Day 6: How the Internet Actually Works — OSI Model, TCP/IP & Ports

Series: Ethical Hacking for Beginners | Day 6 Tags: #OSIModel #TCPIP #EthicalHacking #NetworkSecurity

Before you can hack a network — or defend one — you need to understand how it breathes. Today we cover the two frameworks every hacker lives by: the OSI Model and TCP/IP Suite.

Table of Contents

1. Why Networking = Foundation of Hacking
2. The OSI Model — What Is It Really?
3. All 7 OSI Layers Explained
4. Protocols at Each Layer
5. TCP/IP Suite — How the Internet Actually Works
6. Protocols & Ports — Doors Hackers Knock On
7. Cheat Sheets
8. Summary + What's Next

Why Networking Is the Foundation of Ethical Hacking

Imagine trying to break into a house without knowing what a door is. That's what pentesting looks like without networking knowledge. Every attack — SQL injection, man-in-the-middle, port scanning, DDoS etc— happens across a network.

• Run Nmap? You're talking to ports at Layer 4
• Use Wireshark? You're reading packets across all OSI layers
• Crack Wi-Fi? You're attacking Layer 2

Networking isn't theory. It's the map of the battlefield.

By end of Day 6, you will:

• Know all 7 OSI layers + their functions
• Know which protocols live at each layer
• Understand TCP/IP and how it maps to OSI
• Know the most critical ports attackers target
• Use Nmap and Wireshark for basic recon

The OSI Model

OSI = Open Systems Interconnection Developed by ISO in the late 1970s, published 1984 as ISO 7498. It's a blueprint that explains how data travels from one computer to another — broken into 7 layers, each with its own job. Data travels DOWN the layers on the sender, across the network, then UP the layers on the receiver.

Why Hackers Care About OSI

All 7 OSI Layers Explained

Layer 7 — Application Layer

The layer users actually interact with. Your browser, email client, WhatsApp — they use Application Layer protocols. The apps themselves are NOT part of this layer; it provides the protocols apps use.

Key functions:

• Identifies communication partners
• Checks resource availability
• Provides user-facing network services

Example: You type https://google.com → browser uses HTTPS (an L7 protocol) to request the page.

Hacker's View: Most common attack surface. XSS, CSRF, SQL injection, broken auth all live here. Layer 7 DDoS floods servers with fake-legitimate HTTP requests — hardest to block.

Layer 6 — Presentation Layer

The translator, encryptor, and compressor. It makes sure data from Layer 7 on one device can be understood by Layer 7 on another device — even if they use different formats.

Key functions:

• Translation — Converts formats (ASCII(American Standard Code for Information Interchange) ↔ EBCDIC(Extended Binary Coded Decimal Interchange Code), UTF-8(Unicode Transformation Format — 8-bit))
• Encryption/Decryption — TLS/SSL happens here
• Compression — Reduces data size before sending

Example: HTTPS visit → TLS handshake negotiates encryption at this layer.

Hacker's View: SSL stripping attacks target this layer — downgrade HTTPS to HTTP so traffic is readable in plaintext. Weak cipher suites = common pentest finding.

Layer 5 — Session Layer

The manager of conversations. It establishes, manages, and terminates sessions between devices.

Key functions:

• Opens, closes, and manages sessions
• Adds checkpoints (sync points) so transfers resume after failure
• Controls half-duplex / full-duplex modes

Example: Logging into a website — the Session Layer manages that ongoing conversation between your browser and server.

Hacker's View: Session hijacking (stealing a valid session token) exploits this layer. Burp Suite captures and replays session cookies here.

Layer 4 — Transport Layer

The delivery manager — reliable or fast, your choice. It is the heart of the OSI model. This is where TCP and UDP live.

Key functions:

• Segmentation & Reassembly — Breaks data into numbered segments
• Flow Control — Prevents fast sender from overwhelming slow receiver
• Error Control — Retransmits lost/corrupt segments
• Port Addressing — Port numbers let multiple apps share one connection

TCP vs UDP

TCP 3-Way Handshake (Memorize This!)

Client → Server:  SYN      (I want to connect)
Server → Client:  SYN-ACK  (OK, I acknowledge)
Client → Server:  ACK      (Let's go!)

Client → Server:  SYN      (I want to connect)
Server → Client:  SYN-ACK  (OK, I acknowledge)
Client → Server:  ACK      (Let's go!)

Hacker's View: SYN flood attacks send thousands of SYN packets without completing the handshake — exhausts server resources. Nmap port scanning works at this layer.

Layer 3 — Network Layer

The GPS of networking — routing and addressing. It handles logical addressing (IP) and determines the best path for data across multiple networks. Routers operate here.

Key functions:

• Logical Addressing — Assigns/reads IP addresses (IPv4/IPv6)
• Routing — Best path from source to destination
• Packet Forwarding — Moves packets router to router
• Fragmentation — Breaks large packets into smaller ones

Example: You're in Islamabad, server is in New York. Layer 3 routes your IP packet hop-by-hop through dozens of routers worldwide.

Hacker's View: IP spoofing, ICMP ping floods, BGP hijacking, traceroute-based recon all happen here.

Layer 2 — Data Link Layer

Node-to-node delivery on the same network segment. It uses MAC addresses (physical hardware addresses) instead of IP addresses. Only handles delivery within a single network segment.

Two Sublayers:

LLC (Logical Link Control) — Error detection, flow control, interfaces with Layer 3

MAC (Media Access Control) — Physical addressing, controls who can transmit

Key functions:

• Framing — Wraps packets into frames with MAC headers
• Physical Addressing — MAC addresses (e.g., AA:BB:CC:DD:EE:FF)
• Error Detection — CRC (Cyclic Redundancy Check)
• Access Control — Who can transmit on shared media (CSMA/CD(Carrier Sense Multiple Access / Collision Detection))

Hacker's View: ARP spoofing/poisoning, MAC flooding, and Wi-Fi deauthentication attacks all happen at Layer 2 — operating against 802.11 management frames. This is where MITM attacks begin.

Layer 1 — Physical Layer

The actual 0s and 1s traveling through wire, fiber, or air. It contains raw bits over physical media. Defines hardware: cables, connectors, voltages, frequencies, and signal timing.

Key functions:

• Transmits raw binary bits over physical medium
• Defines electrical, optical, and radio characteristics
• Bit synchronization and encoding

Physical media:

• Ethernet cable (Cat5/Cat6) — wired LAN
• Fiber optic — high speed, long distance
• Wi-Fi (2.4GHz / 5GHz) — wireless
• Coaxial cable — legacy/cable TV

Hacker's View: Wiretapping, rogue access points, hardware keyloggers, optical fiber tapping, Bluetooth sniffing. Physical access = game over.

OSI Memory Trick

Top to Bottom (Layer 7 → 1):

A_ll __P__eople __S__eem __T__o __N__eed __D__ata __P_rocessing

Protocols at Each OSI Layer

Key Protocols to Know

DNS (Port 53) — Translates domain names to IPs. Every internet action starts with DNS. DNS poisoning = critical attack vector.

HTTP/HTTPS (80/443) — Foundation of the web. HTTPS encrypted via TLS (Layer 6). Most web app attacks target HTTP.

SSH (Port 22) — Encrypted remote shell. Replaced Telnet. Top brute-force target on exposed servers.

FTP (Port 20/21) — File transfer. Port 21 = control, Port 20 = data. Often misconfigured with anonymous login.

SMTP (Port 25) — Sends email. Classic vector for phishing and open relay attacks.

SNMP (Port 161/162) — Network device management. Default community strings ("public", "private") often exposed.

Telnet (Port 23) — Cleartext remote access. Completely insecure — still found on legacy systems and IoT.

5️⃣ TCP/IP Suite — How the Internet Actually Works

The real internet runs on TCP/IP — a simpler 4-layer model developed by the US DoD that predates OSI.

OSI vs TCP/IP Mapping

The 4 Layers of TCP/IP

TCP/IP is the real-world model the internet runs on. Unlike OSI's 7 layers, TCP/IP keeps it simple with just 4 layers — each handling a specific job in getting your data from Point A to Point B.

Layer 4 — Application Layer

This is the layer you actually interact with. Every protocol that powers your daily internet activity lives here — whether you're browsing a website, sending an email, or connecting to a remote server.

Protocols: HTTP, HTTPS, FTP, SSH, SMTP, DNS, Telnet, SNMP, RDP

Layer 3 — Transport Layer

This layer is responsible for how data is delivered. It breaks large data into smaller chunks, makes sure everything arrives correctly, and uses port numbers to direct traffic to the right application.

Protocols: TCP (reliable) and UDP (fast)

Layer 2 — Internet Layer

Think of this as the GPS of your data. It assigns IP addresses and figures out the best route for your data to travel across multiple networks — from your device all the way to the destination server.

Protocols: IPv4, IPv6, ICMP, ARP, OSPF, BGP

Layer 1 — Network Access Layer

This is the foundation — the actual physical transmission of data. It handles how bits travel over your network cable, Wi-Fi signal, or any other physical medium, and manages delivery within your local network using MAC addresses.

Protocols: Ethernet, Wi-Fi (802.11), PPP, MAC Addressing

Working of TCP/IP Model

Why Hackers Care: Wireshark lets you see every layer's header. Crafting malicious packets = manipulating these headers deliberately.

Protocols & Ports — Doors Hackers Knock On

A port is like a door in a building. IP address = building address. Port = specific door number.

When hackers port scan, they're knocking on every door to see which ones are open.

Port Number Ranges

Top 30 Critical Ports Every Hacker Must Know

Note: Port 389 (LDAP) supports both TCP and UDP, though TCP is primary. Port 138 within the NetBIOS range (137–139) is UDP only — the full range is listed as TCP/UDP for simplicity.

Ports — Hacker's Favorites

Port 445 (SMB) — Brought hospitals down worldwide via WannaCry ransomware (2017). The EternalBlue exploit (leaked NSA tool) targeted this port. Always block 445 at firewall if SMB isn't needed.

Port 3389 (RDP) — Remote Desktop exposed on the internet = attacker's dream. BlueKeep (CVE-2019–0708) allowed unauthenticated RCE. Millions of systems still expose RDP publicly.

Port 23 (Telnet) — Still found on routers, IoT devices, legacy systems. Everything is cleartext. If you find it open during a pentest, it's a critical finding every time.

Port 22 (SSH) — Secure by design, but weak passwords and default creds make it a top brute-force target. Always enforce key-based authentication.

Port 53 (DNS) — Zone transfers on misconfigured servers expose the entire network topology. DNS tunneling exfiltrates data right through firewalls.

Quick-Reference Cheat Sheets

OSI One-Liner Summary

L7 Application  → User protocols: HTTP, FTP, SMTP, DNS, SSH
L6 Presentation → Encrypt/Decrypt/Compress: TLS/SSL
L5 Session      → Manage connections: NetBIOS, RPC
L4 Transport    → TCP/UDP, Ports, Segmentation
L3 Network      → IP Addresses, Routing: IP, ICMP, OSPF
L2 Data Link    → MAC Addresses, Frames: Ethernet, Wi-Fi
L1 Physical     → Raw bits over wire/fiber/air

L7 Application  → User protocols: HTTP, FTP, SMTP, DNS, SSH
L6 Presentation → Encrypt/Decrypt/Compress: TLS/SSL
L5 Session      → Manage connections: NetBIOS, RPC
L4 Transport    → TCP/UDP, Ports, Segmentation
L3 Network      → IP Addresses, Routing: IP, ICMP, OSPF
L2 Data Link    → MAC Addresses, Frames: Ethernet, Wi-Fi
L1 Physical     → Raw bits over wire/fiber/air

TCP vs UDP — One-Liner

TCP → Reliable, ordered, handshake
      Uses: HTTP, HTTPS, SSH, FTP, SMTP, RDP, MySQL
UDP → Fast, no guarantee, no handshake
      Uses: DNS, DHCP, SNMP, VoIP, Streaming, Gaming, NTP

TCP → Reliable, ordered, handshake
      Uses: HTTP, HTTPS, SSH, FTP, SMTP, RDP, MySQL
UDP → Fast, no guarantee, no handshake
      Uses: DNS, DHCP, SNMP, VoIP, Streaming, Gaming, NTP

Critical Ports — 60-Second Cheat Sheet

21    FTP       cleartext file transfer
22    SSH       secure remote access
23    Telnet    cleartext remote (INSECURE ⚠️)
25    SMTP      email sending
53    DNS       domain resolution
80    HTTP      cleartext web
110   POP3      email retrieval
143   IMAP      email access
443   HTTPS     encrypted web
445   SMB       Windows file sharing (HIGH RISK ⚠️)
3306  MySQL     database
3389  RDP       remote desktop (HIGH RISK ⚠️)
5900  VNC       remote desktop (often no auth ⚠️)
8080  HTTP-ALT  proxy / dev servers

21    FTP       cleartext file transfer
22    SSH       secure remote access
23    Telnet    cleartext remote (INSECURE ⚠️)
25    SMTP      email sending
53    DNS       domain resolution
80    HTTP      cleartext web
110   POP3      email retrieval
143   IMAP      email access
443   HTTPS     encrypted web
445   SMB       Windows file sharing (HIGH RISK ⚠️)
3306  MySQL     database
3389  RDP       remote desktop (HIGH RISK ⚠️)
5900  VNC       remote desktop (often no auth ⚠️)
8080  HTTP-ALT  proxy / dev servers

Day 6 Summary + What's Next

OSI Model — Key Takeaways:

• 7 layers, each with a specific job
• Data travels DOWN on sender, UP on receiver
• Different attacks target different layers
• Mnemonic: "All People Seem To Need Data Processing" (L7→L1)

TCP/IP — Key Takeaways:

• Real internet = 4-layer TCP/IP, not 7-layer OSI
• TCP = reliable, connection-oriented (3-way handshake)
• UDP = fast, connectionless, no handshake
• Data is encapsulated at each layer, de-encapsulated on receipt

Ports — Key Takeaways:

• 65,535 total ports: 0–1023 (well-known), 1024–49151 (registered), 49152–65535 (dynamic)
• Open ports = attack surface — always scan early in a pentest
• Most critical: 22 (SSH), 80/443 (Web), 445 (SMB), 3389 (RDP)
• Tools: Nmap (scanning), Wireshark (analysis), Netcat (connections)

Coming Up on Day 7 — Network Scanning & Enumeration

In Day 7, we kick off our first real hacking phase. Here's what we'll cover:

Reconnaissance:

• Passive vs Active Reconnaissance — what's the difference and when to use each

Scanning & Enumeration Tools:

• Advanced Nmap techniques — scripts, evasion, and output formats
• Banner grabbing — extracting information from running services
• Service enumeration with Enum4linux, Gobuster, and Nikto

Practical Labs (Continuing from Day 6 — apply these in your lab):

Lab 1 → Visualize OSI layers in live traffic using Wireshark
Lab 2 → Port scanning with Nmap (10 commands — basic to aggressive)
Lab 3 → Manually build a TCP handshake using Netcat
Lab 4 → DNS enumeration — dig, nslookup, and zone transfer
Lab 5 → Protocol capture challenge — DNS, HTTP, ICMP, ARP

Lab 1 → Visualize OSI layers in live traffic using Wireshark
Lab 2 → Port scanning with Nmap (10 commands — basic to aggressive)
Lab 3 → Manually build a TCP handshake using Netcat
Lab 4 → DNS enumeration — dig, nslookup, and zone transfer
Lab 5 → Protocol capture challenge — DNS, HTTP, ICMP, ARP

Goal:

Build a complete network map of your target — open ports, running services, and operating system fingerprint.

Found this useful? Give it up to 50 claps 👏 and drop a comment — let's build this community together!

Medium Tags: ethical hacking cybersecurity OSI model TCP/IP networking pentesting Nmap Wireshark infosec hacking for beginners network security protocols and ports