Basic Networking Concepts for Security Professionals

The OSI Model and Encapsulation

The OSI model serves as the conceptual roadmap for how data travels across a network, abstracting complex processes into seven distinct layers. For security, the most important takeaway is the concept of encapsulation: as data moves down the stack, each layer wraps the payload in its own header. By the time a packet hits the physical wire, it contains layers of headers—Ethernet, IP, and TCP. A security professional must understand this because threats often hide within specific header fields, such as TTL values or TCP flags, that are invisible to higher-level applications. By deconstructing these headers, we can reason about whether a packet is legitimate or malformed. If a header field deviates from RFC standards, it often indicates an attempt to evade a firewall or fingerprint an operating system, making deep packet inspection our primary tool for anomaly detection.

# Using standard tools to inspect a packet structure
# This shows how we might capture the raw header bytes for analysis
import socket

# Create a raw socket to listen for incoming packets
sniffer = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_TCP)
sniffer.bind(('0.0.0.0', 0))

# Receive the packet header
packet = sniffer.recvfrom(65565)
print(f"Raw packet header captured: {packet[0][:20].hex()}")

Address Resolution Protocol (ARP)

ARP is the essential mechanism used to map a known IP address to a physical MAC address within a local network segment. Because switches and network interface cards operate at the Data Link Layer, they require MAC addresses to forward frames to the correct hardware. The vulnerability here lies in the trust-based nature of the protocol; ARP is stateless and allows for gratuitous replies. This means any device on a segment can broadcast an ARP response claiming to be a specific IP address without ever having received a request. This fundamental design choice is the reason Man-in-the-Middle (MitM) attacks occur, as an attacker can poison the ARP cache of a victim, forcing them to send traffic to the attacker's machine instead of the legitimate gateway. Understanding this allows you to recognize traffic spikes or suspicious MAC-IP mismatches in your logs.

# A script to monitor for suspicious ARP-like activity
# We check for broadcast frames that attempt to claim IP ownership
def detect_arp_spoof(source_mac, target_mac, claim_ip):
    # If the gateway MAC changes suddenly, it's a security alert
    known_gateway_mac = "00:11:22:33:44:55"
    if source_mac != known_gateway_mac:
        print(f"Alert: Possible ARP Spoofing detected for IP: {claim_ip}")

# Simulate receiving an ARP broadcast
detect_arp_spoof("AA:BB:CC:DD:EE:FF", "FF:FF:FF:FF:FF:FF", "192.168.1.1")

Transmission Control Protocol (TCP) Handshake

TCP is a connection-oriented protocol that ensures reliability through a sequence of handshakes, acknowledgments, and sequence numbers. The three-way handshake—SYN, SYN-ACK, ACK—is the bedrock of session establishment. Security professionals focus on this process because it is a common target for state-exhaustion attacks. By initiating a SYN request and ignoring the responding SYN-ACK, an attacker leaves the server in a half-open state, consuming memory resources until the service crashes. Furthermore, tracking TCP states allows us to implement stateful firewalls; these firewalls don't just look at single packets, but rather the flow of traffic to verify that an incoming packet is part of an established, valid session. If a packet arrives claiming to be an 'ACK' without a previous handshake initiation, the firewall drops it as a spoofed attempt to gain unauthorized entry to the network.

# Simulating a check for half-open connection attempts
connections = {'192.168.1.5': 'SYN_RECEIVED', '192.168.1.10': 'ESTABLISHED'}

for ip, state in connections.items():
    if state == 'SYN_RECEIVED':
        print(f"Warning: Potential SYN flood source found at {ip}")

User Datagram Protocol (UDP) and Statelessness

Unlike TCP, UDP is a connectionless, stateless protocol designed for speed. Because it lacks a handshake and error recovery mechanisms, it is inherently faster but also more susceptible to abuse. In UDP, the sender simply blasts packets toward the destination without verifying if the receiver is ready or even active. For security, this is a major concern because it facilitates amplification attacks. An attacker can send a tiny request to a public-facing service (like a DNS resolver) that is spoofed to appear as though it came from the victim. The service then sends a massive response to the victim. Because UDP is stateless, there is no handshake to prove the identity of the source, making it extremely difficult to verify the legitimacy of traffic before it reaches your network's perimeter and overwhelms your infrastructure.

# Simple UDP listener to check for high-volume traffic influx
import socket

# Create a UDP socket to receive datagrams
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.bind(('0.0.0.0', 53))

# A basic counter to detect potential flood conditions
packet_count = 0
while packet_count < 1000:
    data, addr = sock.recvfrom(1024)
    packet_count += 1
print("Received 1000 UDP packets, checking for flood patterns...")

Domain Name System (DNS) and Resolution

DNS translates human-readable hostnames into IP addresses, functioning as the phonebook of the internet. It operates primarily over UDP, making it susceptible to the same amplification issues mentioned previously. However, the security challenge extends further into the integrity of the data itself. If an attacker successfully compromises a DNS server or performs DNS cache poisoning, they can redirect traffic destined for a legitimate site to a malicious clone. By manipulating the resolution process, attackers can harvest credentials or inject malware into a user's session without the user ever realizing the domain has changed. Therefore, security professionals must monitor DNS queries for unusual patterns, such as sudden spikes in requests for rare domains or requests that attempt to resolve internal hostnames from external, unauthorized recursive resolvers on the public internet.

# Monitoring DNS query logs for suspicious patterns
dns_logs = ["google.com", "malicious-domain.xyz", "internal.local"]

for query in dns_logs:
    # Check if internal domains are being queried externally
    if "internal.local" in query:
        print(f"Alert: Unauthorized internal DNS lookup detected for: {query}")

Interview questions

All cyber security interview questions →

Check yourself

Take the full cyber security quiz →