Post cover image
Networking Fundamental

November 2, 2026

04 Networking Fundamentals for Ethical Hackers

1. The OSI Model in Practice

By CyberExplorer

9 min read

1. The OSI Model in Practice

The Open Systems Interconnection (OSI) model splits network communication into seven layers to decouple software development, transmission mechanics, and hardware implementations.

None 
+-------------------------------------------------------------------------+
| Layer 7: Application   - User data, HTTP payload, API requests          |
| Layer 6: Presentation  - TLS encryption/decryption, JSON, ASCII, gzip   |
| Layer 5: Session       - Sockets, RPC sessions, connection lifecycle    |
| Layer 4: Transport     - TCP (reliability, ports), UDP (speed)          |
| Layer 3: Network       - IP addressing, routing tables, ICMP            |
| Layer 2: Data Link     - MAC addresses, Ethernet frames, switches       |
| Layer 1: Physical      - Voltage levels, radio frequencies, cables      |
+-------------------------------------------------------------------------+

Layer-by-Layer Breakdown

  • Layer 7 (Application): Directly interacts with client software. It exposes protocols like HTTP, SSH, DNS, and SMTP.
  • Layer 6 (Presentation): Standardizes data representation between disparate operating systems. It handles compression (e.g., gzip/brotli) and cryptographic transformations (e.g., TLS encryption and decryption).
  • Layer 5 (Session): Establishes, manages, and terminates long-lived conversational exchanges between local and remote applications.
  • Layer 4 (Transport): Provides logical communication between application processes. It handles multiplexing via ports, segments large payloads, enforces flow control, and establishes reliability mechanisms.
  • Layer 3 (Network): Handles logical host addressing across disparate networks using IP addresses and calculates packet delivery paths using routing protocols (OSPF, BGP).
  • Layer 2 (Data Link): Facilitates direct hop-to-hop frame transfers within the same physical network segment using hardware-burned Media
  • Access Control (MAC) addresses. It is divided into:
  • Logical Link Control (LLC): Manages synchronization and flow control.
  • Media Access Control (MAC): Governs physical wire access via CSMA/CD or CSMA/CA.
  • Layer 1 (Physical): Converts data frames into raw electrical pulses, light wavelengths, or radio signals across physical mediums (twisted pair copper Cat6, fiber optic, 802.11 RF).

Systematic Troubleshooting Workflow

When tracking down an outage, work sequentially up the stack:

  1. Layer 1 Check: Verify physical link lights. Run ip link show to ensure the interface state is not DOWN. Check physical or virtual cable connections.
  2. Layer 2 Check: Verify local link neighbors using ip neigh or arp -a. Check whether the default gateway's MAC address is resolved. If the ARP table shows INCOMPLETE, the local link or VLAN configuration is misconfigured.
  3. Layer 3 Check: Inspect host IP configuration (ip a) and routing tables (ip route). Verify end-to-end reachability via ping <gateway_ip> and ping 8.8.8.8.
  4. Layer 4 Check: Confirm destination port availability using nc -zv <target_ip> <port> or test local listening daemons using ss -tulpn. If ICMP pings succeed but TCP handshakes timeout, suspect stateful firewall rules or closed ports.
  5. Layer 7 Check: Test application-layer responses directly using curl -Iv https://<target> to check HTTP status headers, TLS certificate validity, and DNS resolution failures.

2. TCP/IP Architecture & Encapsulation

The TCP/IP stack consolidates network architecture into four practical operational layers:

[ Application Data (HTTP GET) ]
              │
              ▼  Encapsulate with TCP Header (Source/Dest Ports, Seq/Ack)
[ TCP Header | HTTP Data ]  ===> TCP Segment (Layer 4)
              │
              ▼  Encapsulate with IP Header (Source/Dest IPs, TTL)
[ IP Header | TCP Header | HTTP Data ]  ===> IP Packet (Layer 3)
              │
              ▼  Encapsulate with Ethernet Frame (Source/Dest MACs, EtherType, CRC)
[ Eth Header | IP Header | TCP Header | HTTP Data | FCS/Trailer ]  ===> Ethernet Frame (Layer 2)

Step-by-Step Encapsulation of an HTTP Request

None

Application Layer: A browser generates a plaintext request:

GET /index.html HTTP/1.1\r\nHost: example.com\r\n\r\n.

Transport Layer:

  • Wraps the payload in a TCP Segment Header (20 bytes un-optioned).
  • Appends an ephemeral client source port (e.g., 51234) and well-known destination port 80.
  • Assigns an Initial Sequence Number (ISN) and sets a TCP window size for flow control.

Internet Layer:

  • Wraps the TCP segment in an IPv4 Packet Header (20 bytes un-optioned).
  • Sets Source IP (192.168.1.50), Destination IP (93.184.216.34), Protocol number 0x06 (TCP), and Time-to-Live (TTL=64).

Link Layer:

  • Wraps the packet in an Ethernet II Frame.
  • Appends the local host's source MAC (00:1A:2B:3C:4D:5E), the local gateway router's destination MAC (00:11:22:33:44:55), and an EtherType field of 0x0800 (IPv4).
  • Appends a 4-byte Frame Check Sequence (FCS/CRC-32) at the end for hardware error detection.

3. IPv4 Addressing & CIDR Subnetting

An IPv4 address consists of 32 binary bits divided into four 8-bit octets:

11000000 . 10101000 . 00000001 . 00000001 ← →192.168.1.1

None

Reserved RFC 1918 Private Ranges

Private address blocks are filtered by internet backbone routers and cannot be routed across the public internet:

  • Class A Block:
  • 10.0.0.0/8 (10.0.0.0 to 10.255.255.255) ← → 16,777,216 total addresses.
  • Class B Block:
  • 172.16.0.0/12 (172.16.0.0 to 172.31.255.255) ← →1,048,576 total addresses.
  • Class C Block:
  • 192.168.0.0/16 (192.168.0.0 to 192.168.255.255)← →65,536 total addresses.

Specialized Address Spaces

  • Loopback: 127.0.0.0/8 (typically 127.0.0.1 / localhost). Packets never hit a physical network adapter.
  • APIPA (Automatic Private IP Addressing / Link-Local): 169.254.0.0/16. Auto-assigned by operating systems when a DHCP client gets no response.
  • Multicast: 224.0.0.0/4 (Class D).
  • Broadcast: 255.255.255.255 (Limited broadcast to the local physical wire).

Subnetting Mechanics

A subnet mask defines where the network prefix ends and host identifiers begin.

Formulas:

None 
Detailed Example: Given 172.16.10.68/26
1. Subnet Mask:
   Prefix /26 = 26 ones, 6 zeroes:
   11111111.11111111.11111111.11000000 = 255.255.255.192
2. Address Counts:
   Host bits (H) = 32 - 26 = 6
   Total Addresses = 2^6 = 64
   Usable Hosts = 64 - 2 = 62
3. Block Size (Magic Number):
   256 - 192 = 64
   Subnet increments occur in blocks of 64 in the 4th octet:
   Subnet 0: .0 to .63
   Subnet 1: .64 to .127  <-- 172.16.10.68 falls here
   Subnet 2: .128 to .191
4. Subnet Boundaries for 172.16.10.68/26:
   * Network ID:          172.16.10.64   (Host bits all 0)
   * First Usable Host:   172.16.10.65
   * Last Usable Host:    172.16.10.126
   * Broadcast Address:   172.16.10.127  (Host bits all 1)

4. Transport Protocols: TCP vs. UDP

None

5. TCP State Machine, Flags, and Handshakes

Header Flags

  • SYN (Synchronize): Initial connection request; synchronizes initial sequence numbers (ISNs).
  • ACK (Acknowledgment): Confirms receipt of previously transmitted segments.
  • FIN (Finish): Gracefully indicates that the sender has finished sending data.
  • RST (Reset): Abruptly tears down an invalid connection or rejects an incoming segment.
  • PSH (Push): Instructs receiver to pass buffered data to the application layer immediately.
  • URG (Urgent): Informs receiver that data within the segment is high priority.

3-Way Handshake (Connection Establishment)

Client (Port 50123)                                    Server (Port 443)
        │                                                      │
        │ ─── 1. [SYN] Seq=1000 ─────────────────────────────> │  (Server moves to SYN-RECEIVED)
        │                                                      │
        │ <── 2. [SYN, ACK] Seq=5000, Ack=1001 ─────────────── │  (Client moves to ESTABLISHED)
        │                                                      │
        │ ─── 3. [ACK] Seq=1001, Ack=5001 ───────────────────> │  (Server moves to ESTABLISHED)
        ▼                                                      ▼

4-Way Handshake (Graceful Teardown)

Endpoint A                                             Endpoint B
        │                                                      │
        │ ─── 1. [FIN, ACK] Seq=1500, Ack=6000 ──────────────> │  (B enters CLOSE-WAIT)
        │                                                      │
        │ <── 2. [ACK] Ack=1501 ────────────────────────────── │  (A enters FIN-WAIT-2)
        │                                                      │
        │ <── 3. [FIN, ACK] Seq=6000, Ack=1501 ─────────────── │  (B finishes lingering tasks)
        │                                                      │
        │ ─── 4. [ACK] Ack=6001 ──────────────────────────────> │  (A enters TIME-WAIT for 2*MSL)
        ▼                                                      ▼  (B enters CLOSED)

6. Core Application Protocols & Infrastructure Services

DNS Resolution Architecture

When resolving a domain (e.g., api.example.com):

Client  ──(1) Query: api.example.com──>  Recursive Resolver (e.g., 8.8.8.8)
                                                │
                                                ├──(2) Where is .com? ──> Root DNS Server (.)
                                                │<──(3) Refer to TLD ───
                                                │
                                                ├──(4) Where is example.com? ──> TLD Server (.com)
                                                │<──(5) Refer to Auth NS ───────
                                                │
                                                ├──(6) What is api.example.com? ──> Authoritative Nameserver
                                                │<──(7) 93.184.216.34 (A Record) ──
                                                ▼
Client  <──(8) Return IP: 93.184.216.34 ───────

DHCP DORA Workflow

Used by endpoints to automatically lease IP addresses on local networks:

  • Discover (Client →Network): UDP broadcast (0.0.0.0:68 --> 255.255.255.255:67) requesting an IP lease.
  • Offer (Server →Client): DHCP server offers an unassigned IP, subnet mask, default gateway, and DNS servers.
  • Request (Client →Server): Client formally accepts the offered IP via another broadcast.
  • Acknowledge (Server →Client): Server confirms the reservation and starts the lease timer.

7. HTTP/1.1 vs HTTP/2 vs HTTP/3 & TLS Architecture

HTTP Version Evolution

  • HTTP/1.1: Plaintext. Persistent TCP connections (Keep-Alive), but suffers from Head-of-Line (HoL) blocking: only one request can be processed per TCP connection at a time.
  • HTTP/2: Binary framing protocol. Enables multiplexing (concurrent bidirectional streams over a single TCP connection) and HPACK header compression. However, packet loss on the underlying TCP stream still stalls all multiplexed streams.
  • HTTP/3: Replaces TCP with QUIC (a UDP-based transport layer protocol). Eliminates transport-layer Head-of-Line blocking, integrates the TLS 1.3 handshake directly into connection setup, and enables connection migration across network changes (e.g., Wi-Fi to cellular).

TLS 1.3 Cryptographic Handshake

Client                                                 Server
  │                                                      │
  │ ─── ClientHello (Supported Ciphers, Client Random, ──>│
  │     Key Share [Client Public Diffie-Hellman Key])     │
  │                                                      │
  │ <── ServerHello (Chosen Cipher, Server Key Share) ── │
  │     {EncryptedExtensions}                            │
  │     {Certificate} (X.509 Server Certificate)         │
  │     {CertificateVerify} (Signature from Private Key) │
  │     {Finished}                                       │
  │                                                      │
  │ ─── {Finished} ─────────────────────────────────────>│
  ▼                                                      ▼
  [ Symmetric Encryption Active: AES-GCM or ChaCha20-Poly1305 ]

8. Network Hardware, NAT, and Edge Routing

Hardware Distinction

  • Switch (Layer 2): Inspects incoming Ethernet frame headers. Uses an internal MAC Address Table (CAM Table) to selectively forward frames only to the physical port tied to the destination hardware address, eliminating collision domains.
  • Router (Layer 3): Evaluates incoming IP packet headers. Consults an internal Routing Table (containing network prefixes, metrics, and next-hop interfaces) to forward packets across different subnets and network boundaries.

Network Address Translation (NAT / NAPT / PAT)

Port Address Translation (PAT) allows thousands of internal hosts with private RFC 1918 addresses to share a single public IP:

[ Internal Host ]                                            [ NAT Gateway / Router ]                                       [ Public Web Server ]
192.168.1.50:41234                                            Public IP: 203.0.113.1                                         93.184.216.34:443
        │                                                                │                                                            │
        │ ── IP: 192.168.1.50:41234 -> 93.184.216.34:443 ──────────────> │                                                            │
        │                                                                │ [NAT Table Lookup & Rewrite]                               │
        │                                                                │ Rewrites Source IP:Port to 203.0.113.1:58001               │
        │                                                                │ ── IP: 203.0.113.1:58001 -> 93.184.216.34:443 ───────────> │
        │                                                                │                                                            │
        │                                                                │ <── IP: 93.184.216.34:443 -> 203.0.113.1:58001 ─────────── │
        │                                                                │ [Reverse NAT Lookup]                                       │
        │                                                                │ Rewrites Dest IP:Port to 192.168.1.50:41234                │
        │ <── IP: 93.184.216.34:443 -> 192.168.1.50:41234 ──────────────│                                                            │
        ▼                                                                ▼                                                            ▼

9. Diagnostics: ARP, ICMP, and Traceroute

ARP (Address Resolution Protocol)

None

Maps Layer 3 logical IP addresses to Layer 2 physical MAC addresses within a broadcast domain:

  1. Host 192.168.1.10 wants to talk to 192.168.1.20. It broadcasts: "Who has 192.168.1.20? Tell 192.168.1.10" (Sent to FF:FF:FF:FF:FF:FF).
  2. Target host 192.168.1.20 unicasts back: "192.168.1.20 is at 00:0c:29:ab:cd:ef".
  3. The sender caches this in its ARP table (ip neigh show).

ICMP (Internet Control Message Protocol)

None

Operates at Layer 3 to send operational status and diagnostic feedback:

  • Type 8 / Code 0: Echo Request (ping outbound).
  • Type 0 / Code 0: Echo Reply (ping response).
  • Type 3: Destination Unreachable (e.g., Code 1 = Host Unreachable, Code 3 = Port Unreachable).
  • Type 11 / Code 0: Time Exceeded (TTL hit zero during transit).

Traceroute Internal Mechanics

traceroute maps every intermediate router hop by deliberately exhausting packet TTL values:

  1. Sends a packet with TTL=1. The first router decrements TTL to 0, drops the packet, and returns an ICMP Type 11 (Time-to-Live Exceeded) message. Traceroute records Hop 1's IP address and latency.
  2. Sends the next packet with TTL=2. It survives the first router, but drops at the second router, which returns an ICMP Time Exceeded message (Hop 2 recorded).
  3. The process repeats, incrementing the TTL by 1 each time until the destination IP returns an ICMP Echo Reply or ICMP Port Unreachable, ending the trace.

10. IPv6 Architecture Fundamentals

None

IPv6 addresses the address exhaustion of IPv4 by expanding address space from 32 bits to 128 bits, formatted as 8 hexadecimal blocks of 16 bits separated by colons:

→ 2001:0db8:85a3:0000:0000:8a2e:0370:7334

Address Compression Rules

Omit Leading Zeroes: Any leading zero within a 16-bit block can be omitted (0042 — >42, 0000 — >0).

Double Colon (::) Substitution: A single contiguous sequence of all-zero fields can be replaced with :: once per address.

2001:0db8:0000:0000:0000:0000:0000:0001 → 2001:db8::1

Key Scopes & Protocols

  • Global Unicast (2000::/3): Publicly routable, globally unique addresses across the IPv6 internet.
  • Link-Local (fe80::/10): Automatically assigned to every IPv6-enabled interface; valid only for communication within the local Layer 2 broadcast domain.
  • Loopback (::1): Equivalent to IPv4's 127.0.0.1.
  • Elimination of Broadcast: IPv6 eliminates traditional broadcast addresses; it relies on multicast addressing groups and anycast routing.
  • Neighbor Discovery Protocol (NDP): Replaces IPv4's ARP and DHCP using specialized ICMPv6 messages:
  • Neighbor Solicitation (NS) and Neighbor Advertisement (NA) resolve MAC addresses.
  • Router Solicitation (RS) and Router Advertisement (RA) allow devices to configure their own IPs without a DHCP server (SLAAC — Stateless Address Autoconfiguration).