Network Fundamentals for InfoSec: Devices, Protocols, IP Addressing, and Security Controls

Every attack you will ever investigate travels over a network. A phishing email crosses SMTP, a C2 beacon hides inside HTTPS, a port scan is just a flood of TCP SYN packets. If you cannot read the network, you cannot read the incident.

These are my notes from the networking course, rewritten as a single study guide. I merged the topics that repeated across the lecture slides, corrected a few details I found imprecise while cross-checking, and added the security angle that matters for a future SOC Analyst or Security Engineer.

How to use this guide: Read → Draw → Run the command → Explain it out loud. If you can sketch the diagram from memory and explain it in two sentences, you actually know it.

Table of Contents

• What is a Computer Network?
• Network Types by Scale (PAN, LAN, MAN, WAN)
• Network Devices
• Network Topologies
• Network Cables and Connectors
• IP Addressing
• Network Protocols (TCP, UDP, HTTP, HTTPS, FTP)
• OSI Model vs TCP/IP Model
• Routing vs Switching
• Network Security Basics
• Bandwidth, Throughput, and Latency
• Internet Services
• Essential Network Commands
• Why This Matters for a SOC Analyst
• Common Misconceptions
• Quick Revision Checklist

What is a Computer Network?

A computer network is a set of computers and devices connected together so they can communicate, share resources, and exchange data. A network can be tiny (a phone sharing Wi-Fi with a laptop) or planet-sized (the Internet).

                .----------------.
               (    Internet      )
                '-------+--------'
                        |
                  +-----+-----+
                  |  Router   |
                  +--+--+--+--+
                     |  |  |
            +--------+  |  +--------+
            |           |           |
        [Laptop]    [Desktop]    [Server]

Figure 1: The simplest useful picture of a network. Devices connect to a router, and the router connects the local network to the Internet.

Network Types by Scale

Networks are classified by geographic scope. The bigger the network, the wider the area it covers.

+-----------------------------------------------------+
| WAN   countries / continents / the Internet         |
|  +-----------------------------------------------+  |
|  | MAN   a city or metropolitan area             |  |
|  |  +-----------------------------------------+  |  |
|  |  | LAN   home / office / campus            |  |  |
|  |  |  +-----------------------------------+  |  |  |
|  |  |  | PAN   Bluetooth, phone hotspot    |  |  |  |
|  |  |  +-----------------------------------+  |  |  |
|  |  +-----------------------------------------+  |  |
|  +-----------------------------------------------+  |
+-----------------------------------------------------+

Figure 2: Scope of each network type. Larger network, larger coverage.

Don't confuse scale with medium. Separately from scale, we also describe how devices connect:

Network Devices

Each device has one job. Knowing which OSI layer it works at tells you what information it can "see".

Hub vs Switch vs Router

The three devices most often confused. The key difference is who receives your data.

A Typical Home / Small Office Network

        ( Internet / ISP )
               |
          +----+----+
          |  Modem  |    <- connects to ISP (cable / DSL / fiber)
          +----+----+
               |
          +----+----+
          | Router  |    <- routing, NAT, DHCP, basic firewall
          +----+----+
               |
          +----+----+
          | Switch  |    <- Layer 2 forwarding by MAC address
          +--+--+--++
             |  |   \
        Laptop  PC   Access Point  ~~ Wi-Fi ~~  Phone, Tablet

Figure 3: Data flow: Device → Switch → Router → Modem → Internet.

Reality check: the box your ISP gives you is usually an all-in-one device: modem + router + 4-port switch + Wi-Fi access point + DHCP server + NAT + firewall. The functions are separate even when the hardware is shared.

Network Topologies

Topology describes how devices are arranged and connected. There are two views: physical (how cables and devices are actually laid out) and logical (how data actually flows).

BUS                                   STAR
 [PC1]   [PC2]   [PC3]   [PC4]                  [PC1]
   |       |       |       |                      |
 ==+=======+=======+=======+==       [PC4]--- [SWITCH] ---[PC2]
      shared backbone cable                       |
                                                [PC3]

RING                                  MESH (full, 4 nodes)
  [A]--------[B]                       [A]--------[B]
   |          |                         |  \    /  |
   |          |                         |    \/    |
  [D]--------[C]                        |    /\    |
                                        |  /    \  |
                                       [D]--------[C]

TREE
                 [Core Switch]
                 /           \
         [Switch 1]         [Switch 2]
          /      \           /      \
       [PC1]   [PC2]      [PC3]    [PC4]

Figure 4: The five classic topologies.

Full mesh math: 4 nodes need 6 links, 10 nodes need 45, 50 nodes need 1,225. This is why full mesh is rare outside critical backbones.

Network Cables and Connectors

IP Addressing

An IP address is a logical address that identifies a device on a network.

2001:db8::/32 is reserved for documentation. You'll see it in textbooks and slides, never on the real Internet.

Public vs Private vs Special Addresses

Private addresses are not routable on the Internet. Your router uses NAT (Network Address Translation) to let many private devices share one public IP.

Classful Addressing (Legacy, but Still on Exams)

• 0.x.x.x is reserved and 127.x.x.x is loopback, which is why Class A stops at 126.
• Modern networks use CIDR (Classless Inter-Domain Routing, e.g. 10.20.30.0/22) instead of fixed classes. Classes are mostly a teaching tool today.

Network Protocols

A protocol is a set of rules that defines how data is formatted, sent, received, and understood.

TCP vs UDP

The TCP Three-Way Handshake

Client                                    Server
  |                                          |
  |------------- SYN (seq = x) ------------->|
  |<-------- SYN-ACK (seq = y, ack = x+1) ---|
  |------------- ACK (ack = y+1) ----------->|
  |                                          |
  |========== connection established =========|

Figure 5: A port scanner like Nmap abuses exactly this. A half-open "SYN scan" sends the SYN, reads the reply, and never completes the handshake.

HTTP vs HTTPS

Plain FTP and Telnet send credentials in cleartext. In practice use SFTP/FTPS and SSH instead.

OSI Model vs TCP/IP Model

Both are reference models that explain how data moves across a network. OSI is the theoretical one (7 layers). TCP/IP is the practical one the Internet actually runs on (4 layers).

      OSI Model (7 layers)             TCP/IP Model (4 layers)
+---------------------------+      +---------------------------+
| 7. Application            |      |                           |
+---------------------------+      |                           |
| 6. Presentation           |      | 4. Application            |
+---------------------------+      |    HTTP, HTTPS, FTP, DNS  |
| 5. Session                |      |                           |
+---------------------------+      +---------------------------+
| 4. Transport              |      | 3. Transport  (TCP, UDP)  |
+---------------------------+      +---------------------------+
| 3. Network                |      | 2. Internet   (IP, ICMP)  |
+---------------------------+      +---------------------------+
| 2. Data Link              |      |                           |
+---------------------------+      | 1. Network Access         |
| 1. Physical               |      |    Ethernet, Wi-Fi        |
+---------------------------+      +---------------------------+

Figure 6: OSI layers 5 to 7 collapse into TCP/IP's Application layer, and layers 1 to 2 collapse into Network Access.

OSI Layer Details

Mnemonic (top → bottom): All People Seem To Need Data Processing. Mnemonic (bottom → top): Please Do Not Throw Sausage Pizza Away.

TCP/IP Layer Details

Key Differences

When someone says "that's a Layer 2 problem" or "that's a Layer 7 attack", they are using OSI vocabulary even though the network runs TCP/IP.

Routing vs Switching

Both move data across a network, but at different layers and with different addresses.

Routing protocols in one line each:

• RIP: distance-vector, hop-count metric, simple but slow to converge. Mostly legacy.
• OSPF: link-state, fast convergence, the common interior protocol inside an organization.
• BGP: path-vector, the protocol that glues different organizations (Autonomous Systems) together. The Internet runs on it.

Switching technologies:

• VLAN: logically splits one physical switch into multiple isolated networks.
• STP (Spanning Tree Protocol): prevents Layer 2 loops that would cause broadcast storms.

Network Security Basics

Network security protects data and devices from unauthorized access and attacks. No single tool does it all, which is why we layer them (defense in depth).

 Internet --> [ Firewall ] --> [ IDS/IPS ] --> [ Internal Network ]
                  |                 |                  ^
           blocks unwanted    detects / stops          |
              traffic            attacks               |
                                                       |
 Remote user ===== VPN (encrypted tunnel) =============+

Figure 7: Layered defenses. Firewall filters, IDS/IPS inspects, and VPN protects remote access.

Types of Firewalls

IDS vs IPS

Bandwidth, Throughput, and Latency

Bandwidth is the maximum amount of data a link can carry per unit of time. It is measured in bits per second (bps), commonly Kbps, Mbps, Gbps.

Dial-up    |#                      |   56 Kbps
Broadband  |#########              |   10 Mbps   (example tier)
Fiber      |#######################|    1 Gbps
            (illustrative, not to scale)

Figure 8: Higher bandwidth means more data per second, not necessarily lower delay.

Bits vs bytes: 1 byte = 8 bits. Internet plans are sold in Mbps (bits), file sizes are shown in MB (bytes). A 100 Mbps connection tops out around 12.5 MB/s in theory, and real throughput is lower because of protocol overhead and congestion.

Internet Services

The Internet is a global network of networks that connects billions of devices and offers many services on top of the same protocols.

Essential Network Commands

These are the first tools to reach for when troubleshooting, and the first thing a SOC analyst runs on a suspicious host.

# Is the host alive? (Linux: send 4 packets)
ping -c 4 8.8.8.8

# What path does my traffic take?
traceroute example.com        # Windows: tracert example.com

# Which ports are listening, and which process owns them?
ss -tulnp                     # Windows: netstat -ano

# Resolve a domain's A record
dig example.com A +short      # or: nslookup example.com

# Who is on my local network segment?
arp -a

Why This Matters for a SOC Analyst

Networking is not a separate subject from security. It is the evidence you investigate.

Common Misconceptions

Details that are easy to get wrong when memorizing slides:

1. "Private IPs are only 192.168.x.x." No. There are three private ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.
2. "Public IPs are everything from 1.0.0.0 to 223.255.255.255." Not quite. Private, loopback, link-local, and other reserved blocks live inside that span, and 224+ is multicast/reserved.
3. "Loopback is just 127.0.0.1." The whole 127.0.0.0/8 block is loopback. 127.0.0.1 is simply the one everyone uses.
4. "A hub and a switch both connect devices, so they're the same." A hub repeats to all ports. A switch forwards only to the right port.
5. "Antivirus is a network security device." It is endpoint protection. Network controls are firewalls, IDS/IPS, segmentation, and so on.
6. "VPN is a type of network like LAN or WAN." It is a tunnel/overlay that runs over another network.
7. "Higher bandwidth means lower latency." No. Bandwidth is capacity, latency is delay. A satellite link can have high bandwidth and high latency.
8. "A failed ping means the host is down." Many hosts and firewalls simply drop ICMP.
9. "Classes A/B/C are how IPs are assigned today." Real networks use CIDR. Classes are mostly historical.
10. "ifconfig and tracert work everywhere." ifconfig is legacy on modern Linux (use ip), and tracert is the Windows name (traceroute elsewhere).

Quick Revision Checklist

Before moving on, make sure you can:

• Explain PAN, LAN, MAN, and WAN with one real example each.
• Say which OSI layer a hub, switch, and router work at, and why that matters.
• Draw the five topologies and name the weakness of each.
• List the three private IPv4 ranges from memory.
• Explain the TCP three-way handshake and why UDP skips it.
• Recite the 7 OSI layers and map them onto the 4 TCP/IP layers.
• Distinguish routing from switching (layer, address, device, protocol).
• Explain the difference between a stateless firewall, a stateful firewall, and an NGFW.
• Explain IDS vs IPS and where each sits in the network.
• Convert Mbps to MB/s and explain bandwidth vs throughput vs latency.
• Use ping, traceroute, ss/netstat, dig/nslookup, arp, and ip route and interpret the output.

Conclusion

Computer networks let devices and people communicate, share resources, and reach information. They work because many small pieces cooperate: devices that move data, topologies that arrange them, addresses that identify them, protocols that define the rules, and security controls that keep it all trustworthy.

For anyone heading toward a SOC or security engineering role, this is the foundation everything else is built on. Packet captures, firewall rules, SIEM correlation, and incident timelines all assume you can picture what is happening on the wire.

Always connected. Always learning. Always coding. 🙂

If you spot a mistake or have a better way to explain something, please reach out. Corrections make these notes better for everyone.