Networking Fundamentals

You cannot defend or test what you cannot read. Almost every attack and every detection happens on the network, so the protocols below are the vocabulary of packet captures, firewall rules and scan results.

OSI vs TCP/IP

 OSI                      TCP/IP            Examples / PDU
 7 Application  \
 6 Presentation  >------- Application      HTTP, DNS, SSH, TLS   (data)
 5 Session      /
 4 Transport    --------- Transport        TCP, UDP              (segment/datagram)
 3 Network      --------- Internet         IP, ICMP              (packet)
 2 Data Link    \-------- Link             Ethernet, Wi-Fi, ARP  (frame)
 1 Physical     /                          cables, radio         (bits)

Mnemonic (7 to 1): All People Seem To Need Data Processing. Security people use the layer numbers as shorthand: a "Layer 7 attack" targets the application, a "Layer 2 attack" is ARP or MAC spoofing, a "Layer 3 firewall" filters by IP.

Encapsulation

Each layer wraps the data from the layer above with its own header. The receiver unwraps in reverse.

Application:  [          DATA          ]
Transport:    [TCP hdr][    DATA      ]
Network:      [IP hdr][TCP hdr][ DATA ]
Link:      [Eth hdr][IP hdr][TCP hdr][ DATA ][Eth trailer]

Addressing

Private ranges (RFC 1918) and special addresses

Subnetting basics

CIDR notation /n says how many leading bits are the network part; the rest are host bits.

192.168.1.0/24  -> mask 255.255.255.0   -> 256 addresses, 254 usable hosts
192.168.1.0/26  -> mask 255.255.255.192 ->  64 addresses,  62 usable hosts
Usable hosts = 2^(32 - n) - 2   (network address + broadcast excluded)

Subnets are also security boundaries: hosts in different subnets must pass a router or firewall, which is where filtering is applied (see Network Segmentation).

TCP, UDP and Ports

Three-way handshake

Client                      Server
  | ---- SYN (seq=x) ------>  |
  | <--- SYN-ACK (seq=y, ack=x+1) |
  | ---- ACK (ack=y+1) ----->  |
  |      connection established |
  | ---- FIN / ACK ... ----->  |   (graceful close)  or RST (abort)

Scan techniques built on these flags are covered in Nmap; flood attacks in Network Attacks.

Common ports and protocols

Ranges: 0-1023 well-known, 1024-49151 registered, 49152-65535 ephemeral (client-side). See also SSH and Telnet.

Core Network Services

DNS — names to addresses

Browser -> stub resolver -> recursive resolver -> root -> TLD (.com) -> authoritative
                                  \_ caches the answer for the record's TTL

Records: A/AAAA (IPv4/IPv6), CNAME (alias), MX (mail), NS (name server), TXT (SPF/DKIM/verification), PTR (reverse). Attacks: cache poisoning, DNS tunnelling/exfiltration, hijacking, subdomain takeover. Defences: DNSSEC, DNS filtering, logging queries. See Security Technologies: DNS Filtering.

DHCP — automatic addressing

The DORA exchange: Discover, Offer, Request, Acknowledge (broadcast, UDP 67/68). It hands out IP, mask, gateway and DNS. There is no authentication, so a rogue DHCP server can steer clients through an attacker's gateway; counter with DHCP snooping on switches.

ARP — IP to MAC on the local segment

"Who has 192.168.1.1?" is broadcast and the owner replies with its MAC. Replies are accepted without verification, enabling ARP spoofing for man-in-the-middle. Counter with dynamic ARP inspection, static entries for critical hosts and encrypted protocols. See Network Attacks and macof.

NAT — sharing public addresses

Inside 192.168.1.10:51000 --> [NAT router] --> 203.0.113.5:40001 --> Internet

PAT maps many private hosts to one public IP using port numbers. NAT hides internal addressing but is not a firewall; inbound reachability still depends on rules.

HTTP and HTTPS

Request/response protocol over TCP 80 (clear) or 443 (TLS). Request = method (GET, POST, ...) + path + headers + optional body; response = status code (2xx ok, 3xx redirect, 4xx client error, 5xx server error) + headers + body. HTTPS wraps this in TLS for confidentiality and server authentication (see Public Key Infrastructure). Web-layer risks are in Application Attacks.

Routing, Switching and Devices

Switching moves frames inside a network; routing moves packets between networks. A switch that has its CAM table flooded fails open and behaves like a hub. A VPN builds an encrypted tunnel across untrusted networks (VPN and Tunneling).

Seeing It on the Wire

ip addr                       # interfaces and addresses (Linux)
ip route                      # routing table
ss -tulpn                     # listening TCP/UDP sockets
dig example.com A             # DNS lookup
tcpdump -i eth0 'tcp port 443' # capture traffic

Capturing and filtering packets is covered in Wireshark and tcpdump.

Key Points

• Know OSI layers 1-7 and how TCP/IP maps to them; each layer adds a header (encapsulation).
• CIDR defines the network boundary; use RFC 1918 ranges internally.
• TCP = handshake, flags, reliability; UDP = fast, stateless. Scans and floods abuse flags.
• Memorise the common ports and prefer their encrypted replacements.
• DNS, DHCP and ARP trust whoever answers first, which is why they are classic attack points.
• NAT is not security; switches work at layer 2, routers at layer 3.

Related

• Network Attacks | Nmap | hping3
• Wireshark | tcpdump
• Network Segmentation | Security Architecture Principles
• Hands-on: THM: AOC Network Discovery - Scan-ta Clause, THM: Firewall Fundamentals