Skip to main content

Preview build: sign-in and grading run on the server. MFA is not enabled, and storage is in server memory so it does not survive a restart.

LearnDefend
How Networks Work
TheoryBeginner13 minNetwork Analysis

Clients, Servers, Peers & Interfaces

What is it?

In any exchange, the node that starts the conversation is the client and the node that answers is the server. When two nodes talk as equals, each both asking and answering, they are peers. The role is about behaviour in that exchange, not about the size or importance of the device. A device joins the network through a network interface (wired or wireless), which is what actually holds its address.

Why it matters

Knowing who is the client and who is the server tells you who initiated, who is expected to be listening, and which direction a request flows. Almost every design and troubleshooting decision starts by getting that direction right.

Where you see it

A browser (client) requesting a web server; a phone app (client) calling a cloud API (server); two machines syncing files as peers; `ipconfig`/`ip addr` showing a device's own interfaces and addresses.

What normal looks like

Clients open connections toward servers; servers sit listening and answer; each device has an interface with a valid address. A machine acting as a server for the service it is meant to run, and as a client when it reaches out for updates, is entirely normal.

What suspicious looks like

A role that does not fit the device's job: a device that should only ever answer suddenly initiating outbound connections, an interface with no address, or two interfaces claiming the same address. In an operational sense these are the shapes of a misconfiguration (or, occasionally, a compromise).

How analysts investigate

By asking, for any connection, 'who opened it?' — that names the client and the server. Then check each end's interface: does it have a valid address, and is playing this role expected for that device?

Common beginner mistakes

  • Assuming 'server' means a big powerful machine and 'client' means a small one. The roles are about who starts and who answers in a given exchange — a tiny sensor can be a server and a supercomputer a client.
  • Forgetting that one device can be a client in one exchange and a server in another, at the same time.

When a Meridian employee opens the internal wiki, their laptop asks a question and a wiki server answers it. But that same wiki server, minutes later, reaches out to a software repository to download an update — and in that moment the server is the one asking. Same machine, opposite roles, decided entirely by who started the conversation.

Client asks, server answers
Client10.10.10.15Serverexample.comrequest (packets)response (packets)
The client opens the connection and sends a request; the server, sitting and listening, sends a response back. The role is defined by who initiated.
RoleIn an exchangeEveryday example
ClientStarts the conversation; sends the requestA browser opening a website
ServerWaits, listening; sends the answerThe web server that returns the page
PeerBoth asks and answers, as an equalTwo laptops sharing a file directly

A device does not touch the network directly — it connects through a network interface. A laptop typically has two: a wired Ethernet interface and a wireless Wi-Fi one. The interface is what actually holds the device's address on the network, which is why one machine with two interfaces can appear at two addresses at once.

Which end is the server?

A connection log line reads: 10.10.4.20 opened a connection to 10.10.4.9. A colleague says '10.10.4.9 is the server because it has the lower number.' Decide the roles properly.

  1. Ignore the numbers; ask who opened it.

    The log says 10.10.4.20 opened the connection. Whoever opens a connection is, by definition, the client for that exchange. The address value is irrelevant — 'lower number = server' is a made-up rule. So 10.10.4.20 is the client.

  2. Name the other end and confirm with behaviour.

    10.10.4.9 answered, so it is the server for this exchange. Confirm it fits: a server sits listening on a known port for a service (a wiki, a database, a file share). If 10.10.4.9 runs such a service, the roles are consistent and unremarkable.

  3. Notice when the role would be worth a second look.

    The role only becomes interesting if it does not fit the device's job — for example if 10.10.4.9 is a printer (which should answer print jobs, not run a wiki), or if a machine that should only ever answer suddenly starts opening outbound connections. Role + expected job together is what tells you 'normal' from 'worth investigating'.

Quick check

What decides whether a node is the client or the server in a given exchange?

A quick self-check — it doesn't affect your XP or progress.

Quick check

A single server hosts a website AND, every night, downloads its own software updates. How should you describe its roles?

A quick self-check — it doesn't affect your XP or progress.

Sign in to save your progress on the server.