Networking Fundamentals for Cybersecurity
Layers in one minute
The TCP/IP model has four layers: link (Ethernet/Wi-Fi), internet (IP), transport (TCP/UDP) and application (HTTP, DNS, SSH). The 7-layer OSI model is a more detailed teaching model.
IP addresses and subnets
An IPv4 address has 32 bits, written like 192.168.1.10. A CIDR suffix shows the network size: /24 means the first 24 bits identify the network, leaving 8 bits for hosts (256 addresses). Private ranges (RFC 1918) are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16.
Ports and services
A port number identifies a service on a host. Common ones: 22 SSH, 53 DNS, 80 HTTP, 443 HTTPS, 25 SMTP, 3389 RDP. An open port means a program is listening — which is why scanning your own network is a good first step in defence.
TCP vs UDP
| TCP | UDP | |
|---|---|---|
| Connection | Yes (handshake) | No |
| Reliability | Retransmits lost data | None |
| Typical use | Web, SSH, email | DNS queries, streaming |
TCP three-way handshake: SYN → SYN/ACK → ACK. You can see it in Wireshark with the filter tcp.flags.syn == 1.
Helper protocols
- ARP maps IP addresses to MAC addresses on a local network.
- DHCP hands out IP addresses.
- NAT lets many private hosts share one public address.
- DNS turns names into addresses — see how DNS works.
Why security cares
Attackers and defenders both work with these building blocks: port scans, spoofed ARP replies, unencrypted protocols that leak passwords (see our Cleartext Credentials challenge) and misconfigured firewalls.
Practise
Run ip addr and ss -tulpn on your Linux machine, then capture your own traffic and identify each layer.
Related tool: Nmap
Use techniques only on systems you are authorised to test.