BeginnerNetworking

Networking Basics: Understanding TCP/IP, DNS, and Network Protocols

Learn the fundamentals of computer networking including the OSI model, TCP/IP protocol suite, IP addressing, subnetting, DNS, and network security essentials.

#networking#TCP/IP#DNS#OSI model#network security#subnetting

Why Networking Fundamentals Matter

Every cyber attack travels over a network. Whether an attacker is exploiting a web application, intercepting wireless traffic, or launching a denial-of-service attack, they are manipulating network protocols. To defend against these attacks — or to conduct authorized penetration testing — you must understand how networks operate at a fundamental level.

The OSI Model

The Open Systems Interconnection (OSI) model is a conceptual framework that standardizes networking functions into seven layers. Each layer provides services to the layer above it and receives services from the layer below.

|-------|------|----------|-----------------|

While the TCP/IP model (four layers) is more practical, the OSI model remains invaluable for troubleshooting and understanding where different protocols operate.

The TCP/IP Protocol Suite

TCP/IP is the foundational protocol suite of the internet. It consists of four layers: Application, Transport, Internet, and Link.

TCP vs UDP

TCP (Transmission Control Protocol) is connection-oriented and guaranteed. It establishes a three-way handshake (SYN, SYN-ACK, ACK) before sending data, ensures ordered delivery, and retransmits lost packets. TCP is used where reliability matters: web browsing, email, file transfers.

UDP (User Datagram Protocol) is connectionless and best-effort. It sends datagrams without establishing a connection, with no guarantee of delivery or ordering. UDP is used where speed matters over reliability: streaming, VoIP, DNS queries, DHCP.

IP Addressing

Every device on a network needs a unique IP address. IPv4 addresses are 32-bit numbers typically written in dotted decimal notation (192.168.1.1). With address exhaustion, IPv6 (128-bit) is gradually being adopted.

Subnetting

Subnetting divides a network into smaller, manageable segments. A subnet mask defines which portion of the IP address represents the network and which represents the host.

For example, 192.168.1.0/24 means the first 24 bits are the network portion, leaving 8 bits for hosts (254 usable addresses). Understanding CIDR notation (/16, /24, /28) and subnet calculations is essential for network design and security zoning.

DNS Resolution Process

The Domain Name System translates human-readable domain names into machine-readable IP addresses.

You type "example.com" into your browser.

Your computer checks its local DNS cache.

If not cached, it queries your configured DNS resolver (typically your ISP or a public resolver like 8.8.8.8).

The resolver queries a root nameserver, which directs it to the .com TLD nameserver.

The TLD nameserver points to the authoritative nameserver for example.com.

The authoritative nameserver returns the IP address (or a CNAME record).

Your browser connects to that IP address.

DNS Record Types

| Record | Purpose |

|--------|---------|

| A | Maps a domain to an IPv4 address |

| AAAA | Maps a domain to an IPv6 address |

| CNAME | Canonical name alias |

| MX | Mail exchange server |

| TXT | Arbitrary text (often for verification) |

| NS | Nameserver for the domain |

| SOA | Start of authority — administrative information |

Network Security Fundamentals

Firewalls

Firewalls filter traffic based on rules. Packet-filtering firewalls inspect headers (source/destination IP, port, protocol). Stateful firewalls track connection states and allow return traffic automatically. Next-generation firewalls (NGFW) add application-layer inspection, intrusion prevention, and threat intelligence.

VPNs

Virtual Private Networks encrypt traffic between two endpoints, creating a secure tunnel over an untrusted network. Common protocols include WireGuard, OpenVPN, and IPsec. VPNs protect data in transit and provide remote access to internal networks.

Network Segmentation

Dividing a network into segments limits the blast radius of a breach. If an attacker compromises a workstation in a segmented network, they cannot easily reach the database server in a different segment. VLANs and firewalls enforce segmentation.

Practical Networking Tools

Every security professional should be proficient with these tools:

**ping** — Tests basic connectivity and round-trip time

**traceroute/tracert** — Maps the path packets take to a destination

**nslookup/dig** — Queries DNS records

**nmap** — Scans ports, discovers hosts, identifies services

**tcpdump** — Captures and analyzes network packets from the command line

**Wireshark** — Graphical packet analysis with deep protocol inspection

**netstat/ss** — Shows active connections and listening ports

Understanding these networking fundamentals is the bedrock of cybersecurity. Every attack and defense operates within these protocols. Master the basics here, and advanced topics like penetration testing, traffic analysis, and network defense become far more approachable.

Frequently Asked Questions

What is the OSI model and why does it matter?

The OSI model is a conceptual framework that divides networking into seven layers: Physical, Data Link, Network, Transport, Session, Presentation, and Application. Understanding it helps you troubleshoot network issues by identifying which layer is affected.

What is the difference between TCP and UDP?

TCP is connection-oriented and guarantees delivery with error checking and retransmission, making it reliable for web browsing and file transfers. UDP is connectionless and faster but unreliable, used for streaming, VoIP, and [DNS queries](/learn/dns-explained).

How does DNS resolution work?

When you type a domain name, your browser checks its local cache, then queries a recursive resolver (like 8.8.8.8). The resolver queries root servers, TLD servers, and authoritative servers to find the IP address, typically completing in 10-100 milliseconds.

What is a subnet mask?

A subnet mask defines which portion of an IP address represents the network and which represents the host. For example, 255.255.255.0 (/24) means the first 24 bits are the network portion, allowing 254 usable host addresses.

What is a firewall and how does it work?

A firewall filters network traffic based on rules. Packet-filtering firewalls inspect headers (IP, port, protocol), while stateful firewalls track connection states. Next-generation firewalls add application-layer inspection and intrusion prevention.

What is the difference between IPv4 and IPv6?

IPv4 uses 32-bit addresses (about 4.3 billion addresses), written as four decimal numbers like 192.168.1.1. IPv6 uses 128-bit addresses (virtually unlimited), written as eight hexadecimal groups. IPv6 was created to address IPv4 exhaustion.

What is a VPN and why should I use one?

A [VPN](/learn/vpn-guide) creates an encrypted tunnel between your device and a remote server, protecting your traffic from eavesdropping and masking your IP address. Use VPNs on public WiFi, for privacy, or to access geo-restricted content.

What is network segmentation?

Network segmentation divides a network into smaller, isolated segments. If an attacker compromises one segment, they cannot easily reach other segments. VLANs and firewalls enforce segmentation, limiting the blast radius of breaches.

How do I troubleshoot network connectivity issues?

Start with `ping` to test basic connectivity, then `traceroute` to see where packets stop. Use `nslookup` or `dig` to verify [DNS resolution](/learn/dns-explained), and `netstat -tulpn` to check listening ports and active connections.

What is ARP and why is it important?

ARP (Address Resolution Protocol) maps IP addresses to MAC addresses on a local network. It operates at Layer 2 and is essential for LAN communication. ARP spoofing is a common attack where an attacker associates their MAC with another device's IP.