🔄 Topic

Understanding how virtual machine networking works and why NAT vs bridged mode matters in a cybersecurity lab.

🎯 Goal

Clarify the difference between NAT and bridged networking and understand how each affects connectivity and visibility.

🛠 What I Did

While troubleshooting connectivity between machines in my lab, I explored how Parallels networking works.

Observed two main modes:

  • NAT (Network Address Translation)
  • Bridged networking

I noticed:

  • NAT assigns internal IPs (e.g. 10.211.x.x)
  • Bridged assigns IPs from the local network (e.g. 192.168.x.x)

🔗 Key Cybersecurity Connections

Networking mode directly affects:

  • visibility between systems
  • ability to simulate attacks
  • realism of lab environments

In NAT mode:

  • systems are partially isolated
  • external systems may not see internal hosts

In bridged mode:

  • VM behaves like a real machine on the network
  • easier to simulate real attack scenarios

🔍 Investigation Questions

  • Is the target system on the same network?
  • Are IP ranges compatible?
  • Is traffic being routed or blocked?

🚨 Detection Opportunities

  • unusual internal IP communication patterns
  • unexpected host visibility on network
  • lateral movement attempts across subnets

🧭 MITRE ATT&CK Techniques

  • T1021 — Remote Services
  • T1046 — Network Service Discovery

⚠ Challenges

Confusion came from:

  • systems existing but not seeing each other
  • connectivity depending on network mode

📚 What I Learned

  • NAT simplifies setup but limits realism
  • bridged networking enables real interaction
  • lab design impacts what can be tested

➡ Next Steps

  • standardize lab networking setup
  • ensure consistent IP visibility between machines

🧠 Reflection

This was a key realization:

Your lab is only as good as its network design.

🧩 Lessons Learned

What worked

Comparing IP ranges and network behavior.

What broke

Assuming all VMs could see each other.

Why it broke

Different networking modes isolate traffic.

Fix / takeaway

Always validate network topology first.

📈 Skill Progression Context

This improves lab realism and prepares for network-based investigations in SOC environments.

😄 TL;DR

If your machines can’t see each other…
it’s not hacking — it’s networking.