Everything you need to understand how data actually moves across networks — from cables to applications.
A network is two or more devices connected together so they can share data. That could be two computers in the same room, your phone talking to a web server across the world, or millions of devices all connected through the internet.
Networking is the foundation of everything in cybersecurity. You can't defend what you don't understand — and almost every attack involves the network in some way.
LAN (Local Area Network) — A network within a small area like your home or office. Devices on the same LAN can talk to each other directly.
WAN (Wide Area Network) — A network that spans large distances. The internet is the largest WAN. Your ISP connects your LAN to the WAN.
WLAN (Wireless LAN) — A LAN that uses Wi-Fi instead of cables. Same idea, no wires.
When you visit a website, a lot happens in milliseconds. Your device needs to find the server, establish a connection, request data, and receive it — all reliably and in the right order.
Data doesn't travel as one big chunk. It gets broken into small pieces called packets. Each packet is sent independently across the network and reassembled at the destination. This is why your download can keep going even if one path is congested — packets can take different routes.
Every device on a network needs an address so data knows where to go. That's what an IP address is — an Internet Protocol address. There are two versions in use today.
32-bit address — written as 4 numbers separated by dots, each from 0–255.
Supports about 4.3 billion unique addresses. That sounds like a lot — but we ran out. Every device needs an IP, and there are way more than 4.3 billion devices now.
Still the most common version you'll see today.
128-bit address — written as 8 groups of 4 hex digits separated by colons.
Supports 340 undecillion addresses (that's 340 followed by 36 zeros). We won't run out.
Also has built-in improvements: better security, no need for NAT, auto-configuration.
Both are Layer 4 (Transport Layer) protocols that define how data is sent between devices. They take very different approaches.
Before TCP can send any data, it establishes a connection through a 3-way handshake. This is one of the most important things to understand for security — it's where a lot of attacks happen.
SYN = Start a connection | ACK = Acknowledge data was received | FIN = Close the connection
UDP packets are intentionally simple — just 4 fields: Source Port, Destination Port, Length, and Checksum. That's it. No sequence numbers, no ACKs. Speed over reliability.
The OSI Model (Open Systems Interconnection) is essentially a blueprint for how computers talk to each other over a network. It breaks the process into 7 layers, each with a specific job.
When you send data it starts at Layer 7 (Application) and works down to Layer 1. When you receive data it starts at Layer 1 (Physical) and works up to Layer 7.
| # | Layer | Simple Description | What it Does | Examples |
|---|---|---|---|---|
| 7 | ApplicationTOP | Where humans & software interact | Services like email, file transfers, web browsers | HTTP/HTTPSFTPDNSSMTP |
| 6 | PresentationTRANSLATOR | Translates data formats | Converts formats so both sides understand — handles encoding, encryption, compression | JPEGSSL/TLSASCII |
| 5 | SessionCONVERSATION MGR | Manages ongoing connections | Opens, maintains, and closes sessions ("conversations") between devices | Session tokensAPI Sessions |
| 4 | TransportDELIVERY CONTROL | Splits data & ensures it arrives | Segments data, controls flow, handles errors and retransmission | TCPUDPPorts |
| 3 | NetworkADDRESSING & ROUTING | Routes across different networks | Assigns IP addresses, finds the best path between networks | IPRoutersICMP |
| 2 | Data LinkLOCAL DELIVERY | Handles local delivery | Deals with delivery between devices on the same network using MAC addresses | EthernetMAC AddressSwitches |
| 1 | PhysicalHARDWARE | Transmits raw bits | Sends data as electrical signals, light, or radio waves (actual 1s and 0s) | CablesFiberRadio wavesNIC |
An IP address gets data to the right device — but a port number tells that device which application should handle it. Think of an IP address as a building address, and a port as the specific apartment number inside.
Ports 0–1023 are well-known ports reserved for specific protocols. Ports 1024–49151 are registered ports. Ports 49152–65535 are dynamic/ephemeral — used temporarily by clients.
| Port | Protocol | Main Use | Side |
|---|---|---|---|
| 20 | FTP (Data) | Transfers file data | Server |
| 21 | FTP (Control) | FTP commands & login | Server |
| 22 | SSH | Secure remote login | Server |
| 23 | Telnet | Remote login (insecure — avoid) | Server |
| 25 | SMTP | Sending email | Server→Server |
| 53 | DNS | Domain Name System lookups | Both |
| 67 | DHCP | Assigns IP addresses | Server |
| 68 | DHCP | Requests IP addresses | Client |
| 69 | TFTP | Simple file transfer (no auth) | Server |
| 80 | HTTP | Web traffic (unencrypted) | Server |
| 110 | POP3 | Receive/download email | Server |
| 119 | NNTP | Network news | Server |
| 123 | NTP | Time synchronization | Both |
| 179 | BGP | Routing between networks (internet backbone) | Both |
| 443 | HTTPS | Secure web traffic (TLS encrypted) | Server |
These two devices are constantly confused — and your ISP probably combined them into one box. Here's what each one actually does.
Computers communicate using IP addresses. But humans can't remember 142.250.80.46 — we remember google.com. DNS (Domain Name System) is what translates between the two.
When you type a URL, your device sends a DNS query (on port 53) asking "what's the IP for this domain?" A DNS server responds with the IP, and then your browser connects.
HTTP (HyperText Transfer Protocol) is the protocol your browser uses to request and receive web pages. Every time you visit a website, your browser sends an HTTP request and the server sends back a response.
HTTP runs on port 80. It is a simple request-response model — your browser asks for something, the server replies. Requests have a method that describes the action: GET (fetch data), POST (send data), PUT (update data), DELETE (remove data).
HTTPS is HTTP with TLS (Transport Layer Security) encryption wrapped around it. It runs on port 443. The content of the request is encrypted so nobody intercepting the traffic can read it — they can see you are talking to a server, but not what you are saying.
Every concept in this guide directly maps to real-world attacks and defenses. Networking isn't just background knowledge — it is security.