Module 2 of 20 — Core Infrastructure

Networking Fundamentals & OSI Model Deep Dive

Networking is the bloodstream of enterprise technology. Every cyber attack moves through networks. Every defensive control monitors or filters network traffic. This module dissects how data travels across networks, the protocols that power the internet, and the security implications of each layer in the networking stack.

The OSI Model: Understanding Network Communication

The Open Systems Interconnection (OSI) model is a 7-layer framework that standardizes network functions from physical cables to application data. Developed by ISO in 1984, it remains fundamental to understanding network security, troubleshooting, and attack vectors.

Info

Why 7 Layers Matter for Security: Each layer presents unique attack surfaces. Security controls operate at specific layers: firewalls (Layers 3–4), encryption (Layer 6), IDS (Layers 3–7). Understanding which layer an attack exploits helps you select proper defenses.
7

Application

Layer 7

User-facing protocols and data formats. HTTP, HTTPS, FTP, SMTP, DNS operate here.

Key Protocols

HTTP/HTTPS (Web)SMTP (Email)FTP (File Transfer)DNS (Name Resolution)SSH (Remote Access)

Protocol Data Unit

Data

Analogy: Like the content of a letter you’re writing—the actual message you want to send.

Important

Real Incident: Heartbleed (2014): OpenSSL vulnerability in TLS implementation at Application layer allowed extraction of 64KB memory chunks from servers, compromising private keys and session cookies across millions of websites.
6

Presentation

Layer 6

Data translation, encryption, compression, and formatting. Converts data into a format the Application layer can understand.

Key Protocols

SSL/TLS (Encryption)JPEG/PNG (Image formats)MPEG (Video)ASCII/Unicode (Character encoding)

Protocol Data Unit

Data

Analogy: Like translating a letter into a foreign language or encrypting it so only the recipient can read it.

Important

Real Incident: ROCA (2017): Infineon TPM vulnerability in RSA key generation algorithm allowed attackers to factor private keys by exploiting weaknesses in the presentation layer's data transformation process, affecting Estonia's national ID cards and other systems.
5

Session

Layer 5

Establishes, maintains, and terminates connections between applications. Manages dialogues and control.

Key Protocols

NetBIOSRPCPPTPSockets (TCP/UDP port binding)

Protocol Data Unit

Data

Analogy: Like a phone call—you dial (establish), talk (maintain), and hang up (terminate).

Important

Real Incident: Session hijacking attacks on e-commerce sites in the early 2000s where attackers stole session cookies to impersonate logged-in users, placing fraudulent orders. Led to implementation of secure session management and HttpOnly cookies.
4

Transport

Layer 4

End-to-end communication, reliability, flow control, error recovery. TCP (reliable) vs UDP (fast but unreliable).

Key Protocols

TCP (Connection-oriented)UDP (Connectionless)SCTP (Multi-streaming)

Protocol Data Unit

Segments (TCP) / Datagrams (UDP)

Analogy: Like postal service—TCP is registered mail with receipt (guaranteed delivery), UDP is regular mail (may or may not arrive).

Important

Real Incident: TCP SYN Flood (1996): First major DoS attack exploited TCP's three-way handshake by sending SYN packets without completing handshake, exhausting server resources. Led to SYN cookies and modern DDoS mitigation techniques.
3

Network

Layer 3

Logical addressing and routing. IP addresses determine where packets go. Routers operate at this layer.

Key Protocols

IP (IPv4/IPv6)ICMP (diagnostics)ARP (address resolution)BGP/OSPF (routing protocols)

Protocol Data Unit

Packets

Analogy: Like the postal address on an envelope—tells the post office where to deliver.

Important

Real Incident: SolarWinds (2020): Attackers bypassed network segmentation by compromising legitimate admin tools. Network layer security (VLANs, firewalls, route filtering) is critical to limiting lateral movement.
2

Data Link

Layer 2

Physical addressing (MAC addresses), error detection, flow control between directly connected nodes. Switches operate here.

Key Protocols

Ethernet (IEEE 802.3)Wi-Fi (IEEE 802.11)ARPPPP

Protocol Data Unit

Frames

Analogy: Like the specific apartment number in a building—once mail reaches the building, this tells you which unit.

Important

Real Incident: MAC flooding attacks on switches (early 2000s): Attackers flooded switches with fake MAC addresses, forcing switches into “fail-open” mode where they broadcast all traffic, enabling sniffing of traffic across VLANs. Led to port security features on modern switches.
1

Physical

Layer 1

Actual physical medium: cables, fiber optics, radio waves, connectors, voltages. Defines how bits are transmitted as electrical/light signals.

Key Protocols

Ethernet cables (Cat5e/6)Fiber opticsWi-Fi radioBluetoothCoaxial

Protocol Data Unit

Bits (0s and 1s)

Analogy: Like the road or fiber optic cable itself—the physical medium everything travels on.

Important

Real Incident: Fiber tap attacks: Attackers physically access fiber optic cables and use bend-sensitive taps to extract data without breaking the connection. Undetectable by network monitoring since no electrical disruption occurs. Requires physical security and encryption.

TCP/IP Model: The Internet's Architecture

The TCP/IP model (DoD model)is a 4-layer model that describes how the actual internet works. It's the practical implementation behind the theoretical OSI model.

1

Application Layer

Combines OSI layers 5-7. Protocols: HTTP, DNS, SMTP, FTP.

Maps to OSI Layers:

Application, Presentation, Session

2

Transport Layer

Direct mapping to OSI layer 4. Protocols: TCP, UDP.

Maps to OSI Layers:

Transport

3

Internet Layer

IP addressing and routing. Protocols: IP, ICMP, ARP.

Maps to OSI Layers:

Network

4

Network Access / Link Layer

Physical transmission and local network communication. Protocols: Ethernet, Wi-Fi.

Maps to OSI Layers:

Data Link, Physical

Tip

Key Insight: When a web browser (Application) requests a page, data flows down through TCP/IP layers, across networks, then up through layers at destination. At each layer, protocol-specific headers are added (encapsulation) and then stripped (decapsulation).

IP Addressing & Subnetting: Network Segmentation Fundamentals

IP addressing and subnetting control how networks are structured and how traffic flows. Understanding subnetting is essential for network security—proper segmentation contains breaches and limits lateral movement.

IPv4 Address Structure

An IPv4 address is 32 bits (4 octets) written as dotted decimal: 192.168.1.1

1
9
2
1
6
8
1
1

First two octets (192.168): Network portion | Last two octets (1.1): Host portion

Subnet Masks & CIDR Notation

Subnet mask defines network vs host bits. CIDR (Classless Inter-Domain Routing) notation: /24 means 24 bits for network.

bash
1192.168.1.0/24
2255.255.255.0 = 24 network bits
3 
4192.168.1.0/26
5255.255.255.192 = 26 network bits
6= 4 subnets with 62 hosts each

Real-World Subnetting Scenarios

Corporate Network Segmentation

Original Network:

bash
1192.168.1.0/24 (256 addresses)

Split Into:

bash
14 subnets of 62 hosts each: 192.168.1.0/26, 192.168.1.64/26, 192.168.1.128/26, 192.168.1.192/26

Security Reason:

Separate departments (Finance, Engineering, HR, Guest WiFi) to limit lateral movement if one segment is compromised.

DMZ Design

Original Network:

bash
110.0.0.0/16 (65,536 addresses)

Split Into:

bash
1Public web servers: 10.0.1.0/24, Database servers: 10.0.2.0/25, Admin network: 10.0.2.128/25

Security Reason:

Public-facing systems isolated from internal resources. Database subnet only accessible from application servers, not directly from internet.

Network Security Devices & Their Functions

Network security relies on specialized hardware at different layers of the stack. Each device serves distinct security functions.

Router

Layer 3 (Network)

Function: Connects different networks. Routes traffic based on IP addresses. Makes forwarding decisions using routing tables.

Security Role: Enforces network boundaries, implements ACLs (Access Control Lists), terminates VPN tunnels, performs NAT (Network Address Translation).

Example: Corporate router blocks all incoming connections except HTTPS (443) and SSH (22) from known management IPs.

Switch

Layer 2 (Data Link)

Function: Connects devices on the same network. Forwards frames based on MAC addresses.

Security Role: VLAN segmentation, port security (MAC limiting), 802.1X authentication, DHCP snooping, ARP inspection.

Example: Switch configured with 802.1X prevents unauthorized devices from connecting to corporate network—devices must authenticate with credentials before gaining network access.

Firewall

Layer 3/4 (Network/Transport)

Function: Filters traffic based on rules. Can be stateful (tracks connections) or stateless.

Security Role: Enforces network security policy, blocks/allow traffic based on IP, port, protocol, application signatures.

Example: Next-Gen Firewall (NGFW) inspects HTTPS traffic, blocks known malware C2 communications, and enforces user-based policies.

IDS/IPS

Layer 2-7 (varies)

Function: IDS detects, IPS prevents malicious traffic. Signature-based and anomaly-based detection.

Security Role: Network monitoring, threat detection, attack prevention, forensic logging.

Example: Snort IPS detected and blocked SMB exploit attempts from an internal machine contacting known malicious IPs during incident response.

Load Balancer

Layer 4-7

Function: Distributes traffic across multiple servers for performance and redundancy.

Security Role: DDoS protection, SSL offloading, application layer filtering, WAF integration.

Example: Cloud load balancer acted as first line of defense during DDoS attack by absorbing traffic spikes and rate-limiting suspicious requests.

Network Attack Vectors: Deep Dive

Most cyber attacks begin with network reconnaissance followed by exploitation of network-based vulnerabilities. Understanding these attack methodologies is critical for defense.

1

Man-in-the-Middle (MITM)

Method: Attacker intercepts communication between two parties. Can be passive (eavesdropping) or active (injecting/modifying traffic).

Common Techniques:

  • ARP spoofing/poisoning
  • Rogue DHCP server
  • DNS spoofing
  • SSL stripping
  • Evil Twin WiFi

Defensive Measures:

  • End-to-end encryption (TLS with certificate pinning)
  • network monitoring for ARP anomalies
  • static ARP entries for critical servers.

Important

Real Incident: Superfish (2015): Lenovo laptops shipped with adware that installed self-signed root certificate. Adware performed HTTPS interception to inject ads, creating massive security vulnerability that could be exploited by any attacker on same network.
2

Denial of Service (DoS/DDoS)

Method: Overwhelm target with traffic or resource requests to make service unavailable.

Common Techniques:

  • SYN Flood
  • UDP Flood
  • HTTP Flood
  • DNS Amplification
  • Ping of Death

Defensive Measures:

  • Anycast network distribution
  • rate limiting
  • scrubbing centers
  • DDoS mitigation services (Cloudflare
  • Akamai)
  • traffic shaping.

Important

Real Incident: Dyn DDoS (2016): Mirai botnet of compromised IoT devices launched 1.2 Tbps DDoS attack on DNS provider Dyn, taking down Twitter, Netflix, Reddit, Spotify, and others across US East Coast.
3

ARP Spoofing/Poisoning

Method: Send fake ARP messages to associate attacker MAC with victim IP. Enables MITM on local network.

Common Techniques:

  • Gratuitous ARP replies
  • ARP cache poisoning
  • ARP flood

Defensive Measures:

  • Static ARP entries for critical systems
  • Dynamic ARP Inspection (DAI) on switches
  • VPN for all wireless communications
  • port security.

Important

Real Incident: Rogue access points in coffee shops (common): Attackers set up WiFi with common SSID names (e.g., “Starbucks WiFi”). When devices connect, attacker performs ARP spoofing to intercept all traffic, harvesting credentials and session cookies.
4

DNS Cache Poisoning

Method: Corrupt DNS resolver cache to return malicious IP for legitimate domain.

Common Techniques:

  • DNS ID spoofing
  • Cache poisoning via prediction
  • Pharming attacks

Defensive Measures:

  • DNSSEC (DNS Security Extensions)
  • use trusted DNS resolvers (1.1.1.1
  • 8.8.8.8)
  • monitor DNS records for changes.

Important

Real Incident: SeaDragon/M fimware attack (2011): Compromised DNS servers of ISP to redirect users searching for popular domains to malicious sites. Infects computers with ransomware and banking trojans. Millions affected across Europe.
5

BGP Hijacking

Method: Announce fake IP prefixes to reroute internet traffic through attacker-controlled networks.

Common Techniques:

  • Prefix hijacking
  • Subprefix hijacking
  • Session hijacking

Defensive Measures:

  • RPKI (Resource Public Key Infrastructure) for route validation
  • BGP monitoring services
  • multi-homing with diverse providers.

Important

Real Incident: Google traffic rerouted via Russia (2017): Russian ISP (Tele2) accidentally announced BGP routes that diverted 2% of Google's traffic through their network for 4 minutes. Demonstrated fragility of internet routing. More serious: 2008 Pakistan Telecom deliberately hijacked YouTube, making it globally unavailable.

Network Security Best Practices

Implement these proven security controls across your network architecture to reduce attack surface and detect intrusions.

1

Network Segmentation

Divide network into zones with firewalls between them. Critical systems get isolated segments. Compromise of one segment doesn’t mean full network compromise.

2

Zero Trust Architecture

Never trust, always verify. Authenticate and authorize every connection, user, and device—even inside the network. Microsegmentation enforces least-privilege east-west traffic.

3

Defense-in-Depth

Multiple overlapping security layers: perimeter firewall + internal segmentation + endpoint protection + application controls. If one layer fails, others still protect.

4

Encrypted Communications

Use TLS 1.3 everywhere. VPNs for remote access. SSH instead of Telnet. Disable legacy protocols (SSLv3, TLS 1.0/1.1). Perfect Forward Secrecy (PFS) key exchange.

5

Network Monitoring

Deploy IDS/IPS throughout network. Enable NetFlow/sFlow collection. Centralized logging from all network devices. Regular packet capture analysis.

6

Secure Configuration

Disable unused ports and services. Change default credentials. Apply security hardening guides (CIS Benchmarks). Regular vulnerability scanning.

Key Takeaways

  • OSI Model (7 layers) is fundamental to understanding network security controls and attack surfaces.
  • Each OSI layer hosts distinct protocols, attacks, and security controls. Know what operates at each layer.
  • Subnetting and segmentation are primary defenses against lateral movement after breach.
  • Router (L3) vs Switch (L2) distinction: routers connect different networks, switches connect devices within same network.
  • Common attacks like MITM, DoS, ARP poisoning exploit protocol weaknesses—understanding protocols reveals vulnerabilities.
  • Defense-in-depth means overlapping controls at multiple layers—no single point of failure.

Further Reading & Resources

Wireshark Labs

Practice protocol analysis with free packet capture tool. Analyze real network traffic and understand protocol behavior.

TCP/IP Illustrated (Stevens)

The definitive book on TCP/IP protocol internals. Volume 1 is essential reading for network engineers.

Cisco Networking Academy

Free networking fundamentals course covering CCNA-level material with hands-on labs.

MIT 6.829 (Computer Networks)

MIT OpenCourseWare graduate-level networking course with lecture notes and assignments.

Module 2 of 20
FoundationsNext: Cryptography