Network Basics

A clear, organized guide to networking fundamentals for cybersecurity learners.

Learning Objectives#

By the end of this section, you will understand:

• The ISO OSI network model (7 layers)
• IP addressing, subnets, and routing
• TCP, UDP, and port numbers
• How to connect to an open TCP port from the command line

ISO OSI Model#

The OSI (Open Systems Interconnection) model is a conceptual framework that describes how data communication should work in a network. It consists of seven layers, each with specific functions.

Mnemonic for remembering the layers (bottom to top):
Please Do Not Throw Spinach Pizza Away

Layer 1: Physical Layer#

• Defines the physical medium (cables, radio, optical signals).
• Examples: Ethernet cable, WiFi radio bands (2.4GHz, 5GHz).

Layer 2: Data Link Layer#

• Defines protocols for communication on the same network segment.
• Uses MAC addresses (6-byte hardware identifiers).
• Examples: Ethernet (802.3), WiFi (802.11).

Layer 3: Network Layer#

• Handles logical addressing and routing.
• Moves packets between different networks.
• Examples: IP, ICMP, VPN protocols (IPSec).

Layer 4: Transport Layer#

• Provides end-to-end communication.
• Supports error correction, segmentation, flow control.
• Examples: TCP, UDP.

Layer 5: Session Layer#

• Manages and maintains sessions between applications.
• Handles session establishment, maintenance, and synchronization.
• Examples: NFS, RPC.

Layer 6: Presentation Layer#

• Ensures data is delivered in a format the application can understand.
• Handles encoding, encryption, compression.
• Examples: MIME, JPEG, PNG.

Layer 7: Application Layer#

• Provides network services directly to end-user applications.
• Examples: HTTP, FTP, DNS, SMTP, IMAP.

Summary Table#

Key Concepts#

• IP Address: A logical address identifying a device on a network.
• Subnet: A subdivision of a network to improve organization and security.
• Routing: The process of selecting a path for traffic across networks.
• Port Number: Identifies specific services on a host.
• TCP: Reliable, connection-oriented transport protocol.
• UDP: Faster, connectionless transport protocol.

Useful Commands#

Check if a TCP port is open:

nc -vz target_ip port

Show IP configuration:

ip a       # Linux
ipconfig   # Windows

TCP/IP Model#

Now that we've covered the conceptual ISO OSI model, it's important to study the implemented model most widely used in practice: the TCP/IP model.

TCP/IP stands for Transmission Control Protocol/Internet Protocol. It was developed in the 1970s by the U.S. Department of Defense (DoD). One of its design goals was resilience: the ability for a network to continue functioning even if parts are damaged or offline. This is supported by routing protocols that dynamically adapt as network topology changes.

Layers of the TCP/IP Model#

Unlike the 7-layer OSI model, the TCP/IP model is typically described with 4 or 5 layers. Let’s look at the standard 4-layer version:

• Application Layer: Combines OSI layers 5, 6, and 7 (application, presentation, session). Handles high-level protocols, data representation, and user interactions.
• Transport Layer: Equivalent to OSI Layer 4. Provides end-to-end communication, flow control, and reliability.
• Internet Layer: Equivalent to OSI Layer 3. Manages logical addressing and routing across networks.
• Link Layer: Covers OSI Layer 2 responsibilities (and interfaces with the physical layer). Defines communication between devices on the same network.

Mapping OSI and TCP/IP Layers#

Notes on the 4-Layer Variant#

Some textbooks (e.g., Kurose & Ross, Computer Networking: A Top-Down Approach) describe a 4-layer model by explicitly adding:

• Physical Layer: The lowest layer, describing the physical transmission medium.

So the 4-layer stack becomes:

1. Application
2. Transport
3. Network
4. Link

IP Addresses and Subnets#

An IP address is a unique identifier for a device on a network, much like a postal address for your home. It allows devices to find and communicate with each other unambiguously.

IPv4 addresses are the most common. They consist of four octets (32 bits), each ranging from 0 to 255, e.g., 192.168.0.1.

Key Concepts:

• Network Address: The first address in a subnet (e.g., 192.168.1.0).
• Broadcast Address: The last address (e.g., 192.168.1.255), used to communicate with all devices on the subnet.
• Subnet Mask: Defines which part of the address identifies the network. For example, 255.255.255.0 or /24 means the first 24 bits are fixed.

Example of Checking IP Config#

On Linux:

ifconfig

Output shows:

IP address: 192.168.66.89 Subnet mask: 255.255.255.0 Broadcast: 192.168.66.255

Or using:

ip a s

Displays:

192.168.66.89/24 Broadcast: 192.168.66.255

CIDR Notation /24 means 24 bits for the network portion. Addresses in 192.168.66.0/24 range from 192.168.66.1 to 192.168.66.254.

Private vs Public IP Addresses#

Private IP Ranges (RFC 1918): 10.0.0.0 - 10.255.255.255 (10/8) 172.16.0.0 - 172.31.255.255 (172.16/12) 192.168.0.0 - 192.168.255.255 (192.168/16) Public IP: Globally routable on the internet. Private IP: Used within local networks; not routable on the public internet. Requires NAT (Network Address Translation) for internet access.

Routing#

A router acts like a postal sorting center. It examines the destination IP address of a packet and forwards it toward its destination, possibly across many routers. Operates at Layer 3 (Network Layer). Makes routing decisions to deliver data across networks.

Summary IP addresses uniquely identify devices on a network. Subnetting helps organize and manage networks. Private IP addresses allow local communication without using global address space. Routers ensure packets travel the best path to their destination.

UDP and TCP#

Purpose#

While IP ensures delivery to the correct host using an IP address, transport protocols (UDP and TCP) ensure delivery to the correct process on that host using port numbers.

UDP (User Datagram Protocol)#

• Layer: Transport Layer (Layer 4)
• Type: Connectionless protocol
• Features:
  • No connection setup.
  • No delivery guarantees or acknowledgements.
  • Faster, lightweight, low overhead.
• Analogy: Like sending standard mail without delivery confirmation.
• Use Cases: Streaming media, DNS queries, online gaming.
• Ports: 1–65535 (0 reserved).

Key Concept: Port numbers identify sending and receiving processes.

TCP (Transmission Control Protocol)#

• Layer: Transport Layer (Layer 4)
• Type: Connection-oriented protocol
• Features:
  • Establishes a connection before data transfer.
  • Ensures reliable delivery with acknowledgements.
  • Handles sequencing and retransmissions.
• Analogy: Like sending a registered letter with delivery confirmation.
• Use Cases: Web browsing (HTTP/HTTPS), email (SMTP/IMAP), file transfers (FTP).
• Ports: 1–65535 (0 reserved).

TCP Three-Way Handshake#

1. SYN: Client → Server (starts connection, sends initial sequence number).
2. SYN-ACK: Server → Client (acknowledges, sends its own sequence number).
3. ACK: Client → Server (acknowledges server’s sequence number).

Result: A reliable, established connection ready for data exchange.

Summary#

• UDP: Faster, no guarantee of delivery. Suitable for time-sensitive, lossy communication.
• TCP: Reliable, ensures delivery and order. Best for critical data exchanges.

Encapsulation#

Encapsulation is the process where each network layer adds its own header (and sometimes trailer) to the data it receives before passing it to the layer below. This design ensures that each layer focuses on its own role without needing to know details about other layers.

How Encapsulation Works:

1. Application Layer: User data (e.g., a message or HTTP request) is prepared according to the application protocol.
2. Transport Layer: Adds a TCP or UDP header, creating a segment (TCP) or datagram (UDP).
3. Network Layer (Internet Layer): Adds an IP header, forming an IP packet.
4. Link Layer: Adds its own header and trailer (Ethernet or WiFi), creating a frame ready for physical transmission.

Key Point:
Each layer "wraps" the data with its own information. At the receiving end, this process is reversed (decapsulation) to extract the original application data.

The Life of a Packet#

Example: Searching on TryHackMe

1. User Action: You type a search and hit enter.
2. Application Layer: Browser creates an HTTPS (HTTP over TLS) request.
3. Transport Layer:
   • Establishes a TCP connection with the server (3-way handshake).
   • Sends the HTTP request as TCP segments.
4. Network Layer:
   • Adds source and destination IP addresses.
   • Prepares the IP packet for routing.
5. Link Layer:
   • Adds Ethernet or WiFi headers/trailers.
   • Delivers the frame to the local router.

Routing:

• Routers strip and inspect the link-layer information.
• They forward the packet based on its IP destination address.
• Each hop repeats this until it reaches the destination server’s network.

On the Server Side:

• The server reverses the encapsulation.
• It extracts the original HTTP request for the web application to process.