not enough to label one interface “the real adapter.”

3-3. Check ICMP Replies — Test-Connection

Send two requests to local loopback first:

Test-Connection 127.0.0.1 -Count 2 -Quiet

-Quiet returns True/False instead of a table. For one target, True means at least one request received a reply; it does not mean all requests succeeded or the internet works. Next, test one external ICMP target:

Test-Connection 8.8.8.8 -Count 2 -Quiet

8.8.8.8 is a Google Public DNS address, but ping does not query its DNS service. False or timeout can reflect ICMP filtering, response policy, or a path problem. True can coexist with failure of another site’s DNS, TCP, or TLS. Detailed output and parameters differ between PowerShell 5.1 and 7, so these examples use the shared positional target, Count, and Quiet options.

3-4. Test DNS and TCP Separately

Resolve-DnsName google.com -Type A -DnsOnly

Look for A records or distinguish a name-not-found error from a timeout. Addresses and answer counts need not match another PC. Then test TCP 443 for the same name:

Test-NetConnection -ComputerName google.com -Port 443 -InformationLevel Detailed

Read TcpTestSucceeded and the selected RemoteAddress. PingSucceeded can be False while TcpTestSucceeded is True. Comparing a ping to 8.8.8.8 with a failed ping to google.com does not establish DNS failure: these are different destinations.

3-5. Read Connection Rows — netstat

netstat -an | Select-String ESTABLISHED

These are TCP rows in the ESTABLISHED state. They can include internet, LAN, VPN, and loopback traffic. This filter does not show all UDP or HTTP/3 QUIC traffic. The following documentation address is a fictional reading example, not a test target:

TCP  192.168.0.15:51234  203.0.113.10:443  ESTABLISHED

The left endpoint is local, the right endpoint is remote, and the final field is TCP state. Port 443 cannot identify a particular company, browser, or legitimate HTTPS session. Classifying an address as domestic or foreign does not establish trust.

A text search for 443 also matches values such as 1443 or an ephemeral local port. Filter the actual remote-port property when you need exactly 443:

Get-NetTCPConnection |
  Where-Object {$_.State -eq 'Established' -and $_.RemotePort -eq 443} |
  Select-Object -First 20 LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess

OwningProcess is the owning process ID. Processes and connections can disappear between queries. This shows at most 20 rows; zero is possible. Browsers can reuse or retain connections and use QUIC, so opening and closing one tab need not add and remove one TCP row.

3-6. Observe Name Failure Without Changing Settings

An arbitrarily chosen private IP may belong to a real device. Use a reserved .invalid name for this failure exercise instead. The final dot marks an absolute DNS name.

try {
  Resolve-DnsName no-such-host.invalid. -Type A -DnsOnly -ErrorAction Stop
  "Unexpected answer: inspect the resolver; do not treat this as the expected result."
} catch {
  "Name query failed: $($_.FullyQualifiedErrorId)"
}

A name-not-found error is the usual outcome; the illustrated environment returned DNS_ERROR_RCODE_NAME_ERROR. If you see a timeout or another error, record it accurately. An answer is unexpected and calls for inspecting resolver behavior. The prepared try/catch pattern turns an error into readable text; later lessons cover error handling in more detail.

4. Missions and Exercises

Mission — My Network Observation Report

Create network-report.txt in a new dedicated folder. Include collection time, adapter configuration, external ICMP outcome, DNS A query, TCP 443 test, .invalid failure, and ESTABLISHED row count. Both successes and failures are learning results. Do not hide ping failures or change network settings just to obtain a success.

Exercises

1. A ping to 8.8.8.8 succeeds and one to google.com fails. Can you conclude that DNS is broken?
2. Identify the local and remote endpoints and state in the fictional netstat row. Does it establish legitimate web browsing?
3. What does a successful ping to 127.0.0.1 establish?
4. What should you investigate when you see 169.254.x.x?
5. Does command | Out-File automatically save errors shown on screen?

$netlab = Join-Path $HOME ('infosec-step06-' + [guid]::NewGuid().ToString('N'))
New-Item -ItemType Directory -Path $netlab -ErrorAction Stop
$networkReport = Join-Path $netlab 'network-report.txt'
Get-Date -Format o | Out-File -LiteralPath $networkReport -Encoding UTF8
"=== Local adapter configuration ===" | Out-File -LiteralPath $networkReport -Append -Encoding UTF8
ipconfig /all | Out-File -LiteralPath $networkReport -Append -Encoding UTF8 -Width 4096
"ipconfig exit code: $LASTEXITCODE" | Out-File -LiteralPath $networkReport -Append -Encoding UTF8

"=== ICMP to 8.8.8.8 (not a DNS test) ===" | Out-File -LiteralPath $networkReport -Append -Encoding UTF8
try {
  $icmpResult = Test-Connection 8.8.8.8 -Count 2 -Quiet -ErrorAction Stop
  "At least one echo reply: $icmpResult" | Out-File -LiteralPath $networkReport -Append -Encoding UTF8
} catch {
  "ICMP query failed: $($_.FullyQualifiedErrorId)" | Out-File -LiteralPath $networkReport -Append -Encoding UTF8
}

"=== DNS A query for google.com ===" | Out-File -LiteralPath $networkReport -Append -Encoding UTF8
try {
  Resolve-DnsName google.com -Type A -DnsOnly -ErrorAction Stop |
    Format-List Name, Type, IPAddress |
    Out-File -LiteralPath $networkReport -Append -Encoding UTF8 -Width 4096
  "DNS query completed" | Out-File -LiteralPath $networkReport -Append -Encoding UTF8
} catch {
  "DNS query failed: $($_.FullyQualifiedErrorId)" | Out-File -LiteralPath $networkReport -Append -Encoding UTF8
}

"=== TCP to google.com port 443 (not an HTTPS test) ===" | Out-File -LiteralPath $networkReport -Append -Encoding UTF8
try {
  Test-NetConnection -ComputerName google.com -Port 443 -InformationLevel Detailed -ErrorAction Stop |
    Format-List ComputerName, RemoteAddress, RemotePort, TcpTestSucceeded |
    Out-File -LiteralPath $networkReport -Append -Encoding UTF8 -Width 4096
} catch {
  "TCP query failed: $($_.FullyQualifiedErrorId)" | Out-File -LiteralPath $networkReport -Append -Encoding UTF8
}

"=== Reserved invalid-name query ===" | Out-File -LiteralPath $networkReport -Append -Encoding UTF8
try {
  Resolve-DnsName no-such-host.invalid. -Type A -DnsOnly -ErrorAction Stop | Out-Null
  "Unexpected answer for .invalid: inspect the resolver" | Out-File -LiteralPath $networkReport -Append -Encoding UTF8
} catch {
  "Name query failed: $($_.FullyQualifiedErrorId)" | Out-File -LiteralPath $networkReport -Append -Encoding UTF8
}

"=== Observed ESTABLISHED TCP rows (includes local traffic) ===" | Out-File -LiteralPath $networkReport -Append -Encoding UTF8
$tcpRows = @(netstat -an)
"netstat exit code: $LASTEXITCODE" | Out-File -LiteralPath $networkReport -Append -Encoding UTF8
($tcpRows | Select-String ESTABLISHED | Measure-Object).Count |
  Out-File -LiteralPath $networkReport -Append -Encoding UTF8
$networkReport

Get-Content -LiteralPath $networkReport -Encoding UTF8

6. Common Pitfalls and Fixes

Many virtual adapters: VPN and virtualization software can add interfaces, routes, and DNS settings. Do not turn off Tailscale or reset settings for this lesson. Interpret results in relation to the destination and path.

Ping fails but the browser works: consider ICMP restrictions and path differences such as proxies. Test-NetConnection does not reproduce the browser’s proxy, TLS, or login flow.

A 169.254.x.x address: this is link-local space, generally for communication on the same link. Distinguish it from internet access through another interface or IPv6.

An empty or incomplete report: reread it and inspect errors, False results, and exit codes. Errors do not automatically enter a normal pipeline. After opening a new PowerShell session, rerun the mission block to initialize its variables.

Unexpected connection counts: counts change live. A count, country, or port alone cannot classify traffic as safe or malicious.

7. Summary

Inspect configuration → test ICMP, DNS, and TCP separately → observe connections → record successes and failures. Carry forward the habit of stating which test established which fact. Step 7 explains the variables and data types used in these prepared examples.

Practice verification record

Historical record. The dated record below describes the earlier lesson version. The current instructions include subsequent editorial corrections; that record does not certify every revised example.

On 2026-09-10, every executable block was run in order using Windows PowerShell 5.1.26100.9444 and PowerShell 7.6.5. Verification covered local configuration, loopback and external ICMP, DNS A lookup, TCP 443, reserved-name failure, and report persistence. A separate local TCP fixture demonstrated that netstat also includes loopback. Raw network details were kept private. Firewall, DNS, and VPN settings were unchanged. These observations do not validate another environment or time, TLS, or web application behavior.

Microsoft: Test-Connection · Resolve-DnsName · Test-NetConnection · netstat · RFC 6761: special-use names · RFC 1918: private addresses · RFC 3927: IPv4 link-local · Tailscale addresses