Network Security Fundamentals
You cannot hack a network you do not understand. This guide covers the absolute essentials of networking that every security professional must master. From the packets on the wire to the logical addressing schemes.
Why This Matters
What You'll Learn
- OSI and TCP/IP model mastery
- IP addressing and subnetting
- Protocol analysis and packet inspection
- Common ports and services identification
- Network defense mechanisms
- Modern protocol security (QUIC, gRPC)
- Traffic capture and analysis
- Attack surface mapping by layer
OSI Attack Surface Map
Quick Legend
Attack Focus
🔴 Red ports = High-value targets
🟡 Yellow ports = Common services
🟢 Green ports = Encrypted/Secure
🟣 Purple ports = Auth-critical
View Exploitation Techniques →
The Two Models You Must Know
OSI Model (7 Layers)
The theoretical framework. Used for discussing attacks.
TCP/IP Model (4 Layers)
The practical implementation. What actually runs.
Mnemonic: "All Traffic Is Not Perfect" (Application, Transport, Internet, Network Access)
Attack Surface by Layer
Every layer presents unique attack opportunities. Knowing where an attack occurs helps you understand how to execute and defend against it.
| Layer | Attack Type | Example Techniques | MITRE ATT&CK |
|---|---|---|---|
| L7 - Application | Web/App Exploits | SQL Injection, XSS, API Abuse, RCE | T1190 | Exploit Public-Facing Application |
| L6 - Presentation | Encryption Attacks | SSL Stripping, Padding Oracle, Downgrade Attacks | T1557 | Adversary-in-the-Middle |
| L5 - Session | Session Hijacking | Cookie Theft, Session Fixation, Token Replay | T1563 | Remote Service Session Hijacking |
| L4 - Transport | Connection Attacks | SYN Flood, Port Scanning, TCP Sequence Prediction | T1046 | Network Service Discovery |
| L3 - Network | Routing Attacks | IP Spoofing, ICMP Redirect, BGP Hijacking | T1599 | Network Boundary Bridging |
| L2 - Data Link | LAN Attacks | ARP Spoofing, MAC Flooding, VLAN Hopping | T1557.002 | ARP Cache Poisoning |
| L1 - Physical | Hardware Attacks | Cable Tapping, Rogue Devices, Jamming | T1200 | Hardware Additions |
Deep Dive Available
Quick Reference: Critical Ports
These are the ports you will encounter on almost every engagement. Color-coded by risk: high, medium, secure, auth-critical.
Remote Access & File Transfer
Web Services
Authentication & Directory
Windows / Linux File Sharing
Databases
Management & Email
Learning Modules
Networking Basics
The foundation: OSI Model, IP Addressing, and MAC Addresses.
Protocols & Ports
Understanding TCP/UDP, the 3-Way Handshake, and common services.
Subnetting
Mastering IP division, CIDR notation, and network segmentation.
Firewalls & Defense
Understanding network defenses: firewalls, IDS/IPS, and segmentation.
Packet Analysis
Deep-dive into packet structure, headers, and traffic forensics.
Network Traffic
Capturing, analyzing, and interpreting network communications.
Modern Protocols
QUIC, HTTP/3, gRPC, WebSockets, and encrypted DNS (DoH/DoT).
Essential Recon Commands
Copy-paste these into your terminal to start exploring any network.
Discover Live Hosts (Ping Sweep)
nmap -sn 192.168.1.0/24nmap -sn 192.168.1.0/24Quick Port Scan (Top 1000)
nmap -sT -T4 <target_ip>nmap -sT -T4 <target_ip>View Your Network Interfaces
ip addr show # Linux
ipconfig /all # Windows
ifconfig # macOSip addr show # Linux
ipconfig /all # Windows
ifconfig # macOSCheck ARP Table (Local Neighbors)
arp -a # All platforms
ip neigh show # Linux modernarp -a # All platforms
ip neigh show # Linux modernTrace the Route to a Target
traceroute <target> # Linux/macOS
tracert <target> # Windowstraceroute <target> # Linux/macOS
tracert <target> # WindowsFull Service Scan with Scripts
nmap -sC -sV -O -p- <target_ip>nmap -sC -sV -O -p- <target_ip>Related Tools
Subnet Calculator
Calculate network ranges, broadcast addresses, and host counts.
Port Reference
Comprehensive list of common and uncommon service ports.
Nmap Command Builder
Interactively build Nmap commands for your scans.
Wireshark Cheatsheet
Filter expressions and analysis tips for packet capture.