Module 1: Network Foundations
TCP/IP for Security People
Every attack that crosses a network, from a phishing link to a ransomware outbreak, travels as packets. If you understand how those packets are built and delivered, you can read firewall logs, write sensible rules and recognise traffic that does not belong. You do not need to be a network engineer, but you do need a clear model of TCP/IP.
The layers that matter
The TCP/IP model is usually described in four layers. Security tools work at different layers, so it helps to know which is which.
| Layer | What it does | Examples | Security relevance |
|---|---|---|---|
| Link | Moves frames on the local network | Ethernet, Wi-Fi, MAC addresses, ARP | ARP spoofing, rogue devices, Wi-Fi attacks |
| Internet | Addresses and routes packets between networks | IPv4, IPv6, ICMP | IP spoofing, scanning, routing and firewall rules |
| Transport | Delivers data between applications | TCP, UDP, port numbers | Port scanning, SYN floods, firewall port rules |
| Application | The service the user actually uses | HTTP, HTTPS, DNS, SMTP, SSH | Web attacks, DNS abuse, phishing, malware delivery |
Many people also use the seven-layer OSI model, where "layer 2" means the link layer, "layer 3" the network layer and "layer 7" the application layer. When someone says "a layer 7 firewall", they mean one that understands applications, not only addresses and ports.
IP addresses and subnets
An IPv4 address such as 192.168.10.25 identifies a device interface. A subnet mask or prefix, such as /24, says which part identifies the network. 192.168.10.0/24 covers addresses 192.168.10.0 to 192.168.10.255, with 254 usable host addresses. Private ranges reserved for internal networks are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. These are not routed on the public internet, so a router performs Network Address Translation (NAT) to share one public address among many internal devices.
IPv6 uses much longer addresses, such as 2001:db8::1 (the 2001:db8::/32 range is reserved for documentation). Many networks now run IPv6 alongside IPv4, sometimes without the administrator realising it. A firewall that filters only IPv4 can leave IPv6 wide open.
TCP and UDP
TCP is connection-oriented. Before data flows, the client and server perform a three-way handshake: the client sends SYN, the server replies SYN-ACK, and the client sends ACK. TCP then guarantees ordered, reliable delivery. Web, email and SSH use TCP.
UDP is connectionless. It sends datagrams without a handshake or delivery guarantee, which makes it fast and suitable for DNS queries, voice and video. It also makes UDP easier to spoof, which attackers exploit in reflection and amplification attacks.
Ports identify the application. A connection is described by five values: source IP, source port, destination IP, destination port and protocol. Firewalls make decisions based on this "5-tuple".
Worked example: reading a connection
On a Linux machine, you can list active connections:
$ ss -tunap
Netid State Local Address:Port Peer Address:Port
tcp ESTAB 192.168.10.25:51544 203.0.113.40:443 users:(("firefox",pid=2210))
udp UNCONN 0.0.0.0:68 0.0.0.0:* users:(("dhclient",pid=640))
tcp LISTEN 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=880))Reading this: the browser on 192.168.10.25 has an established TCP connection from a random high source port to port 443 (HTTPS) on a web server. The DHCP client listens on UDP port 68. The SSH server listens on TCP port 22 on all interfaces (0.0.0.0), which means any device that can reach this machine can try to log in. If this is a laptop that does not need remote access, that listening service is unnecessary attack surface.
On Windows, netstat -ano gives similar information.
Common mistakes to avoid
- Assuming private IP addresses are "safe". Attackers who get onto the internal network, for example through a phishing email, operate from inside.
- Forgetting IPv6 when writing firewall rules or monitoring traffic.
- Confusing source and destination ports. Clients usually use a random high source port; the destination port tells you the service.
- Treating ICMP as harmless and allowing everything, or blocking all of it and breaking path MTU discovery. Allow the ICMP types you need.
Exercise
On your own computer, run ss -tunap on Linux or netstat -ano on Windows and copy the output into a document. For each listening port, identify the program and decide whether it needs to be reachable from other devices. Then find your IP address and prefix length and work out the network range and the number of usable host addresses in your subnet.
Key points
- Know the four TCP/IP layers and which security tools work at each.
- Private ranges are not automatically safe; attackers often operate from inside.
- TCP uses a three-way handshake; UDP is connectionless and easier to spoof.
- Firewalls decide based on source and destination IP, ports and protocol.