Network security — ports, firewalls, HTTP
Networking · SOC · Network sec · Pentester
OSI/TCP-IP, segmentation, firewalls, DNS, TLS, and HTTP status codes for triage.
Concept map
Client → Firewall → Server SYN → SYN-ACK → ACK | 200 OK vs 401/403/404/500
1. Ports & services
Document expected listeners (22, 443, 53). Unexpected open ports = investigation.
- ss -tlnp or netstat reviewed on lab VM
2. Firewalls
Default deny inbound; allow least paths. Log denied traffic for IDS tuning.
3. HTTP status codes
200 OK, 301/302 redirect, 401 unauthenticated, 403 forbidden, 404 not found, 500 server error — each implies different test or defense.
4. DNS & email auth
SPF, DKIM, DMARC reduce spoofing — pair with OSINT on your domain (DNSDumpster, SecurityTrails).
Case studies
DDoS & availability
Availability attacks drive CDN and rate limiting — not confidentiality-only thinking.