Networking Fundamentals for Security
Understand the OSI model, TCP/IP stack, subnetting, common protocols, and how attackers exploit each layer — the foundation of all network security work.
Learning Objectives
- → Describe each OSI layer and its security relevance
- → Explain the TCP three-way handshake and why it matters for attacks
- → Read and interpret IP headers, ports, and packet captures
- → Identify common protocols and their default ports
- → Subnet and identify network ranges in CIDR notation
The OSI Model
Every network attack and defense maps to a layer:
| Layer | Name | Examples | Attack Examples |
|---|---|---|---|
| 7 | Application | HTTP, DNS, SMTP, FTP | SQL injection, XSS, phishing |
| 6 | Presentation | TLS/SSL, encoding | SSL stripping, encoding attacks |
| 5 | Session | NetBIOS, RPC | Session hijacking |
| 4 | Transport | TCP, UDP | SYN flood, port scanning |
| 3 | Network | IP, ICMP, routing | IP spoofing, MITM |
| 2 | Data Link | Ethernet, ARP, MAC | ARP poisoning, MAC flooding |
| 1 | Physical | Cables, radio, fiber | Physical tap, jamming |
Mnemonic: "Please Do Not Throw Sausage Pizza Away" (Physical→Application)
TCP/IP Stack
TCP/IP collapses OSI into 4 layers:
Application ── HTTP, DNS, SSH, SMTP
Transport ── TCP, UDP
Internet ── IP, ICMP, ARP
Link ── Ethernet, Wi-Fi
TCP Three-Way Handshake
Client Server
│──── SYN ────▶│ "I want to connect" (seq=x)
│◀── SYN-ACK ──│ "OK, I'm ready" (seq=y, ack=x+1)
│──── ACK ────▶│ "Connection open" (ack=y+1)
│══ DATA ══════│
│──── FIN ────▶│ (teardown)
Security relevance:
- SYN flood — attacker sends millions of SYN packets, never completes handshake → server exhausts half-open connections
- Port scanning — SYN with no ACK reveals open ports (SYN scan / -sS in nmap)
- TCP hijacking — predict sequence numbers, inject into existing connection
IP Addressing & CIDR
IPv4 address: 192.168.1.100
Binary: 11000000.10101000.00000001.01100100
CIDR notation:
192.168.1.0/24 → 256 addresses, mask 255.255.255.0
10.0.0.0/8 → 16M addresses
172.16.0.0/12 → 1M addresses (private)
/24 = 254 usable hosts (1 network, 1 broadcast)
/25 = 126 usable hosts (splitting /24 in half)
/32 = single host
Private ranges (RFC 1918 — not routable on internet):
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16
Common Ports & Protocols
| Port | Protocol | Notes |
|---|---|---|
| 20/21 | FTP | File transfer — cleartext credentials |
| 22 | SSH | Encrypted remote shell |
| 23 | Telnet | Cleartext remote shell — avoid |
| 25 | SMTP | Email sending |
| 53 | DNS | Domain → IP resolution |
| 80 | HTTP | Unencrypted web |
| 110 | POP3 | Email retrieval — cleartext |
| 143 | IMAP | Email retrieval |
| 443 | HTTPS | Encrypted web (TLS) |
| 445 | SMB | Windows file sharing (EternalBlue) |
| 3306 | MySQL | Database — should not be internet-facing |
| 3389 | RDP | Remote Desktop |
| 8080 | HTTP-alt | Dev servers, proxies |
DNS – The Security Critical Protocol
Browser asks: What is the IP of google.com?
1. Check /etc/hosts (local)
2. Check DNS cache
3. Ask Recursive Resolver (ISP/8.8.8.8)
4. Resolver → Root DNS → .com TLD → google.com NS
5. google.com NS → returns 142.250.x.x
6. Cache result with TTL
DNS attacks:
- DNS spoofing / cache poisoning → return wrong IP
- DNS tunneling → exfiltrate data via DNS queries
- DNS amplification → DDoS reflection
- typosquatting → google.com → g00gle.com
ARP – Address Resolution Protocol
ARP maps IP → MAC address on a local network:
Host A wants to send to 192.168.1.5:
"Who has 192.168.1.5? Tell 192.168.1.1" (broadcast)
192.168.1.5 replies: "I'm at AA:BB:CC:DD:EE:FF"
ARP Poisoning (MITM):
Attacker sends gratuitous ARP: "192.168.1.1 is at ATTACKER-MAC"
All hosts update ARP cache → traffic flows through attacker
ICMP – Ping & Traceroute
# Ping (ICMP Echo Request/Reply) — test reachability
ping 8.8.8.8
ping -c 4 10.0.0.1
# Traceroute — path each packet takes
traceroute 8.8.8.8 # Linux
tracert 8.8.8.8 # Windows
# ICMP attacks:
# Ping flood (DoS), ping of death (oversized packet),
# ICMP redirect (redirect traffic through attacker)
Reading a Packet Capture
tcpdump -i eth0 -w capture.pcap # capture all traffic
tcpdump -r capture.pcap # read capture
# Filter expressions:
tcpdump host 10.0.0.1 # specific host
tcpdump port 80 # specific port
tcpdump 'tcp[tcpflags] & tcp-syn != 0' # SYN packets
# Wireshark display filters:
http.request # HTTP requests
dns.qry.name == "evil.com" # DNS query
tcp.flags.syn == 1 # SYN packets
ip.src == 10.0.0.100 # from specific IP
Network Scanning with nmap
# Host discovery (which hosts are up?)
nmap -sn 192.168.1.0/24
# Port scan (which ports are open?)
nmap -sS 10.0.0.1 # SYN scan (stealth)
nmap -sT 10.0.0.1 # TCP connect scan
nmap -sU -p 53,161 10.0.0.1 # UDP scan
# Service and version detection
nmap -sV 10.0.0.1
# OS detection
nmap -O 10.0.0.1
# Full scan
nmap -A -p- 10.0.0.1
For each attack, identify the OSI layer it targets: (1) SQL injection, (2) SYN flood, (3) ARP poisoning, (4) SSL stripping, (5) IP spoofing, (6) MAC flooding, (7) DNS cache poisoning, (8) physical wiretap. Explain your reasoning for each.
At which OSI layer does ARP poisoning operate?
At which OSI layer does a SYN flood operate?
For each CIDR block, calculate: first host, last host, broadcast address, and number of usable hosts: (1) 192.168.10.0/24, (2) 10.0.0.0/8, (3) 172.16.50.0/25, (4) 192.168.1.128/26.
How many usable hosts does a /24 network provide?
What is the broadcast address of 192.168.1.0/24?
Use Wireshark (or tcpdump) to: (1) capture your own DNS resolution (ping google.com while capturing), (2) identify the query type (A record), (3) find the TTL, (4) identify the source/destination IPs. Write a tcpdump filter to capture only DNS traffic on port 53.
What tcpdump filter captures only traffic on port 53?
What DNS record type maps a hostname to an IPv4 address?