By Davy Rogers. Use these techniques only in environments you own or have explicit permission to test.

Introduction to Networking

Computer networking is the backbone of cybersecurity. Whether you're attacking systems, defending networks, or analyzing traffic, understanding how data flows between devices is absolutely essential. This lesson provides the foundation you need to understand network security, packet analysis, and communication protocols that you'll encounter throughout your cybersecurity journey.

What You'll Learn

  • What computer networking is and why it matters
  • Basic networking concepts and terminology
  • The OSI and TCP/IP models
  • Network types (LAN, WAN, WLAN)
  • Network topologies
  • How data travels across networks
  • Why networking knowledge is critical for security

What is Computer Networking?

Networking is the practice of connecting two or more computing devices to share resources and exchange data.

Simple Example:

Your Computer  ←→  Router  ←→  Internet  ←→  Web Server
     (You)                                    (Google)

When you type google.com, your computer:

  1. Sends a request through your router
  2. Travels across the internet
  3. Reaches Google's servers
  4. Returns the webpage to you

All of this happens in milliseconds!

Why Networking Matters in Cybersecurity

For Offensive Security (Pentesting):

  • Port scanning: Find open services on target systems
  • Traffic interception: Man-in-the-middle attacks
  • Network pivoting: Move laterally through networks
  • Exploitation: Attack network services
  • Evasion: Bypass firewalls and IDS/IPS

For Defensive Security (Blue Team):

  • Traffic analysis: Detect malicious activity
  • Network monitoring: Identify anomalies
  • Incident response: Trace attack paths
  • Firewall configuration: Protect network perimeters
  • Network segmentation: Limit blast radius

Real-World Example:

# Pentester discovers open port
nmap 10.0.0.5
# Port 445 (SMB) is open

# Exploit SMB vulnerability
use exploit/windows/smb/ms17_010_eternalblue

# Without networking knowledge:
# ❌ "What's a port?"
# ❌ "What's SMB?"
# ❌ "How do I connect to it?"

Network Types

1. LAN (Local Area Network)

Scope: Small geographical area (home, office, building)

Characteristics:

  • High speed (1 Gbps to 10 Gbps)
  • Low latency
  • Privately owned
  • Limited geographical area

Examples:

  • Your home Wi-Fi network
  • Office network in a building
  • School computer lab
┌─────────┐    ┌─────────┐    ┌─────────┐
│Computer │────│ Switch  │────│Computer │
└─────────┘    └────┬────┘    └─────────┘
                    │
               ┌────┴────┐
               │  Router │
               └────┬────┘
                    │
               [ Internet ]

2. WAN (Wide Area Network)

Scope: Large geographical area (cities, countries, continents)

Characteristics:

  • Slower than LAN
  • Higher latency
  • Often leased lines
  • Connects multiple LANs

Examples:

  • The Internet (largest WAN)
  • Corporate networks connecting multiple offices
  • ISP infrastructure
    Office (NYC)         Office (LA)        Office (London)
   ┌──────────┐         ┌──────────┐       ┌──────────┐
   │   LAN    │         │   LAN    │       │   LAN    │
   └────┬─────┘         └────┬─────┘       └────┬─────┘
        │                    │                   │
        └────────────┬───────┴───────────────────┘
                     │
                [ WAN / Internet ]

3. WLAN (Wireless Local Area Network)

Scope: LAN using wireless technology (Wi-Fi)

Characteristics:

  • No physical cables
  • Easier to deploy
  • More security challenges
  • Radio frequency interference

Examples:

  • Home Wi-Fi
  • Coffee shop Wi-Fi
  • Airport Wi-Fi

Security Concerns:

  • Signal can be intercepted (wireless sniffing)
  • Weak encryption (WEP, WPA)
  • Rogue access points
  • Evil twin attacks

4. Other Network Types

PAN (Personal Area Network):

  • Very small range (10 meters)
  • Examples: Bluetooth, USB connections

MAN (Metropolitan Area Network):

  • City-wide network
  • Larger than LAN, smaller than WAN

VPN (Virtual Private Network):

  • Encrypted tunnel over public network
  • Secure remote access

Network Topologies

Topology = Physical or logical arrangement of network devices

1. Bus Topology

Computer─┬─Computer─┬─Computer─┬─Computer
         │          │          │
    (Single cable - backbone)

Pros: Simple, cheap Cons: Single point of failure, slow with many devices

2. Star Topology (Most Common)

        Computer
            │
Computer────Switch────Computer
            │
        Computer

Pros: Easy to manage, fault-tolerant Cons: Central device is single point of failure

3. Ring Topology

Computer → Computer
   ↑           ↓
Computer ← Computer

Pros: Equal access, predictable performance Cons: One break affects entire network

4. Mesh Topology

Computer ←→ Computer
   ↕     ×      ↕
Computer ←→ Computer

Pros: Highly redundant, fault-tolerant Cons: Expensive, complex

The OSI Model (7 Layers)

The OSI (Open Systems Interconnection) Model is a conceptual framework for understanding network communication.

┌───────────────────────────────────────┐
│ 7. Application  │ HTTP, FTP, SMTP     │ ← User applications
├───────────────────────────────────────┤
│ 6. Presentation │ Encryption, Encoding│ ← Data formatting
├───────────────────────────────────────┤
│ 5. Session      │ Session management  │ ← Connections
├───────────────────────────────────────┤
│ 4. Transport    │ TCP, UDP            │ ← End-to-end delivery
├───────────────────────────────────────┤
│ 3. Network      │ IP, ICMP, Routing   │ ← Logical addressing
├───────────────────────────────────────┤
│ 2. Data Link    │ MAC, Switching      │ ← Physical addressing
├───────────────────────────────────────┤
│ 1. Physical     │ Cables, Signals     │ ← Hardware
└───────────────────────────────────────┘

Mnemonic to Remember:

"Please Do Not Throw Sausage Pizza Away"

  • Physical
  • Data Link
  • Network
  • Transport
  • Session
  • Presentation
  • Application

We'll cover the OSI model in detail in a dedicated lesson.

The TCP/IP Model (4 Layers)

TCP/IP is the practical implementation used on the Internet.

OSI Model          TCP/IP Model
─────────          ────────────
Application   ┐
Presentation  ├─→  Application
Session       ┘
Transport     ────→ Transport
Network       ────→ Internet
Data Link     ┐
Physical      └───→ Network Access

TCP/IP Layers:

1. Network Access (Link Layer)

  • Physical transmission
  • Ethernet, Wi-Fi

2. Internet Layer

  • Routing between networks
  • IP addressing (IPv4, IPv6)
  • ICMP (ping)

3. Transport Layer

  • End-to-end communication
  • TCP (reliable) vs UDP (fast)
  • Port numbers

4. Application Layer

  • User applications
  • HTTP, FTP, SSH, DNS

How Data Travels: Encapsulation

Encapsulation = Wrapping data with protocol headers at each layer

Application Layer:    [  Data  ]

Transport Layer:    [ TCP Header | Data ]

Network Layer:    [ IP Header | TCP Header | Data ]

Data Link Layer: [ Ethernet Header | IP Header | TCP Header | Data | Trailer ]

Physical Layer:    → Bits → Electrical signals →

Example: Sending an email

  1. Application: "Hello!"
  2. Transport: Add TCP port (25 for SMTP)
  3. Network: Add IP addresses (source and destination)
  4. Data Link: Add MAC addresses
  5. Physical: Convert to electrical signals

On the receiving end, each layer removes its header (de-encapsulation) until the original data reaches the application.

Key Networking Concepts

1. Protocols

Protocol = Set of rules for communication

Examples:

  • HTTP - Web browsing
  • SMTP - Email sending
  • FTP - File transfer
  • SSH - Secure remote access
  • DNS - Domain name resolution

2. Packets

Packet = Unit of data transmitted over a network

Contains:

  • Header: Metadata (source, destination, protocol)
  • Payload: Actual data
  • Trailer: Error checking (sometimes)
┌────────────────────────────────────────┐
│ IP Header | TCP Header | Data | CRC   │
└────────────────────────────────────────┘

3. IP Addresses

IP Address = Unique identifier for a device on a network

IPv4: 192.168.1.100 (32-bit, ~4.3 billion addresses) IPv6: 2001:0db8:85a3::8a2e:0370:7334 (128-bit, practically unlimited)

4. MAC Addresses

MAC (Media Access Control) = Physical hardware address

Format: 00:1A:2B:3C:4D:5E (48-bit)

  • Burned into network interface card (NIC)
  • First 3 bytes = Manufacturer
  • Last 3 bytes = Unique identifier

5. Ports

Port = Virtual endpoint for communication (0-65535)

Examples:

  • 80: HTTP (web)
  • 443: HTTPS (secure web)
  • 22: SSH (remote access)
  • 3389: RDP (Windows remote desktop)

Analogy: IP address = Building address, Port = Apartment number

6. DNS (Domain Name System)

DNS = Translates domain names to IP addresses

You type: google.com
DNS says: "That's 142.250.185.46"

Without DNS, you'd have to remember IP addresses for every website!

Network Devices

1. Router

  • Function: Connects different networks
  • Layer: Network (Layer 3)
  • Forwards packets between networks
Home Network (192.168.1.0/24)
         │
    ┌────┴────┐
    │  Router │
    └────┬────┘
         │
      Internet

2. Switch

  • Function: Connects devices within a network
  • Layer: Data Link (Layer 2)
  • Forwards frames based on MAC addresses
Computer ─┬─ Switch ─┬─ Computer
          │          │
      Computer   Computer

3. Hub (Obsolete)

  • Function: Connects devices (dumb repeater)
  • Layer: Physical (Layer 1)
  • Broadcasts to all ports (inefficient, insecure)

4. Firewall

  • Function: Filters traffic based on rules
  • Types: Hardware, software, or both
  • Controls: What traffic is allowed in/out

5. Access Point (AP)

  • Function: Provides Wi-Fi connectivity
  • Connects: Wireless devices to wired network

Network Communication Example

Scenario: You visit google.com

  1. DNS Resolution:

    Your Computer → DNS Server: "What's google.com's IP?"
DNS Server → Your Computer: "142.250.185.46"

  2. TCP Handshake:

    Your Computer → Google: SYN (Let's talk!)
Google → Your Computer: SYN-ACK (OK!)
Your Computer → Google: ACK (Great!)

  3. HTTP Request:

    Your Computer → Google: "GET / HTTP/1.1"

  4. HTTP Response:

    Google → Your Computer: "Here's the HTML..."

  5. Rendering: Your browser displays the Google homepage

All of this happens in milliseconds!

Common Network Commands

Windows:

# Display IP configuration
ipconfig

# Display all network settings
ipconfig /all

# Test connectivity
ping google.com

# Trace route to destination
tracert google.com

# Display routing table
route print

# Display active connections
netstat -an

# Display DNS cache
ipconfig /displaydns

# Flush DNS cache
ipconfig /flushdns

Linux/macOS:

# Display IP configuration
ip addr show     # Modern
ifconfig         # Legacy

# Test connectivity
ping -c 4 google.com

# Trace route
traceroute google.com

# Display routing table
ip route show
route -n

# Display active connections
netstat -tuln    # Legacy
ss -tuln         # Modern

# DNS lookup
dig google.com
nslookup google.com

# Display ARP cache
ip neigh show
arp -a

Networking in Penetration Testing

Reconnaissance Phase:

# Discover live hosts
nmap -sn 192.168.1.0/24

# Scan for open ports
nmap -p- 192.168.1.100

# Identify services
nmap -sV 192.168.1.100

# OS detection
sudo nmap -O 192.168.1.100

Traffic Analysis:

# Capture packets
tcpdump -i eth0 -w capture.pcap

# Analyze with Wireshark
wireshark capture.pcap

# Monitor specific port
tcpdump -i eth0 port 80

Network Exploitation:

# ARP spoofing (MITM)
arpspoof -i eth0 -t 192.168.1.5 192.168.1.1

# DNS spoofing
dnsspoof -i eth0

# Packet injection
packit -m inject -i eth0

Try It Yourself

Beginner Exercises:

1. Explore Your Network:

# What's your IP address?
ipconfig    # Windows
ip addr     # Linux

# Who's your router?
ipconfig | findstr "Default Gateway"  # Windows
ip route show                         # Linux

# What devices are on your network?
arp -a

2. Test Connectivity:

# Can you reach Google?
ping google.com

# How many hops to reach Google?
tracert google.com   # Windows
traceroute google.com # Linux

3. Check Open Ports:

# What's listening on your machine?
netstat -an | findstr LISTENING  # Windows
ss -tuln                         # Linux

4. DNS Lookup:

# What's Google's IP?
nslookup google.com

# Detailed DNS info
dig google.com

Challenge:

Map your home network:

  1. Find your IP address
  2. Find your router's IP
  3. Scan your network for devices
  4. Identify what each device is
  5. Draw a network diagram

Common Networking Terms

Bandwidth: Amount of data transmitted per unit time (Mbps, Gbps)

Latency: Time delay in data transmission (milliseconds)

Throughput: Actual data transfer rate achieved

Packet Loss: Percentage of packets that don't reach destination

Jitter: Variation in latency

MTU (Maximum Transmission Unit): Largest packet size (usually 1500 bytes)

NAT (Network Address Translation): Maps private IPs to public IP

DHCP (Dynamic Host Configuration Protocol): Automatically assigns IP addresses

Subnet: Division of a larger network into smaller networks

Gateway: Device that routes traffic between networks (usually your router)

Resources

Interactive Learning:

Books:

  • "Computer Networking: A Top-Down Approach" by Kurose & Ross
  • "TCP/IP Illustrated" by W. Richard Stevens
  • "Network Warrior" by Gary Donahue

Courses:

  • Cisco CCNA - Industry-standard networking certification
  • CompTIA Network+ - Entry-level networking cert
  • Professor Messer's Network+ course (free on YouTube)

Practice:

Next Steps

  1. Next lesson: Learn about network protocols in detail
  2. Install Wireshark: Start capturing and analyzing packets
  3. Practice commands: Get comfortable with networking tools
  4. Draw your network: Create a diagram of your home/lab network
  5. Experiment: Set up a virtual lab with multiple VMs

Remember: Networking is fundamental to everything in cybersecurity. Master these basics, and the advanced topics will make much more sense!

"The network is the computer." - John Gage, Sun Microsystems (In security, the network is the battlefield!)

Up next

What is a Network Protocol

Understanding how network protocols enable communication.