Module 1: The Architectural Blueprint (OSI & TCP/IP)
To a cybersecurity professional, the OSI model isn't just a chart; it’s a map of the attack surface.
The 7-Layer OSI Model
Layer Name
Function
Protocol Examples
Human-Computer
HTTP, DNS, FTP,
Interaction
SMTP
Security Focus
7
Application
6
Presentation Encryption & Formatting
5
Session
Managing Connections
NetBIOS, RPC
Session Hijacking
4
Transport
End-to-End Delivery
TCP, UDP
Port Scanning, Syn Floods
3
Network
Path Determination (IP)
IP, ICMP, IPsec
IP Spoofing, Routing loops
2
Data Link
1
Physical
Physical Addressing
(MAC)
Bits and Cables
SSL/TLS, JPEG,
ASCII
Ethernet, ARP, PPP
Fiber, Coax, Hubs
SQLi, XSS, API security
Encryption flaws
ARP Poisoning, MAC
Spoofing
Wiretapping, Jamming
The TCP/IP Suite
While OSI is theoretical, TCP/IP is the practical implementation. It condenses the model into four
layers: Network Access, Internet, Transport, and Application.
Module 2: The Logic of Addressing & Subnetting
In networking, if you can't manage your IP space, you can't secure it.
IPv4 vs. IPv6
IPv4: 32-bit addresses (e.g., 192.168.1.1). Limited to approximately 4.3 billion addresses.
IPv6: 128-bit addresses (e.g., 2001:0db8:85a3:0000:0000:8a2e:0370:7334). Designed to
provide an almost infinite address space.
Subnetting Math
Subnetting is the process of dividing a large network into smaller, manageable sub-networks. This
is crucial for Network Segmentation—ensuring that if a hacker breaches your "Guest Wi-Fi,"
they can't jump over to your "Database Server."
The number of usable hosts in a subnet is calculated using:
$$2^n - 2$$
(Where $n$ is the number of host bits. We subtract 2 for the Network ID and the Broadcast
Address.)
Module 3: The Transport Layer (TCP vs. UDP)
This is where the "reliability" of the internet happens.
TCP (Transmission Control Protocol)
TCP is connection-oriented. It uses the Three-Way Handshake, which is a primary target for
attackers (e.g., SYN Flood attacks):
1. SYN: Client sends a synchronization packet.
2. SYN-ACK: Server acknowledges and sends its own synchronization.
3. ACK: Client acknowledges the server.
UDP (User Datagram Protocol)
UDP is connectionless. It’s faster but "unreliable" (no error checking). It is used for streaming,
gaming, and DNS. Because there is no handshake, UDP is often used in Amplification DDoS
attacks.
Module 4: Core Network Services (DNS & DHCP)
DNS (Domain Name System)
The "Phonebook of the Internet." It translates google.com into 142.250.190.46.
Security Risk: DNS Poisoning (redirecting users to a fake site) and DNS Tunneling
(exfiltrating data through DNS queries).
DHCP (Dynamic Host Configuration Protocol)
Automatically assigns IP addresses to devices on a network.
Security Risk: DHCP Starvation (an attacker exhausts all available IPs) and Rogue DHCP
servers (giving clients a malicious Gateway IP).
Module 5: Routing & Switching
Switching (Layer 2): Uses MAC addresses to send data to the correct device on a local
network.
Routing (Layer 3): Uses IP addresses to send data between different networks.
VLANs (Virtual LANs): Logically separating a physical switch into multiple virtual ones
to keep departments isolated.
Module 6: Networking for Ethical Hacking
Since you are focusing on cybersecurity, networking isn't just about connectivity; it's about
Visibility.
1. Packet Analysis: Using tools like Wireshark to inspect the "raw" data moving across the
wire.
2. Nmap (Network Mapper): The industry standard for discovering what devices are on a
network and what ports are open.
3. Firewalls/IDS/IPS:
Firewall: Blocks/Allows traffic based on rules.
IDS (Intrusion Detection System): Watches and alerts.
IPS (Intrusion Prevention System): Watches and actively blocks threats.
How do you want to proceed?
Since 10,000 words is a massive project, we should tackle this in stages. Which of these areas do
you want to expand into "Chapter 1" right now?
Option A: A deep dive into Subnetting and VLSM math?
Option B: A technical breakdown of Common Network Attacks (ARP Poisoning, MITM,
DDoS)?
Option C: How to use Wireshark to analyze real network traffic?
0
