TCP/IP and the network layers

Why defenders learn networking first

Almost every attack travels over a network: a phishing email, a stolen password used from another country, malware calling home, data being copied out. If you cannot read network data, you cannot see these attacks. Security analysts spend much of their day looking at IP addresses, ports and protocols in logs.

Layers: one job each

Sending data over a network is split into layers. Each layer does one job and hands its work to the next. This makes networks easier to build and to troubleshoot: when something breaks, you ask "which layer?"

There are two common models. The OSI model has 7 layers and is used for teaching and talking. The TCP/IP model has 4 layers and is how the internet really works. They describe the same thing at different detail.

Encapsulation

Encapsulation means each layer wraps the data from the layer above with its own header (a label with addresses and control information). Your web request becomes a TCP segment, inside an IP packet, inside an Ethernet or Wi-Fi frame. The receiver unwraps it layer by layer.

TCP and UDP

The transport layer has two main protocols. A protocol is an agreed set of rules for talking.

• TCP (Transmission Control Protocol): reliable. It sets up a connection, numbers the data, resends anything lost, and delivers it in order. Used by web, email, SSH and file transfer.
• UDP (User Datagram Protocol): fast and simple, with no connection and no resending. Used by DNS lookups, video calls, online games and streaming, where speed matters more than a lost packet.

The TCP three-way handshake

Before TCP sends data, the two sides agree to talk using three small packets, each marked by flags (on/off bits in the TCP header):

Client  → Server   SYN        "I want to talk"
Server  → Client   SYN-ACK    "OK, I hear you, do you hear me?"
Client  → Server   ACK        "Yes. Let's start."
... data ...
Either side        FIN        "I am done" (polite close)
Either side        RST        "Stop now" (reset)

Defenders use this. Thousands of SYN packets with no final ACK can mean a SYN flood (a denial-of-service attack that fills the server's waiting list). One source sending a SYN to hundreds of different ports in a minute usually means a port scan.

Common mistakes

• Thinking a firewall at layer 3/4 can stop a phishing page. That is an application-layer problem; it needs web filtering and user awareness.
• Mixing up MAC and IP addresses. A MAC address identifies a network card on the local network; an IP address identifies a device across networks.
• Assuming UDP traffic is harmless because it is "connectionless". DNS over UDP is used in many attacks.