Network and Internet Foundations

Introduction

Cybersecurity depends on an accurate understanding of how digital communication works. Security controls such as firewalls, intrusion-detection systems, secure tunnels, identity services, and cloud access policies operate on networks. A defender who cannot interpret an IP address, recognize a protocol, trace a route, or distinguish a transport port from an application service will struggle to identify attacks or diagnose legitimate failures.

A network is a collection of computing devices and communication links that exchange data according to agreed rules called protocols. Networks range from a small home network to the global Internet. Although technologies differ, communication generally involves addressing, forwarding, delivery, naming, and service identification. This chapter introduces these foundations and relates them to practical cybersecurity work.

Learning Objectives

By the end of this chapter, you should be able to:

• explain common network terminology and distinguish LANs, WANs, internets, and the Internet;
• describe the OSI and TCP/IP models and the purpose of encapsulation;
• calculate basic IPv4 subnet ranges and recognize IPv6 address structure;
• explain ports, protocols, switching, routing, DNS, DHCP, NAT, and VPNs;
• describe the broad architecture of the Internet;
• use basic diagnostic tools to investigate connectivity and name-resolution problems; and
• identify security implications and good operational practices for foundational network services.

1. Network Concepts and Terminology

A host is a device capable of sending or receiving network traffic. A host may be a laptop, server, smartphone, virtual machine, printer, or Internet of Things device. A network interface connects a host to a network. Interfaces may be physical, such as Ethernet or Wi-Fi adapters, or virtual, such as those created by a hypervisor or VPN client.

A link is a communication path between devices. It may use copper cable, fibre-optic cable, radio, or a leased telecommunications circuit. A node is a general term for a connected device, including hosts and intermediate devices. A switch forwards frames within a local network, while a router forwards packets between different IP networks.

A protocol is a defined set of message formats, procedures, and rules. TCP, UDP, IP, DNS, HTTP, and DHCP are examples. Protocols make interoperability possible: equipment from different manufacturers can communicate when it implements the same standards.

A LAN (local area network) normally covers a limited site such as a home, office, or campus. A WAN (wide area network) connects geographically separated networks. An internetwork is a network of networks. The Internet is the globally interconnected system of independently operated networks that communicate using the Internet Protocol suite.

Bandwidth describes the maximum theoretical data-carrying capacity of a link, commonly measured in bits per second. Throughput is the actual achieved data rate. Latency is delay, while jitter is variation in delay. Packet loss occurs when transmitted data does not reach its destination. These measures affect voice, video, cloud applications, and security monitoring.

A frame is a data-link-layer unit, a packet is commonly an IP-layer unit, and a segment usually refers to a TCP transport-layer unit. In UDP terminology, the transport unit is a datagram. Usage varies slightly by context, but the distinction is useful when analysing traffic.

2. Layered Network Models

The OSI model

The Open Systems Interconnection (OSI) model divides communication into seven conceptual layers:

The OSI model is primarily a teaching and analysis framework. Real protocols do not always fit one layer perfectly. For example, TLS is often discussed between the application and transport layers, and ARP connects network-layer addressing with data-link operation.

The TCP/IP model

The practical Internet architecture is commonly represented by four layers:

1. Application: services such as HTTP, DNS, SSH, and DHCP.
2. Transport: TCP and UDP provide process-to-process communication.
3. Internet: IP provides logical addressing and routing.
4. Link or network access: local framing and physical transmission.

Some texts use a five-layer version that separates physical transmission from the data-link layer. The models are not competing implementations. The OSI model offers finer conceptual separation; the TCP/IP model more closely reflects deployed Internet protocols.

Encapsulation and decapsulation

When an application sends data, each lower layer adds control information. Application data becomes a transport payload; the transport layer adds a header, producing a segment or datagram. IP adds an IP header, producing a packet. The link layer adds a frame header and usually a trailer. At the destination, the process is reversed and is called decapsulation.

For example, an HTTPS request may be represented as:

Application data → TCP segment → IP packet → Ethernet or Wi-Fi frame.

Headers may contain source and destination ports, IP addresses, sequence information, protocol identifiers, and error-detection fields. Encapsulation allows each layer to perform a defined task without requiring every layer to understand the entire application message. A security analyst uses packet captures to inspect these fields and determine where a failure or suspicious activity occurs.

3. IPv4 Addressing and Subnetting

IPv4 addresses are 32-bit logical addresses, normally written as four decimal octets, such as 192.168.10.25. Each octet represents eight bits and has a value from 0 through 255. An address is interpreted together with a subnet mask or prefix length. The prefix identifies the network portion; the remaining bits identify hosts within that network.

CIDR notation expresses the prefix length with a slash. For example, /24 means that 24 of the 32 bits identify the network and 8 bits remain for host addressing. The number of addresses in an IPv4 subnet is:

where N is the total number of addresses and h is the number of host bits. In a conventional subnet, the network address and directed-broadcast address are reserved, so the number of normally assignable host addresses is:

This subtraction applies to ordinary IPv4 subnets where both addresses have their traditional meanings. It does not universally apply to point-to-point conventions or special-purpose prefixes.

Worked subnetting example

Consider 192.168.20.0/26. A /26 prefix leaves:

h = 32 − 26 = 6 host bits.

Therefore:

N = 2⁶ = 64 total addresses, and

H = 64 − 2 = 62 normally usable host addresses.

The block size is 64 addresses. The subnet ranges within 192.168.20.0/24 are:

An address such as 192.168.20.70 belongs to the second subnet because it lies between 64 and 127. Its network address is 192.168.20.64 and its broadcast address is 192.168.20.127.

Subnetting reduces broadcast scope, supports address planning, and assists segmentation. It is not, by itself, a complete security boundary. Access-control rules, routing policy, authentication, and monitoring are also required.

IPv4 address categories

Private IPv4 ranges are reserved for internal networks and are not globally routed on the public Internet:

• 10.0.0.0/8
• 172.16.0.0/12
• 192.168.0.0/16

Other important categories include loopback addresses (127.0.0.0/8), link-local addresses (169.254.0.0/16), and documentation ranges used in examples. Public addresses must be allocated and routed according to provider or regional Internet registry policies.

4. IPv6 Addressing

IPv6 uses 128-bit addresses, written as eight groups of hexadecimal digits separated by colons, for example 2001:db8:1234:1::10. Leading zeroes within a group may be omitted, and one consecutive sequence of zero groups may be compressed with ::. The documentation prefix 2001:db8::/32 is intended for examples and should not be treated as a public production allocation.

IPv6 provides an extremely large address space and supports hierarchical allocation. A common LAN prefix is /64, although other prefix lengths have specific uses. IPv6 has no broadcast address. Multicast and, in limited contexts, anycast provide corresponding delivery functions.

Important IPv6 categories include:

• Global unicast: globally routable addresses.
• Link-local: fe80::/10, used on a local link and commonly created automatically.
• Unique local: fc00::/7, intended for private internal use, although actual allocation commonly uses the fd00::/8 portion.
• Multicast: ff00::/8, representing groups of receivers.
• Loopback: ::1.

IPv6 Neighbor Discovery replaces many functions traditionally associated with ARP. Hosts may configure addresses through stateless address autoconfiguration, DHCPv6, or manual configuration. Security teams must support IPv6 deliberately; disabling or ignoring it can create monitoring gaps and unintended bypass paths.

5. Ports and Transport Protocols

An IP address identifies a host interface, but a port identifies a service or process endpoint. TCP and UDP ports range from 0 to 65,535. Ports 0–1023 are traditionally called well-known ports; 1024–49,151 are registered ports; and 49,152–65,535 are commonly used as dynamic or ephemeral ports. These ranges describe conventions, not an absolute security classification.

A communication endpoint is often represented as an IP address and port, such as 192.0.2.10:443. A flow can be distinguished by a five-tuple: source IP, source port, destination IP, destination port, and transport protocol.

TCP is connection-oriented and provides ordered, reliable byte-stream delivery using sequence numbers, acknowledgements, retransmission, and flow control. It uses a handshake to establish a connection. UDP is connectionless and provides a lightweight datagram service without built-in delivery, ordering, or congestion guarantees. DNS, streaming, voice, and modern protocols may use UDP, while other applications choose TCP or implement reliability themselves.

Common services include DNS on port 53, HTTP on port 80, HTTPS on port 443, SSH on port 22, and DHCP using UDP ports 67 and 68. Port numbers alone do not prove what service is running: applications can use non-standard ports, and attackers may deliberately disguise services.

6. Switching and Routing

A switch operates primarily at the data-link layer. Ethernet frames contain source and destination MAC addresses. A switch learns the source MAC address arriving on each port and stores it in a forwarding table. If the destination is known, the frame is sent to the corresponding port; if unknown, it may be flooded within the relevant VLAN. Broadcasts are also distributed within a broadcast domain.

A VLAN logically separates switch ports into different Layer 2 networks. VLANs can reduce broadcast traffic and support segmentation, but they require secure configuration. Trunk links carry traffic for multiple VLANs, usually using tagging. Misconfigured trunks, unused ports, native VLAN settings, and weak switch administration can create security risks.

A router makes forwarding decisions using destination IP addresses and a routing table. Routes may be connected, statically configured, or learned through dynamic routing protocols. The router chooses the most specific matching route, often described as longest-prefix matching. If no specific route exists, a default route may be used.

Routing protocols operate within an autonomous system or between such systems. OSPF is an interior gateway protocol often used within an organisation. BGP is the principal inter-domain routing protocol of the Internet. Routing policy, not merely physical distance, influences the paths chosen. Route leaks, hijacking, and misconfiguration can affect availability and confidentiality, which is why route validation and monitoring matter.

7. DNS, DHCP, NAT, and VPNs

DNS

The Domain Name System translates human-readable names into resource records. A resolver may query a recursive DNS server, which obtains answers from authoritative servers. The hierarchy includes the root, top-level domains, and authoritative zones. Common records include A for IPv4, AAAA for IPv6, CNAME for aliases, MX for mail exchange, NS for name servers, and TXT for text-based information such as verification data.

DNS responses have a time-to-live (TTL), which controls how long resolvers may cache them. Caching improves performance but means changes are not always visible immediately. DNS security concerns include cache poisoning, domain hijacking, malicious domains, data exfiltration through DNS, and misleading look-alike names. DNSSEC can authenticate DNS data using digital signatures, but it does not encrypt ordinary DNS queries. Encrypted DNS technologies such as DNS over HTTPS and DNS over TLS protect the query transport from some observers but introduce governance and visibility considerations.

DHCP

Dynamic Host Configuration Protocol automatically supplies configuration such as an IP address, subnet mask or prefix, default gateway, DNS server, and lease duration. The familiar IPv4 process is often summarized as DORA: Discover, Offer, Request, Acknowledgement.

DHCP is convenient but not inherently trustworthy. A rogue DHCP server may provide a malicious gateway or DNS server. Switch security features such as DHCP snooping, authenticated administrative access, and monitoring can reduce this risk. Static reservations and carefully managed address pools are useful for infrastructure devices.

NAT

Network Address Translation changes address information as traffic crosses a device. Port address translation (PAT), a common form, allows many private hosts to share one public IPv4 address by tracking transport ports and connection state. NAT helps conserve IPv4 addresses and can obscure internal addressing, but it is not a substitute for a firewall. It can complicate peer-to-peer applications, logging, troubleshooting, and end-to-end security models.

VPNs

A virtual private network creates a protected logical connection across an untrusted or shared network. A VPN may provide confidentiality, integrity, authentication, or all three, depending on its design. Site-to-site VPNs connect networks; remote-access VPNs connect an individual device to an organisation. IPsec commonly protects traffic at the network layer, while TLS-based VPNs operate through mechanisms associated with the transport or application layers.

VPN security depends on strong cryptography, secure key exchange, identity verification, endpoint posture, correct routing, and timely patching. A VPN does not make an infected endpoint safe, and it does not automatically prevent an authenticated user from accessing excessive resources. Modern zero-trust designs therefore evaluate identity, device condition, application context, and policy rather than trusting network location alone.

8. Internet Architecture

The Internet is not a single centrally controlled network. It is a federation of autonomous systems operated by Internet service providers, enterprises, universities, cloud providers, content networks, and governments. These systems exchange reachability information, primarily through BGP, and interconnect at private or public peering points. Transit providers carry traffic between networks that do not directly peer.

The Domain Name System provides a distributed naming layer. Internet exchange points can reduce latency and transit cost. Content delivery networks place cached content close to users. Cloud regions and availability zones provide geographically distributed computing, but their connectivity still depends on routing, DNS, provider networks, and security controls.

This distributed structure creates resilience but also complexity. A service may be reachable through several providers, reverse proxies, load balancers, and address families. An outage may therefore result from local configuration, an upstream provider, DNS, routing, a cloud region, or an application rather than from one physical failure.

9. Basic Diagnostic Tools

Troubleshooting should proceed from local conditions toward remote services. First verify interface status, link connectivity, IP configuration, route selection, name resolution, and application reachability. Change one variable at a time and record observations.

Useful tools include:

A failed ping does not necessarily prove that a host is down: firewalls may block ICMP. Conversely, a successful ping does not prove that an application is functioning. If a name fails but its IP address works, investigate DNS. If local addresses work but remote addresses do not, inspect the default gateway, route, firewall, or upstream link. If TCP connection succeeds but a web request fails, examine TLS, HTTP status codes, authentication, and application logs.

Packet capture must be conducted only with authorisation. Captured traffic may contain credentials, personal data, or confidential business information. Store captures securely, limit collection, and delete them according to policy.

10. Applied Case: Diagnosing a Cloud Application Failure

Background

This illustrative case concerns a small organisation whose staff report that an internal web application hosted in a cloud environment is unavailable. The application normally uses the name portal.example.org and HTTPS.

Problem and analysis

The analyst first checks the user’s interface and finds a valid DHCP lease, default gateway, and DNS server. A ping to the gateway succeeds. A DNS query returns an address, but the returned address belongs to an outdated load balancer. The analyst then queries a second approved resolver and obtains the current address. This indicates a DNS publication or caching problem rather than a local cable failure.

A trace to the current address reaches the cloud provider. A TCP test to port 443 succeeds, but curl reports a certificate-name mismatch. Inspection shows that the old load balancer certificate is still being presented for some clients. DNS records and certificate bindings were updated at different times.

Approach and solution

The organisation lowers the DNS record’s TTL only during a planned migration, updates the load balancer configuration, installs the correct certificate chain, and verifies both IPv4 and IPv6 records. It then tests from multiple networks and checks that the application redirects HTTP to HTTPS. Monitoring is added for certificate expiry, DNS consistency, and endpoint availability.

Outcome and learning points

The incident involved several layers: DHCP and local connectivity were healthy; DNS caused some users to reach the wrong destination; TLS configuration caused failures for others. The case demonstrates why troubleshooting should separate name resolution, routing, transport, encryption, and application behaviour. It also shows that a successful TCP connection is not equivalent to a functioning secure service.

11. Security, Governance, and Best Practices

Network foundations have direct governance implications. Organisations should maintain an accurate address and asset inventory, document network diagrams, approve routing and firewall changes, and retain appropriate logs. Administrative interfaces should use strong authentication, least privilege, secure management protocols, and restricted source networks. Telnet and unencrypted management services should be replaced with SSH, HTTPS, or other approved secure alternatives.

Segmentation should be based on business and risk requirements, such as separating users, servers, management systems, guests, and sensitive workloads. Rules should be explicit, reviewed, and logged. IPv4 and IPv6 policies must be aligned. Unused switch ports and services should be disabled where practical, while configuration backups and tested recovery procedures should be maintained.

Privacy laws and organisational policies may regulate the collection of DNS logs, IP addresses, packet captures, and user activity. Monitoring should have a legitimate purpose, proportionate scope, appropriate access controls, and defined retention. Security professionals must not scan or capture traffic on networks without permission.

Contemporary networks increasingly use software-defined networking, cloud-native virtual networks, encrypted DNS, IPv6, service meshes, and identity-aware access. Automation and AI-assisted tools can help identify anomalies or suggest configurations, but their output must be validated. An automated recommendation that changes a route, firewall rule, or DNS record can cause a large outage or create an exposure. Human approval, testing, rollback, and audit trails remain essential.

Chapter Summary

Networks are systems of hosts, links, and protocols that exchange data through layered operations. The OSI model provides seven conceptual layers, while the TCP/IP model reflects the architecture of deployed Internet protocols. Encapsulation adds headers as data moves downward through the stack; decapsulation removes them at the destination.

IPv4 uses 32-bit addresses and CIDR prefixes. Subnetting divides address space, limits broadcast domains, and supports structured design. IPv6 uses 128-bit addresses and requires deliberate operational and security support. Ports identify transport endpoints, TCP provides reliable ordered delivery, and UDP provides a lightweight datagram service.

Switches forward local frames, routers forward IP packets, and VLANs provide logical Layer 2 separation. DNS maps names to records, DHCP supplies configuration, NAT translates addresses, and VPNs protect traffic across shared networks. The Internet is a federation of autonomous systems connected through routing, transit, peering, naming, and content-delivery infrastructure.

Effective diagnosis proceeds systematically from interface and addressing to routing, DNS, transport, encryption, and application behaviour. Security requires segmentation, secure administration, monitoring, privacy controls, accurate documentation, and disciplined change management.

Key Terms

Host: A device capable of sending or receiving network traffic.

Protocol: Rules governing the format and exchange of network messages.

LAN: A network covering a limited geographical or organisational area.

WAN: A network connecting geographically separated networks.

Latency: The delay experienced while data travels through a network.

OSI model: A seven-layer conceptual model for network communication.

TCP/IP model: A practical layered model underlying Internet communication.

Encapsulation: The addition of headers and trailers as data moves through layers.

IPv4: A 32-bit Internet Protocol addressing system.

IPv6: A 128-bit Internet Protocol addressing system.

CIDR: Classless Inter-Domain Routing notation using a prefix length.

Subnet: A logical division of an IP network.

Port: A transport-layer identifier for a service or process endpoint.

Switch: A device that forwards local frames using data-link information.

Router: A device that forwards packets between IP networks.

DNS: A distributed system that maps names to network resource records.

DHCP: A protocol that automatically provides host network configuration.

NAT: Translation of address information between network contexts.

VPN: A protected logical connection across a shared or untrusted network.

Autonomous system: A network or group of networks under one administrative routing policy.

Review Questions

Short Answer Questions

1. What is the difference between bandwidth, throughput, and latency?
2. Why are layered models useful when analysing network communication?
3. What is the purpose of a default gateway?
4. State two differences between TCP and UDP.
5. Why is NAT not equivalent to a firewall?

Long Answer Questions

1. Explain the OSI and TCP/IP models and show how a web request is encapsulated.
2. Describe IPv4 subnetting and calculate the total and usable addresses in a /27 subnet.
3. Explain how switches and routers make forwarding decisions.
4. Describe the operation and security implications of DNS and DHCP.
5. Explain the role of autonomous systems, BGP, transit, peering, and content delivery in the Internet.

Analytical / Application Questions

1. A workstation has a valid IP address and can reach its gateway, but a website name cannot be resolved. Develop a diagnostic sequence and identify likely causes.
2. An organisation has users, public servers, management systems, and guest devices on one flat network. Propose a segmentation design and explain how VLANs, routing, firewall policy, and monitoring would support it.
3. A cloud migration changes both DNS records and TLS certificates. Explain how inconsistent DNS caching and certificate bindings could produce different symptoms for different users, and propose controls to reduce recurrence.

Multiple Choice Questions with Answers

Question 1

Which OSI layer is primarily responsible for logical addressing and routing?

A. Physical

B. Data link

C. Network

D. Transport

Correct Answer: C. Network

Question 2

How many total IPv4 addresses are in a /26 subnet?

A. 32

B. 64

C. 128

D. 256

Correct Answer: B. 64

Question 3

Which protocol automatically provides a host with an IP address and default gateway?

A. DNS

B. DHCP

C. BGP

D. ICMP

Correct Answer: B. DHCP

Question 4

What is the principal function of a switch?

A. Forward frames within a local network

B. Translate domain names

C. Assign public IP addresses

D. Encrypt all application data

Correct Answer: A. Forward frames within a local network

Question 5

Which DNS record maps a name to an IPv6 address?

A. A

B. MX

C. AAAA

D. CNAME

Correct Answer: C. AAAA

Question 6

Which statement best describes TCP?

A. It provides an ordered and reliable byte stream

B. It assigns DNS names to hosts

C. It operates only at the physical layer

D. It cannot use port numbers

Correct Answer: A. It provides an ordered and reliable byte stream

Question 7

A host has address 192.168.20.70/26. What is its subnet network address?

A. 192.168.20.0

B. 192.168.20.32

C. 192.168.20.64

D. 192.168.20.128

Correct Answer: C. 192.168.20.64

Question 8

What is a primary purpose of a VPN?

A. Increase the physical bandwidth of a link

B. Create a protected logical connection across a shared network

C. Replace all routing tables

D. Convert IPv4 addresses into domain names

Correct Answer: B. Create a protected logical connection across a shared network

Question 9

Which tool is most directly suited to inspecting DNS records?

A. dig

B. ss

C. arp

D. traceroute

Correct Answer: A. dig

Question 10

Why is a successful ping insufficient to prove that a web application is working?

A. Ping tests only the application’s database

B. Ping cannot use IP addresses

C. ICMP may be allowed while the application or HTTPS service is failing

D. Ping always tests port 443

Correct Answer: C. ICMP may be allowed while the application or HTTPS service is failing