Unit 2: Addresses and subnets · Lesson 3 of 7 · 18 min
Checking the address plan
Compare the inventory with the subnets it should live in and flag what does not fit.
mission
- You are
- The analyst running a quarterly audit.
- Situation
- Monitoring and firewall rules are written per subnet. The inventory in
hosts.csvshould only contain addresses from the two planned subnets. - Goal
- Find every entry that sits outside the plan, using the terminal in your browser.
- Hand in
- The names of the entries that do not fit.
Read the plan
Start with what should be true, then compare the inventory with it.
cat subnets.txt office 10.10.0.0/24 servers 10.20.0.0/24 head -n 4 hosts.csv name,ip,role web01,10.20.0.11,website db01,10.20.0.12,database mail01,10.20.0.25,mail
Keep only the addresses
cut with a comma delimiter picks the second column, so the names do not get in the way of your patterns.
cut -d , -f 2 hosts.csv | head -n 4
ip
10.20.0.11
10.20.0.12
10.20.0.25
Why the dots are escaped
10.20.0.11 10.20.0.250 10.20.10.4 110.20.0.3 10.200.0.9 10x20x0x7
2 matches
Remove what fits
grep -v drops matching lines; starting each pattern with a comma anchors it to the IP column. Whatever survives both subnets and the header is a finding.
grep -v ',10.20.0.' hosts.csv | grep -v ',10.10.0.' | grep -v '^name'
print01,10.20.1.15,print server
vpn-gw,203.0.113.10,vpn gateway
you should see Two entries outside the plan.
defender tip For each finding ask: is the inventory wrong, or is the machine really there? Both are worth a ticket.
Two kinds of finding
private, but in 10.20.1.0/24 no firewall rules no monitoring
Outside every rule that protects the server room.
public address reachable from the internet expected for a VPN
Fine if documented. Make sure it is patched and watched.
Fix the plan, not just the hosts
For each misplaced host, decide whether the host moves or the plan was wrong. Record the decision in the plan itself.
you should see An updated plan with an owner for every range.
What a defender takes away
- 1An audit compares what should be true with what is.
- 2Escape the dots in address patterns.
- 3Anything outside the plan is outside the controls written for the plan.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.