Step 6. Checking the Network — Inspecting My Computer’s Outside Lines

Level 0 — Understanding How to Operate a Computer and How It’s Structured | Difficulty ★★☆☆☆ | Estimated time: 2–3 hours

Prerequisites: Step 5 complete. We’ll work in Windows PowerShell. Today you’ll need an internet connection.

What you need: a Windows PC, PowerShell, an internet connection.
Safety: today’s experiments are all "check" commands. One experiment pings a nonexistent address, but it’s just a diagnostic signal leaving your own computer — perfectly safe.
Caution: three concepts (IP, gateway, DNS) are today’s skeleton. First grasp them through analogies, confirm them in the exercises, and pin them down again in the summary.

Today is day one on security’s main stage: the network. If you found a call to an unknown number on your phone bill, you’d wonder "who is that?" Computers are the same — behind your back they’re holding countless conversations with outside addresses, and malware secretly phoning home to its base hides among those conversations. Knowing how to see "what is my computer connected to right now" is a staple of incident investigation, and attackers run the same checks first when they enter a network. The goals are opposite; the tools are the same.

1. Learning Objectives

By the end of this chapter, you can:

Find and explain your PC’s IP address, default gateway, and DNS server
Check connectivity with Test-Connection (ping)
Distinguish a DNS problem from a connection problem during an internet outage
Read the list of currently established external connections with netstat -an

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	PowerShell 5.1 + Windows network diagnostic commands
Today’s commands	`ipconfig /all` (check addresses), `Get-NetIPAddress` (PowerShell-style addresses), `Test-Connection` (ping), `netstat -an` (connection list)
Concepts you need	IP address, default gateway, DNS, ports, private/public addresses, `127.0.0.1` (localhost)

2-1. IP Addresses — My Home Address on the Network

To find a computer on a network, you need an address. That’s the IP address. It looks like 192.168.0.15 — four chunks of numbers.

The structure you’d typically see on a home network:

[my PC: 192.168.0.15] ─┐
[phone: 192.168.0.22] ─┼─ [router: 192.168.0.1] ─── Internet ─── [Google: 142.250.x.x]
[laptop: 192.168.0.30] ─┘

Addresses starting with 192.168.x.x are in-house (private) addresses. Internal numbers that work only inside the home. (Countless homes worldwide use the same numbers — our house’s 15 and someone else’s 15 can coexist.)
The real address on the internet (public IP) is held by the router as the representative. It gathers the in-house computers’ mail and delivers it outside.

2-2. The Gateway — The Front Door to the Outside

Say my PC wants to reach google.com. That address isn’t on our house’s numbering plan. So who do we hand the letter to? To the front door — the gateway. At home, that’s the router.

"Default gateway = the address of the door leading to the outside world" — usually 192.168.0.1 (the router). If this door is blocked, everything inside the house can see each other, but nothing outside works.

2-3. DNS — The Phone Book That Turns Names into Addresses

People use names like google.com, but the network moves by numeric addresses like 142.250.207.78. Who translates? DNS (Domain Name System) — a phone book service of planetary scale.

The sequence:

You: "connect to google.com"
Computer: (to the DNS server) "what’s google.com’s number?" → "it’s 142.250.207.78"
Computer: connects to that numeric address

Why DNS matters in security: if this translation is poisoned, you can ask for your bank’s address and be handed a fake number (DNS spoofing). And because malware uses DNS to look up its own base’s address, "asking about strange names frequently" can itself be a sign of infection. You’ll meet these attacks firsthand in Level 2.

2-4. Ports — Which Unit in the Building

Ports get full treatment in Step 34, but let’s preview just what today needs. If the address (IP) guides you to the building, the port is which unit in that building. The web lives at units 80/443; SSH at unit 22. A "connection" is always recorded as an address:port pair.

3. Follow Along

3-1. Checking My Address — ipconfig /all

ipconfig /all

The output is quite long. (That’s because there are multiple network cards — wired, wireless, virtual, etc.) Find the card you’re using now (usually "Wireless LAN adapter Wi-Fi" or "Ethernet adapter") and look at lines like these:

   Physical Address. . . . . . . . . : A4-B1-C1-XX-XX-XX
   IPv4 Address. . . . . . . . . . . : 192.168.0.15(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.0.1
   DNS Servers . . . . . . . . . . . : 192.168.0.1

(On Korean Windows these labels appear in Korean, e.g. IPv4 주소, 기본 게이트웨이, DNS 서버 — same lines, same meaning.)

Find today’s three key lines and write them down yourself:

Item	My value	Meaning
IPv4 Address	(e.g., 192.168.0.15)	my home address
Default Gateway	(e.g., 192.168.0.1)	the front door (router)
DNS Server	(e.g., 192.168.0.1)	where the phone book lives

(Note: the Physical Address is the MAC address — the serial number of the network card itself. If the IP is "a home address that changes when you move," the MAC is "the card’s fingerprint." For now, just remember it exists.)

3-2. The PowerShell Way — Get-NetIPAddress

You can see the same information the PowerShell way:

Get-NetIPAddress -AddressFamily IPv4

IPAddress      InterfaceAlias              PrefixLength
---------      --------------              ------------
192.168.0.15   Wi-Fi                                  24
127.0.0.1      Loopback Pseudo-Interface 1             8

One special address stands out here: 127.0.0.1 — a special address that points to "myself." It even has a name: localhost. In home terms, it’s "me, inside my own house." It’s an address you’ll keep meeting later in exercises where you run a local server. Note it down now.

(Note: on PCs with virtualization tools installed, you may see several virtual card addresses like vEthernet — that’s normal. Just find the one card you’re actually using.)

3-3. Checking Connectivity — Test-Connection (ping)

The most basic test of whether your computer is actually talking to the outside is the ping. You call out "hello, are you there?" and see if an answer comes back.

Test-Connection 8.8.8.8

Actual output on stock Windows PowerShell (5.1):

Source   Destination  IPV4Address  Bytes  Time(ms)
------   -----------  -----------  -----  --------
LEE-PC   8.8.8.8      8.8.8.8      32     33
LEE-PC   8.8.8.8      8.8.8.8      32     33
...

8.8.8.8 — a famous DNS server run free of charge by Google. The standard destination for internet tests.
If results keep coming out line by line — answers are arriving = the road to the internet is open
Time(ms) — round-trip time. A few tens of ms is comfortable

(Note: if you’ve installed the newer PowerShell 7, it shows a new format like Status: Success, Latency(ms). Both mean the same thing: "an answer came back.")

3-4. Testing by Name — Checking DNS

This time let’s call by name instead of number:

Test-Connection google.com

If this also returns results, it means DNS translation (name→number) is working too.

Today’s diagnostic formula — be sure to remember it:

ping 8.8.8.8	ping google.com	Diagnosis
✅	✅	normal
✅	❌	DNS problem (the road is open, but translation is broken)
❌	❌	connection problem itself (suspect the router/line first)

When the internet goes down, these two lines give you a first-pass diagnosis before "turning it off and on again." This is literally a corporate help desk’s first question.

3-5. Who Am I Connected To Right Now? — netstat

Today’s highlight. Let’s look at the list of outsiders actually connected to my computer at this very moment:

netstat -an | Select-String ESTABLISHED

  TCP    192.168.0.15:51234    142.250.207.78:443    ESTABLISHED
  TCP    192.168.0.15:51235    20.190.160.12:443     ESTABLISHED
  ...

How to read each line:

TCP — the name of the connection method (you can skip it for now)
Left 192.168.0.15:51234 — our side (my address:my unit number)
Right 142.250.207.78:443 — their side (Google:unit 443, i.e., a web service)
ESTABLISHED — "connection established" (we picked out only this state with Select-String — the Step 4 technique!)

If your browser is open right now, you’ll see addresses like Google or others. If cloud sync (OneDrive, etc.) is on, you’ll see those servers too. On the author’s PC, 80 connections showed up at this moment — a single browser tab makes multiple connections, so a big number is nothing to be alarmed about.

Security perspective: if this list contains an unknown overseas address or a persistent connection over a strange port, it’s a candidate for investigation. Real breach analysis includes the work of going through and judging, one by one, "is this connection a legitimate program’s?" The starting point of that judgment is knowing what this list normally looks like — the "landscape of normal" once again.

Predict first: how would netstat results differ right after you open a new site in your browser versus a few minutes later? (Answer: a new address:443 connection for the site you opened appears. Close the tab and it disappears shortly after. Try the experiment yourself.)

3-6. Full Diagnostic Drill — Breaking Things on Purpose

Let’s put the diagnostic formula to use. (A safe experiment.)

Ping a nonexistent address: Test-Connection 10.255.255.1 → observe what comes back (read the timeout-type message. A failure message is information too.)
Ping a nonexistent name: Test-Connection no-such-domain-xyz123.com → this time it’s a different kind of failure. Actual message (Korean Windows):

Test-Connection : 'no-such-domain-xyz123.com' 컴퓨터에 대한 ping 테스트를 실패했습니다.
알려진 호스트가 없습니다

(On English Windows: Testing connection to computer 'no-such-domain-xyz123.com' failed: No such host is known.)

"No such host is known" = a translation (DNS) for that name does not exist — in other words, a failure at the name stage.

Confirm that the two failures have different messages. If you can read this difference, you can narrow down what’s broken at an outage scene much faster.

4. Missions & Exercises

Mission — My Network Fact Sheet

Using today’s commands, build network-report.txt collecting your computer’s network information:

First line: time of investigation (Get-Date)
My IPv4 address, gateway, DNS server (the relevant part of the ipconfig /all output — saving the whole thing is fine too)
Result of pinging 8.8.8.8 (whether it’s normal)
Result of pinging google.com (whether DNS is normal)
Current number of ESTABLISHED connections (the count from netstat -an | Select-String ESTABLISHED | Measure-Object)

Everything stacks up with the Out-File ... -Append pattern from Step 5.

Exercises

Exercise 1. The internet is down. Test-Connection 8.8.8.8 succeeded and Test-Connection google.com failed. What’s broken?

Exercise 2. Interpret this netstat line: TCP 192.168.0.15:51234 142.250.207.78:443 ESTABLISHED.

Exercise 3. What kind of address is 127.0.0.1?

Exercise 4. ipconfig shows your IPv4 address as 169.254.x.x. What does that mean?

5. Model Answers & Completion Criteria

Mission Walkthrough

Get-Date | Out-File network-report.txt
"=== My address info ===" | Out-File network-report.txt -Append
ipconfig /all | Out-File network-report.txt -Append
"=== ping 8.8.8.8 ===" | Out-File network-report.txt -Append
Test-Connection 8.8.8.8 | Out-File network-report.txt -Append
"=== ping google.com ===" | Out-File network-report.txt -Append
Test-Connection google.com | Out-File network-report.txt -Append
"=== current ESTABLISHED connection count ===" | Out-File network-report.txt -Append
(netstat -an | Select-String ESTABLISHED | Measure-Object).Count | Out-File network-report.txt -Append

How to verify: read it with Get-Content network-report.txt; if the five items are in order, it’s complete. If both ping results were recorded as tables, that means "normal," and if an error was recorded, the error message itself is the diagnosis.

Answer to the deeper question: if your home’s DNS server came out as 192.168.0.1 (the router), the router in turn asks upstream — the ISP’s DNS or a public DNS like 8.8.8.8. "Whose phone book do you trust?" is the crux of DNS security.

Exercise Answers

Answer 1. It’s a DNS problem. Communication by numeric address works but name translation fails, so the road is fine and only the phone book (DNS) is broken. Check the DNS server settings.

Answer 2. Port 51234 of my computer (192.168.0.15) is currently connected (ESTABLISHED) to port 443 (the HTTPS web service) of the other side (142.250.207.78 — Google). It’s a normal connection from viewing a Google-family site in the browser.

Answer 3. A special address that points to "myself." Also called by the name localhost. It’s an address that ends inside my computer without going outside, and you’ll keep meeting it in local-server exercises later.

Answer 4. It’s a signal that "an address could not be obtained automatically" — the conversation with the router (DHCP) failed. It’s often resolved by restarting the router or checking the cable.

Completion Checklist

[ ] I can find and state my PC’s IPv4 address / gateway / DNS server
[ ] I can explain the roles of IP, gateway, and DNS with analogies
[ ] I can check connectivity with Test-Connection
[ ] I know the formula distinguishing DNS problems from connection problems
[ ] I can read "my side / their side / port" in netstat -an output
[ ] Mission: I completed network-report.txt

6. Common Pitfalls & Fixes

Wall 1. ipconfig output is so long I don’t know what to look at

That’s because virtual cards (VMware, VirtualBox, WSL, etc.) are mixed in. You only need to find the one card whose internet actually works. How to tell: a card with a real IPv4 address like 192.168.x.x or 10.x.x.x. Ignore cards showing Media State: Media disconnected.

Wall 2. Test-Connection spews red errors

That means it failed — and that’s information. Read the message: "No such host is known" means a name (DNS) problem; a timeout means a problem with the other side or the road. Errors are raw material for diagnosis too.

Wall 3. netstat output is too long

That’s normal. A single browser tab makes multiple connections. If you want it narrower, filter by port like netstat -an | Select-String "443", or trim with | Select-Object -First 20. The goal isn’t "memorize everything" but "can you spot something suspicious?"

Wall 4. My address starts with 169.254, not 192.168

169.254.x.x is a signal that "an address could not be obtained automatically" (see Exercise 4). It’s often resolved by restarting the router or checking the cable.

Wall 5. Results differ at work/school

Organizational networks may go through a proxy (relay server) or block ping. There are environments where pinging 8.8.8.8 fails yet the internet works — in that case, test "is the web port open?" instead with Test-NetConnection -ComputerName google.com -Port 443. (This command too is an extension of today’s concept: address:port!)

7. Summary

Today’s Trio of Concepts

Concept	Analogy	Command to check my value
IP address	home address (my location on the network)	`ipconfig /all`, `Get-NetIPAddress`
Gateway	front door (router)	`ipconfig /all`
DNS	phone book (name→number translation)	`ipconfig /all`

Diagnostic Formula

8.8.8.8	google.com	Diagnosis
✅	✅	normal
✅	❌	DNS problem
❌	❌	connection problem itself

Commands You Learned Today

Command	What it does
`ipconfig /all`	check IP/gateway/DNS
`Get-NetIPAddress`	PowerShell-style address check (127.0.0.1 = myself)
`Test-Connection address`	ping — does it answer?
`netstat -an`	connection list (read as address:port pairs)

Instincts That Matter More Than Commands

"A connection is always a pair — my side and their side." And "a failure message is raw material for diagnosis." Whether it’s an internet outage or a breach investigation, a network problem is a game of narrowing down "where did it break?" — and today’s sequence is that game’s opening strategy.

One nice-to-know: take one step past today’s connection list and you’ll wonder "which program opened this connection?" Weave together Get-NetTCPConnection and process info, and you can see it. This combination — pairing "suspicious external address ↔ the program that opened it" — is a real-world technique for catching malware communications, and you’ll meet it again in Level 2.

Once every box is checked, Step 6 is complete. Click the checkbox in the sidebar to save your progress.