Module 2: Networking fundamentals

Estimated time: 4-5 hours (including the lab) · Prerequisites: M1

Almost every attack you'll ever investigate travelled over a network. Phishing arrives by email, malware "phones home" to a command server, and data is stolen out through the same cables and Wi-Fi that carry your Netflix. If you can read what's happening on a network, you can see attacks happening, which is most of what a SOC analyst does all day.

Supports Security+ SY0-701 domains: 3.0 Security Architecture (and parts of 4.0 Security Operations).

What you'll get from this module

Explain how data moves between computers using the postal-system model.
Read an IP address and tell a private one from a public one.
Use the TCP/IP layer model as a practical map (and recognise the OSI model).
Compare TCP and UDP and know when each is used.
Recognise the common ports every analyst memorises.
Explain DNS and HTTPS/TLS, and how attackers abuse both.
Describe a home vs enterprise network and what attack surface means.

1. The network as a postal system

Networking has a lot of jargon, but the underlying idea is old: it's the post.

Postal system	Network equivalent
A letter	A packet of data
The street address	The IP address (which machine)
The apartment number	The port (which program on that machine)
The envelope	Packet headers (addressing info wrapped around your data)
The postal service routing your letter city to city	Routers passing packets network to network
The address book that turns a name into an address	DNS

Every concept in this module maps onto that table. When you get lost, come back to it.

2. IP addresses

Every device on a network has an IP address so packets can find it.

IPv4 looks like 192.168.1.10: four numbers, each 0-255. There are only ~4.3 billion possible IPv4 addresses, which is why we ran out.
IPv6 looks like 2001:db8::8a2e:370:7334: vastly more addresses, written in hex (M1's hex pays off already). You'll see it more each year, but IPv4 still dominates day-to-day analysis.

Private vs public is the distinction you'll use constantly:

Range	Type	Meaning
`10.0.0.0 - 10.255.255.255`	Private	Internal networks only
`172.16.0.0 - 172.31.255.255`	Private	Internal networks only
`192.168.0.0 - 192.168.255.255`	Private	Internal (your home router uses this)
Everything else (mostly)	Public	Reachable on the open internet

Private addresses are not routable on the internet: billions of homes all use 192.168.1.x at the same time without clashing. When an analyst sees a private IP in a log, they're looking at something inside the organisation; a public IP is the outside world.

NAT (Network Address Translation), in one breath: your router shares its single public IP among all your private devices, rewriting addresses as traffic passes through, like a receptionist forwarding mail for everyone in the building. That's why your whole house appears to the internet as one address.

3. Layers: the TCP/IP model (and OSI)

Networks are built in layers, each doing one job and handing off to the next. The practical, four-layer TCP/IP model:

Layer	Job	Examples	Postal analogy
Application	What the data means	HTTP, DNS, SMTP	The letter's contents
Transport	Getting it to the right program, reliably or fast	TCP, UDP (ports live here)	The apartment number
Internet	Getting it to the right machine across networks	IP, routers	The street address & routing
Link	Moving bits over the physical medium	Ethernet, Wi-Fi	The van and the road

You'll also hear about the OSI model, a seven-layer version of the same idea (Physical, Data Link, Network, Transport, Session, Presentation, Application). It appears in exams and in phrases like "a layer 7 attack" (application layer) or "layer 3" (network/IP). Learn TCP/IP as your working map; recognise OSI vocabulary when you hear it.

4. TCP vs UDP

The transport layer offers two delivery services:

TCP (Transmission Control Protocol): registered post. Establishes a connection first (the "three-way handshake": SYN → SYN-ACK → ACK), numbers every segment, confirms delivery, retransmits anything lost. Used where correctness matters: web pages, email, file transfers.
UDP (User Datagram Protocol): a postcard. Fire and forget: no handshake, no confirmation, much less overhead. Used where speed beats perfection: DNS lookups, video calls, game traffic.

The TCP three-way handshake in order: SYN, then SYN-ACK, then ACK, the same three steps described above.

Why security cares: the TCP handshake is visible in logs, so analysts can tell completed connections from mere attempts, a machine spraying thousands of SYNs that never complete is a classic sign of port scanning.

5. Ports and common services

A port is a number (0-65535) identifying which program on a machine should receive the traffic. Well-known services sit on well-known ports, and SOC analysts recognise these on sight:

Port	Service	What it is
22	SSH	Secure remote command line (mostly Linux servers)
25	SMTP	Sending email between mail servers
53	DNS	Name lookups (usually UDP)
80	HTTP	Web traffic, unencrypted
443	HTTPS	Web traffic, encrypted with TLS
3389	RDP	Remote Desktop into Windows machines

Two of these deserve a red flag in your memory now: RDP (3389) exposed to the internet is one of the most common ways ransomware gangs break into Australian businesses, and SSH (22) is endlessly guessed at by automated attacks. "What ports does this machine expose?" is one of the first questions in any investigation.

6. DNS: the internet's address book

You type www.example.com; packets need an IP. DNS (Domain Name System) does the translation:

Your machine asks its configured DNS resolver (usually your router or ISP): "what's the IP for www.example.com?"
If the resolver doesn't know, it asks up the chain: root servers → the .com servers → the servers responsible for example.com.
The answer comes back and is cached so the next lookup is instant.

Why attackers love DNS:

Phishing lookalikes: registering examp1e.com and hoping you don't notice.
Command-and-control: malware asks DNS for its controller's current address, so the attacker can move servers without updating the malware.
DNS tunnelling: smuggling stolen data out inside DNS queries, because almost every network allows DNS traffic out.

Because nearly everything starts with a lookup, DNS logs are one of the richest data sources a SOC has. You'll query them in M8.

7. HTTP vs HTTPS (and TLS in one paragraph)

HTTP sends web traffic as plain text. Anyone positioned on the path (dodgy Wi-Fi, a compromised router) can read or alter it. HTTPS is HTTP wrapped in TLS (Transport Layer Security), which does two things: it encrypts the traffic, and it proves identity using a certificate, a digitally signed statement that the server really is www.example.com, vouched for by a certificate authority your browser already trusts. The padlock in your browser means "encrypted and identity-checked"; it does not mean the site is honest. Phishing sites use HTTPS too. Deeper crypto arrives in M4.

8. Home vs enterprise networks

Your home network is a miniature of what you'll defend professionally:

Home: one box (the "router") is actually router + switch + Wi-Fi access point + basic firewall + DNS forwarder in one. Everything sits on a single flat network.
Enterprise: the same functions as separate, serious components: dedicated routers, switches connecting devices, controlled Wi-Fi with authentication, and firewalls enforcing rules about what traffic may pass. Crucially, enterprise networks are segmented: finance, servers, and guest Wi-Fi live on separate zones so a compromise in one can't roam freely. Segmentation is defence in depth (M4) applied to networks.

Attack surface = every point where an attacker could try to get in or interact: every open port, exposed service, Wi-Fi network, VPN endpoint, and internet-facing application. Defenders work to shrink it (close unused ports, remove unneeded services) and watch what remains. When you hear "reduce the attack surface", picture closing and locking doors on a building.

📺 Curated resources (free)

Professor Messer: CompTIA Network+ (N10-009) course, the full free video course: professormesser.com N10-009 training course. You do not need all ~13 hours now; the Networking Concepts section alone reinforces everything above.
Cloudflare Learning Center: clear, free explainers on DNS, TLS/SSL, DDoS and more: cloudflare.com/learning. Excellent for a second explanation of anything in this module.

🧪 Lab 2: Explore your own network (no installs)

Everything here uses tools already on your machine, examines your own network, and is completely legal and safe. (Rule for the whole course: only ever probe systems you own or have written permission to test.)

Open a terminal: PowerShell on Windows, Terminal on macOS/Linux (or your M1 VM).

Find your own address.
- Windows: ipconfig
- Linux: ip addr
- macOS: ifconfig (macOS has no ip command by default)
Find your IPv4 address. Is it in one of the private ranges from section 2? Note the default gateway, that's your router.
Test reachability. ping 1.1.1.1: you're sending packets to Cloudflare's public DNS resolver and timing the round trip. Then ping your gateway address and compare times: local beats internet.
Do a DNS lookup yourself. nslookup www.cyber.gov.au: you'll see which resolver answered and the IP(s) returned. Try another domain and notice repeat lookups are faster (caching).
Trace the route.
- Windows: tracert www.google.com
- macOS/Linux: traceroute www.google.com
Each line is a router your packets pass through: your gateway first, then your ISP, then the wider internet. Some hops show * (they decline to answer); that's normal.
(Optional) Inspect a real certificate. In your browser, visit any HTTPS site, click the padlock/site-info icon → view certificate. Find: who it was issued to, who issued it (the certificate authority), and its expiry date. You've just done manually what your browser does on every page load.

Lab success = you identified your private IP and gateway, resolved a domain with nslookup, and read a traceroute.

Self-check

Answer before you reveal: the attempt is what makes it stick. Your score and card ratings are saved on this device only.

The port numbers are pure memorisation: analysts recognise them on sight, and this short deck makes that automatic.

Flashcards · spaced repetition

Ports: instant recall

Say your answer out loud (or in your head) before revealing. Recall is the workout. "Knew it" pushes a card's next review further out; "Review again" brings it back today.

Card 1 of 6

Prompt

Port 22

The concepts deserve their own deck: these are the ideas interviewers probe, so rate yourself honestly and they come back on a spaced schedule.

Flashcards · spaced repetition

Networking concepts

Say your answer out loud (or in your head) before revealing. Recall is the workout. "Knew it" pushes a card's next review further out; "Review again" brings it back today.

Card 1 of 9

Prompt

In the postal model: the letter, the street address and the apartment number are…?

Next module

➡️ M3: Operating systems & the command line, driving Linux and Windows from the keyboard, and finding the logs SOC analysts live in.

What you'll get from this module​

1. The network as a postal system​

2. IP addresses​

3. Layers: the TCP/IP model (and OSI)​

4. TCP vs UDP​

5. Ports and common services​

6. DNS: the internet's address book​

7. HTTP vs HTTPS (and TLS in one paragraph)​

8. Home vs enterprise networks​

📺 Curated resources (free)​

🧪 Lab 2: Explore your own network (no installs)​

Self-check​

Check your understanding