Networking Fundamentals
The OSI model, IP and ports, common protocols, and how a packet travels from browser to server.
Learning Objectives
- → Name all 7 OSI layers and map protocols to them
- → Read IP addresses, ports, and CIDR notation
- → Identify common protocols and their port numbers
- → Trace a packet from browser to web server
Networks are the primary attack surface in cybersecurity. Every web attack, remote exploit, and data exfiltration happens over a network. This lesson gives you the vocabulary and mental models you need.
The OSI Model
The Open Systems Interconnection model breaks network communication into 7 layers. Security professionals use it to reason about where attacks happen.
Layer 7 Application HTTP, DNS, FTP, SMTP ← where your app lives
Layer 6 Presentation TLS/SSL, encoding ← encryption happens here
Layer 5 Session session management
Layer 4 Transport TCP, UDP ← ports live here
Layer 3 Network IP addresses, routing ← IP lives here
Layer 2 Data Link MAC addresses, switches
Layer 1 Physical cables, radio waves
Mnemonic: All People Seem To Need Data Processing (top to bottom)
IP Addresses
An IP address uniquely identifies a device on a network.
IPv4
32 bits, written as four decimal octets:
192 . 168 . 1 . 100
│ │ │ │
8 bits 8 bits 8 bits 8 bits = 32 bits total
Private ranges (not routable on the internet):
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
Special addresses:
- 127.0.0.1 — loopback (localhost, your own machine)
- 0.0.0.0 — all interfaces
- 255.255.255.255 — broadcast
Subnet Masks & CIDR
A subnet mask defines which part of the IP is the network vs. the host:
IP: 192.168.1.100
Mask: 255.255.255.0 (/24)
└─ network ──┘ └host┘
/24 means the first 24 bits are the network. 2⁸ = 256 addresses (254 usable).
Ports
A port is a number (1–65535) that identifies a specific service on a machine.
Think of it like: IP address = building, port = apartment number.
Well-Known Ports (memorize these)
| Port | Protocol | Service |
|---|---|---|
| 21 | TCP | FTP |
| 22 | TCP | SSH |
| 23 | TCP | Telnet (insecure!) |
| 25 | TCP | SMTP (email) |
| 53 | TCP/UDP | DNS |
| 80 | TCP | HTTP |
| 443 | TCP | HTTPS |
| 445 | TCP | SMB (Windows file sharing) |
| 3306 | TCP | MySQL |
| 3389 | TCP | RDP (Windows Remote Desktop) |
| 8080 | TCP | HTTP alternate |
TCP vs UDP
TCP (Transmission Control Protocol)
- Connection-oriented: 3-way handshake before data transfer
- Reliable: guarantees delivery, retransmits lost packets
- Ordered: packets arrive in sequence
- Used by: HTTP, SSH, FTP, SMTP
The TCP Handshake:
Client Server
│──── SYN ────►│ "I want to connect"
│◄─── SYN-ACK─│ "OK, I'm ready"
│──── ACK ────►│ "Great, let's go"
│ │
│◄══ DATA ════►│ (data flows both ways)
Security relevance: SYN flood attacks send millions of SYN packets, exhausting server resources.
UDP (User Datagram Protocol)
- Connectionless: no handshake
- Unreliable: no guaranteed delivery
- Fast: less overhead
- Used by: DNS, DHCP, VoIP, gaming
DNS — The Internet's Phone Book
Domain Name System translates human-readable names to IP addresses.
You type: www.example.com
DNS resolves: 93.184.216.34
Browser connects to: 93.184.216.34:443
DNS is a major attack surface:
- DNS spoofing/poisoning — fake DNS responses redirect users to malicious sites
- DNS exfiltration — malware hides stolen data in DNS queries
- Subdomain takeover — dangling DNS records point to unclaimed cloud resources
HTTP — The Web Protocol
HTTP is how browsers and servers communicate. It's a request/response protocol.
HTTP Request:
GET /login HTTP/1.1
Host: example.com
Cookie: session=abc123
User-Agent: Mozilla/5.0...
HTTP Response:
HTTP/1.1 200 OK
Content-Type: text/html
Set-Cookie: session=xyz789
<html>...</html>
Common status codes:
- 200 OK
- 301 Redirect
- 403 Forbidden
- 404 Not Found
- 500 Server Error
HTTPS = HTTP + TLS encryption. The data is the same, but it's encrypted in transit.
Firewalls & NAT
Firewall: filters traffic based on rules (allow/deny by IP, port, protocol).
Internet ──► [Firewall] ──► Internal Network
Rules:
- Allow 443 inbound
- Allow 80 inbound
- Block everything else inbound
- Allow all outbound
NAT (Network Address Translation): maps private IPs to a single public IP. This is why your laptop has 192.168.x.x but websites see your ISP's address.
Key Takeaways
- The OSI model tells you where in the stack an attack or defense operates
- IP + Port = complete address for a service on the internet
- TCP is reliable (handshake), UDP is fast (no handshake)
- DNS is foundational — and a frequent attack target
- Knowing HTTP is essential for web security work
The OSI model divides network communication into 7 layers. Each layer has a specific job. Security tools operate at specific layers — knowing the model tells you where a threat or defence lives.
| # | Layer | PDU | Protocols | Security tools |
|---|---|---|---|---|
| 7 | Application | Data | HTTP, DNS, FTP, SSH | WAF, proxy, DLP |
| 6 | Presentation | Data | TLS/SSL, JPEG, gzip | TLS inspection, cert pinning |
| 5 | Session | Data | NetBIOS, RPC, SOCKS | Session hijacking detection |
| 4 | Transport | Segment | TCP, UDP | Firewall port rules, DDoS mitigation |
| 3 | Network | Packet | IP, ICMP, IPsec | Router ACLs, IPS, nmap |
| 2 | Data Link | Frame | Ethernet, ARP, 802.11 | ARP inspection, port security |
| 1 | Physical | Bits | Cables, WiFi radio | Physical security, tap detection |
At which layer does IP addressing and routing occur?
ARP operates at which OSI layer?
Network traffic is identified by the combination of IP address (which machine) and port number (which service). Together they form a socket.
| Port | Protocol | Service | Encrypted? |
|---|---|---|---|
| 22 | TCP | SSH — secure remote shell | Yes ✓ |
| 23 | TCP | Telnet — insecure remote shell | No ⚠ |
| 25 | TCP | SMTP — send email | No (use 587) |
| 53 | UDP/TCP | DNS — name resolution | No (use DoT/DoH) |
| 80 | TCP | HTTP — web (plaintext) | No ⚠ |
| 443 | TCP | HTTPS — web (TLS) | Yes ✓ |
| 445 | TCP | SMB — Windows file sharing | Partial |
| 3389 | TCP | RDP — Windows remote desktop | Yes (TLS) |
A socket is the combination of:
Which port should you use instead of port 25 for sending email securely?
When you type https://example.com, a complex chain of events unfolds across multiple layers.
Browser checks cache, asks resolver → Root → TLD → Authoritative NS → returns 93.184.216.34
TCP 3-way handshake: SYN → SYN-ACK → ACK to port 443 on the server
Client & server negotiate cipher, exchange certificates, derive session keys
Encrypted: GET / HTTP/1.1 Host: example.com + headers
HTTP 200 OK + HTML body — encrypted with the TLS session key
Browser parses HTML, fetches CSS/JS (more DNS + TCP + TLS for each)
What is the first step when you navigate to https://example.com?
HTTPS protects traffic using: