CND (312-38) Network Defense Simulation

Learn to identify network boundaries and architectural constraints by mastering IPv4 addressing schemes. This simulation reinforces the fundamental knowledge required to configure firewalls, identify spoofing, and segment enterprise networks effectively.

1 Network Scenario

You are auditing a legacy enterprise environment. The internal network uses a mix of static IP assignments and DHCP pools. During a security review, you observe that several critical application servers are hosted on a specific subnet range. As a Blue Team defender, you must verify if the network architecture aligns with standard IP classification for documentation and access control list (ACL) optimization.

Core Infrastructure

VLAN 10: Management (Class A Space)

VLAN 20: Workstations (Class B Space)

Perimeter

External: 203.0.113.5 (Class C)

Internal GW: 10.0.0.1

2 Traffic & Logs

Sample Wireshark/Tcpdump output from internal core switch:

45:12.332 IP 10.50.2.10.443 > 10.50.5.105.52134: Flags [P.], seq 1:512, ack 1
45:12.455 IP 127.0.0.1.53 > 127.0.0.1.5353: [DNS Query] Localhost Loopback
45:13.001 IP 172.16.55.12.80 > 10.50.2.10.445: Flags [S], win 64240, options [mss 1460]
45:15.990 ALERT [IDS-RULE-04] Possible Internal Spoofing Attempt from 127.0.0.1
                

Note: The system identifies 10.x.x.x addresses as being within the primary internal organizational block.

3 Question

Which of the following ranges of addresses can be used in the first octet of a Class A network address?

A. 0-127

B. 192-223

C. 224-255

D. 128-191

4 Expert Analysis

1. What is happening in the network

The logs show traffic utilizing a 10.x.x.x private addressing scheme. This is the most common use of Class A space in modern enterprise defense. The logs also show a loopback address (127.0.0.1) which is technically part of the Class A range but reserved for local testing.

2. Identify attack or behavior

While no active breach is occurring, the knowledge of address classes is vital for configuring "Bogon Filters" on firewalls. Bogon filters block traffic from unallocated or reserved IP space. If a defender doesn't know the boundaries of Class A (0-127), they might misconfigure ingress filters.

3. Why the correct answer is correct

Class A addresses use the range 0 to 127 for the first octet. This is determined by the rule that the leading bit must be 0. (Binary: 0xxxxxxx). This allows for 128 networks (0-127), though 0 and 127 are reserved.

Why others are wrong

128-191: This is Class B (Binary 10xxxxxx).
192-223: This is Class C (Binary 110xxxxx).
224-255: This is Class D (Multicast) and Class E (Experimental).

Defensive Action

Implement network segmentation by assigning logical boundaries. Use private address space (RFC 1918) like 10.0.0.0/8 (Class A) for internal nodes to ensure they are not directly reachable from the public internet.

MINI LESSON: IP Pattern Recognition

Protocol Behavior: IPv4 uses a classful system for historical routing, though CIDR (Classless Inter-Domain Routing) is used today, the underlying classes still define reserved blocks.
Class A Characteristics: Provides a massive number of hosts (over 16 million) per network. It uses a default subnet mask of 255.0.0.0 (/8).
Detection Strategy: If you see traffic entering your perimeter from 127.x.x.x or 10.x.x.x (internal space) on the external interface, it is a high-fidelity indicator of a Spoofing Attack.

Explore more CND simulations

Proceed to Practice Tests