Almost every security concept you will meet later assumes you already understand what an address is, how a name turns into one, and how a packet gets from here to there. Skip that and everything downstream turns into memorization.
So the mentorship spends its first two weeks there. Not on theory for its own sake, but on the specific pieces that keep showing up in incidents.
IP Addresses and What They Really Tell You
An IP address identifies an interface on a network. That is a smaller claim than most people assume. It does not identify a person, it does not reliably identify a machine over time, and in a world of network address translation it very often identifies a few hundred machines at once.
Understanding that limit is a security skill. A large part of investigation work is figuring out what an address actually maps to at a specific moment, which is why DHCP logs and NAT logs matter so much during an incident.
Subnetting Without the Tears
Subnetting has a reputation for being painful, and it is usually taught badly. The trick is to stop treating it as arithmetic and start treating it as a question about which bits are fixed and which are free.
Once that lands you can look at 10.20.30.0/24 and immediately know the range, the broadcast address, and how many hosts fit. That matters when you are writing a firewall rule, defining a scan scope, or reading an alert that says traffic crossed a boundary it should not have.
IPv6, The Address Space That Ate the Universe
IPv6 gets ignored until it causes a problem. The problem is usually that it was enabled by default, nobody wrote rules for it, and a host that is carefully firewalled on IPv4 is wide open on IPv6.
You cover the addressing format, link local addresses, why the enormous address space changes how scanning works, and the specific mistakes that show up in real assessments. The main lesson is simple: if a protocol is running on your network, it is in scope whether you planned for it or not.
DNS, How a Name Becomes an Address
DNS is the phone book, and like a phone book, almost nobody checks whether the entry is right. You walk the full resolution path from a client, to a resolver, to the root, to the authoritative server, and back.
Then the record types. A and AAAA for addresses, CNAME for aliases, MX for mail, NS for delegation, TXT for everything people decided to bolt on including SPF and DKIM, and PTR for reverse lookups. Each one shows up in security work for a different reason.
Zone Files and Running Your Own DNS
You do not really understand DNS until you have run a server and broken it. In the lab you write a zone file, get the serial number wrong, watch nothing propagate, and fix it.
That exercise pays off later. A surprising share of production outages and a meaningful share of breaches trace back to DNS records that nobody owned: a subdomain pointing at a cloud service that was decommissioned, for example, which is how subdomain takeover happens.
When DNS Goes Wrong
Cache poisoning, spoofing, hijacking at the registrar, tunneling data out through DNS queries, and using DNS as command and control. Each one is explained with what it looks like in a log, which is the part that matters if you want to catch it.
DNS query logs are one of the highest value log sources a defender has, and they are covered again in threat hunting and in the Week 7 shadow IT hunt. Defenses include DNSSEC, registrar locks, resolver policy, and simply watching the queries.
Linux Routing and the Firewall
How a packet chooses a path, what a routing table actually says, and what happens when there are two plausible routes. Then the Linux firewall itself.
iptables and nftables are where firewall concepts stop being abstract. A rule has a table, a chain, a match, and a target, and once you have written a few by hand, every commercial firewall product makes more sense. That is the bridge into the next generation firewall material later on.
Learn This at HackRange
Weeks 1 and 2 are the foundation for the entire program. Everything from Splunk searches to cloud security assumes you can read an address, a route, and a name resolution path.