Networking Fundamentals: ARP, NAT, DHCP & Server Hardening

Networking & Security Fundamentals — Networking Fundamentals: ARP, NAT, DHCP & Server Hardening. Author: Diana J. Hakim. Date: January 15, 2020.

Abstract

Modern network administration demands fluent knowledge of the protocols that initialize, resolve, route, and protect traffic. This paper examines DHCP and the DORA exchange that configures devices automatically, the Address Resolution Protocol (ARP) and its security weaknesses, and the bitwise mathematics behind subnetting. It then covers NAT translation at the perimeter, the ports and sockets that identify web communication, and hands-on server hardening for both Windows Server 2016 and Ubuntu Server. A troubleshooting flow ties the concepts together, and hardening evaluation tools provide a practical path to verifying a truly secure configuration.

1. Introduction

Every device on a TCP/IP network depends on a chain of invisible processes: obtaining an address, resolving a neighbor’s hardware address, deciding local versus remote routing, translating private to public addresses, and ultimately binding to the ports that carry web traffic. When one link in that chain misbehaves, connectivity fails — and securing the servers at the end of the chain requires deliberate hardening at the OS level. This paper walks through each stage of that chain and concludes with concrete hardening checklists for the two most common server platforms.

2. Network Initialization & Provisioning: DHCP

Dynamic Host Configuration Protocol (DHCP) eliminates manual IP configuration by leasing addresses to clients automatically. The exchange follows the DORA sequence:

Discover — The client broadcasts a DHCPDISCOVER packet (UDP port 67/68 boundary across the local broadcast domain) searching for available DHCP servers.
Offer — Each available DHCP server responds with a DHCPOFFER containing an available IP address, lease duration, subnet mask, default gateway, and DNS servers.
Request — The client broadcasts a DHCPREQUEST selecting one offer, binding itself to that server’s parameters.
Acknowledge — The server confirms with a DHCPACK, and the client configures its interface and begins using the lease.

Troubleshooting Flow & Diagnostics

When a host fails to obtain a lease, validate each stage: confirm the DHCP server is reachable and has an available scope, verify the client is on the correct VLAN (broadcast domains do not cross routers without a DHCP relay agent), check for IP address conflicts in the scope, and review server logs for declined or denied requests. Common clinical symptoms include an APIPA address (169.254.x.x), a missing default route, or DNS resolution failures that point back to incomplete offer parameters.

3. Layer-2 Resolution & Security: ARP

Address Resolution Protocol (ARP) maps a known IP (Layer 3) address to the MAC (Layer 2) hardware address required to deliver frames on the local network.

On Windows, the ARP cache can be inspected and managed directly:

arp -a     :: View all current entries in the local ARP cache
arp -d     :: Delete an entry (or the entire cache) to force re-resolution

Observing an ARP exchange in Wireshark reveals the broadcast request (“who has 192.168.1.1?”) followed by a unicast reply from the owner of that address. This behaviour is the foundation of all local delivery — and the source of a classic vulnerability.

ARP and Security: Understanding Spoofing

Because ARP replies are not authenticated, any host on the local segment can answer on behalf of another, redirecting traffic to itself. This ARP spoofing (or poisoning) enables man-in-the-middle attacks that silently capture credentials. Defenses include static ARP entries, Dynamic ARP Inspection (DAI) on managed switches, and IPsec protection for the traffic itself.

4. Logical Operations, Routing Decisions, and Subnet Design

The Purpose of Network Masks & Logical AND Operations

Determining whether a destination is local or remote is a purely mathematical operation. The source performs a bitwise AND between its own IP and subnet mask, then repeats it for the destination. If the two results match, the destination is local; otherwise, the packet is forwarded to the default gateway.

Example: for the host 192.168.36.250 with mask 255.255.255.192, the local network is computed as 192.168.36.192. A destination of 192.168.36.220 yields the same 192.168.36.192 (local), while 192.168.36.150 resolves to 192.168.36.128 (remote—routed via gateway).

Packet Routing Decision Analysis

Source Address	Destination Address	Network Mask	Local or Gateway?
192.168.32.22	192.168.32.16	255.255.255.0	Local
192.168.34.22	192.168.44.23	255.255.0.0	Local
192.168.34.25	192.168.34.5	255.255.255.240	Gateway
10.0.0.5	10.0.0.10	255.0.0.0	Local

Subnetting and Network Design

Subnetting divides large address blocks into smaller, manageable networks. Consider the CIDR block 192.168.36.0/24, which must supply 67 host addresses for the sales, engineering, and marketing departments. The calculation proceeds step by step:

Step	Calculations	Reason
1	Identify the requirement: 67 hosts per subnet.	Large enough to cover the largest department with headroom for growth.
2	67 is less than 128 (2^7).	Seven host bits suffice for 126 usable addresses (2^7 – 2).
3	Select 7 host bits.	Provides 2^7 – 2 = 126 usable hosts per subnet.
4	Borrow 1 bit from the host portion (32 – 7 = 25).	One borrowed bit creates 2 subnets of 128 addresses each.
5	New prefix is /25; mask is 255.255.255.128.	255.255.255.128 = 11111111.11111111.11111111.10000000.
6	Subnet 1: 192.168.36.0–192.168.36.127.	First half of the block.
7	Subnet 2: 192.168.36.128–192.168.36.255.	Second half of the block.
8	Each subnet serves 126 usable hosts.	Two reserved addresses (network ID and broadcast) per subnet.

Each department receives a subnet with a usable range, a default gateway using the first usable address, and a broadcast address at the top of its range:

Parameter	Sales	Engineering	Marketing
Network ID	192.168.36.0/25	192.168.36.128/25	(second /26 carved from .128)
Usable Host Range	192.168.36.1–192.168.36.126	192.168.36.129–192.168.36.254	allocated per plan
First Usable IP	192.168.36.1	192.168.36.129	per plan
Last Usable IP	192.168.36.126	192.168.36.254	per plan
Default Gateway	192.168.36.1	192.168.36.129	per plan
Broadcast Address	192.168.36.127	192.168.36.255	per plan
CIDR Prefix	/25	/25	per plan
Usable Hosts	126	126	per plan

Careful subnet planning minimizes wasted address space while preserving room for growth, and the same AND-based calculation verifies every routing decision automatically.

5. Perimeter Routing & Translation: NAT

Network Address Translation (NAT) allows internal private addresses (RFC 1918 ranges) to share one or more public IPs at the network edge.

Request Outbound — An internal host 192.168.1.10 sends a request to a public web server.
Gateway Translation — The router rewrites the source address from 192.168.1.10 to its public IP (e.g., 203.0.113.5) and records the mapping in its translation table, using a unique source port.
Server Response — The web server replies to 203.0.113.5; the router looks up the mapping and reverses the translation.
Internal Routing — The response is forwarded to 192.168.1.10, which is unaware the translation ever occurred.

NAT conserves public IPv4 space and provides a degree of inbound protection, but it is not a substitute for a firewall — port forwarding rules must be reviewed carefully.

6. Web Communication Protocols, Ports, and Socket Analysis

Source and Destination Ports

TCP/IP communication is identified by a four-part socket: source IP, source port, destination IP, and destination port. Well-known destination ports announce the service (80 HTTP, 443 HTTPS, 22 SSH, 21 FTP, 53 DNS), while source ports are typically ephemeral. Observing the full socket on each packet allows an analyst to reconstruct conversations and spot anomalies, such as unexpected outbound SSH from a workstation.

What Sockets Can Tell You

Example socket: 205.43.15.6:21 == FTP (control channel)

When one side of a socket is unexpected — a database server trying to reach a foreign IP on an unusual port — that socket is a red flag worth investigating before assuming legitimate traffic.

7. Server Hardening: Securing the Network Edge & Windows Environments

Servers are high-value targets. Hardening is the process of removing unneeded services, enforcing least privilege, encrypting data at rest and in transit, and verifying the result with automated tools.

Essential Practices

Uninstall or disable every service, feature, and application not explicitly required.
Enforce strong password and account lockout policies; disable unused accounts.
Install security updates on a regular, tested schedule and patch high-risk vulnerabilities immediately.
Audit configs with a hardening benchmark before and after deployment.

Windows Server 2016 Hardening

Key steps for a Windows Server 2016 build include disabling the Print Spooler unless needed, applying password policy (length, complexity, history, and account lockout thresholds), reserving Secure Admin Workstations for elevated tasks, enabling Secure Boot and Device Guard, implementing BitLocker volume encryption, deploying Credential Guard against pass-the-hash attacks, enforcing prompt patch management with a staging ring, hardening the web server by removing unnecessary modules and enabling tracing, and continuous event log monitoring through a SIEM.

Ubuntu Server Hardening

On Ubuntu, harden SSH by disabling root login (“PermitRootLogin no”) and key-only authentication, enable UFW firewall rules allowing only essential ports, install unattended security upgrades, encrypt disks with LUKS, follow least privilege with sudo policies, scan for rootkits and malware with tools like RKHunter and Chkrootkit, enforce AppArmor profiles or SELinux where applicable, and run auditd to log authentication and privilege events.

Hardening Evaluation Tools & Benchmarks

Name of Software / Tool	Source / Link	Pricing Model	Description
UpGuard	www.upguard.com	Paid (trial available)	Continuously scans external-facing systems for misconfiguration, certificate expiry, and open ports; publishes the Windows Server Hardening Checklist used across the industry.
Attack Surface Analyzer	Microsoft Developer Center	Free	Microsoft tool that identifies attack surface changes during software installation by comparing the pre- and post-install system state.
CIS Microsoft Windows Server 2016 Benchmark	www.cisecurity.org	Free benchmark / paid automated tools	The de facto configuration standard with scored recommendations; can be applied via Group Policy Objects and audited with CIS-CAT.

8. Conclusion

From the DORA exchange that boots a device to the ARP resolution that delivers its frames, from subnet mathematics to NAT translation at the edge, every packet on a well-run network follows a deliberate, verifiable path. Securing that infrastructure adds a final, essential layer: hardened operating systems, least-privilege policies, encrypted traffic, and continuous validation with tools like UpGuard, Attack Surface Analyzer, and the CIS benchmarks. Mastery of these fundamentals — protocol by protocol, socket by socket — is what separates a fragile network from a resilient one.

References

Documentation

Give Feedback