TCP/IP
Networking Fundamentals
Simple
TCP/IP is the set of rules computers use to talk over networks. IP gets the message to the right computer (like an address on an envelope); TCP makes sure all pieces arrive in order (like numbered pages with delivery receipts).
Technical
TCP/IP is a four-layer model (Link, Internet, Transport, Application). IP (v4/v6) provides connectionless, best-effort routing via addresses and TTL. TCP adds connection-oriented, reliable byte streams with sequence/ack numbers, windowing and congestion control. UDP offers lightweight datagrams. Ports multiplex services on a host.
Why it matters
Every intrusion, exfiltration, C2 beacon and scan is TCP/IP traffic. Analysts read it in packet captures and logs; testers rely on it to understand what services are reachable.
Example
A SOC analyst sees a workstation making a TCP connection to an unknown external IP on port 4444 every 60 seconds — understanding TCP sessions and ports lets them recognize possible C2 beaconing.
Practice idea
Capture your own localhost HTTP traffic with tcpdump and identify the handshake in Wireshark.
Deep dive
Study TCP state machine (SYN_SENT, ESTABLISHED, TIME_WAIT), sequence number randomization (and why predictable ISNs enabled hijacking), window scaling, SACK, and how scanners infer port states from RST vs no response.
How TCP/IP Works
Data from an application is wrapped (encapsulated) by each layer: application data → TCP segment (ports) → IP packet (addresses) → Ethernet frame (MAC). The receiver unwraps it in reverse.
OSI vs TCP/IP
OSI has 7 layers (Physical, Data Link, Network, Transport, Session, Presentation, Application). TCP/IP collapses them into 4. OSI is a teaching/reference model; TCP/IP is what the internet actually runs.
TCP
Connection-oriented. Handshake SYN → SYN-ACK → ACK. Reliable, ordered delivery with retransmission. Used by HTTP, SSH, SMTP.
UDP
Connectionless, no handshake, no guarantee. Fast and lightweight. Used by DNS, DHCP, VoIP, streaming, QUIC.
IP
Routes packets between networks using IPv4 (32-bit) or IPv6 (128-bit) addresses. TTL prevents infinite loops and powers traceroute.
Ports
0–1023 well-known (22 SSH, 53 DNS, 80 HTTP, 443 HTTPS), 1024–49151 registered, 49152+ ephemeral. A socket = IP + port + protocol.
DNS
Translates names to IPs. Queries usually UDP/53. Attackers abuse DNS for tunneling and exfiltration; defenders monitor DNS logs heavily.
HTTP/HTTPS
HTTP is the web's application protocol over TCP. HTTPS wraps it in TLS, providing confidentiality, integrity and server authentication.
Common Network Attacks
Port scanning (reconnaissance), SYN floods (DoS), ARP spoofing (MITM on LANs), DNS spoofing, session hijacking. Understand them so you can detect them — practice only in lab networks.
Defensive Concepts
Firewalls and segmentation, IDS/IPS (Suricata), network monitoring (Zeek), egress filtering, DNS logging, TLS everywhere, and baselining normal traffic.