Network and Internet Foundations

Introduction

Cybersecurity begins with an accurate understanding of networks. Security controls such as firewalls, intrusion-detection systems, access-control lists, encryption, and network monitoring operate on network communications. To configure or evaluate these controls, a security practitioner must understand how devices connect, how data is addressed, how packets move, and how common protocols support applications.

A network is a collection of interconnected computing devices that exchange data using agreed communication rules called protocols. The Internet is a global interconnection of autonomous networks. It is not a single centrally controlled network; rather, it is a system of networks operated by governments, businesses, universities, service providers, and individuals.

This chapter introduces the essential architecture and terminology required for later study of network attacks, defensive technologies, and secure system administration.

Learning Objectives

By the end of this chapter, you should be able to:

1. Distinguish common network types and topologies.
2. Explain the functions of routers, switches, access points, firewalls, and related devices.
3. Describe MAC addresses, IPv4 and IPv6 addresses, ports, and sockets.
4. Explain packet flow, routing, DNS, and common transport protocols.
5. Relate the OSI reference model to the TCP/IP model.
6. Apply essential security terminology to ordinary network communications.
7. Identify practical weaknesses and appropriate foundational controls.

1. Network Scope and Types

Networks can be classified by geographical scope, ownership, purpose, or technology.

A LAN normally provides high speed over a limited area and is managed by one organization or household. A WAN uses carrier infrastructure, leased circuits, or Internet-based virtual private networks to connect geographically separated networks. A VPN creates an authenticated and often encrypted logical connection over an untrusted or shared network; it does not make the underlying network physically private.

Networks may also be classified as client-server or peer-to-peer. In a client-server arrangement, dedicated servers provide services to clients. In a peer-to-peer arrangement, devices can both request and provide services. Centralized administration generally makes client-server networks easier to monitor and secure, although it also makes important servers attractive targets.

2. Network Topologies

A topology describes how devices are arranged and connected. It may be physical, describing actual cabling and radio coverage, or logical, describing how data flows.

Bus, ring, star, mesh, and hybrid topologies

In a bus topology, devices share one main communication medium. A failure or break in that medium can affect many devices, and collisions may occur in older implementations. In a ring topology, each device connects to two neighboring devices. Data travels around the ring, although modern technologies may use redundant or logically implemented rings.

A star topology connects each endpoint to a central switch or access point. It is common in Ethernet networks because a single endpoint cable can fail without normally disconnecting other endpoints. The central device is, however, a potential single point of failure.

A mesh topology provides multiple paths between devices. Full mesh connectivity can offer resilience but requires many links and is expensive at scale. Partial mesh designs are common in wide-area and wireless networks. A hybrid topology combines two or more designs.

Topology affects availability, troubleshooting, cost, and attack surface. Redundancy improves resilience but can create routing loops or make configuration more complex. Security personnel should therefore understand both intended topology and actual topology discovered through monitoring.

3. Network Devices and Their Security Roles

Network interface card and modem

A network interface controller (NIC) provides a device with network connectivity. It commonly has a burned-in MAC address, although modern systems can use randomized or administratively assigned addresses. A modem converts signals for a particular access technology, such as cable or digital subscriber service. A modem is not necessarily a router or firewall.

Hub and switch

A hub repeats incoming signals to all ports. It has little awareness of destination addresses and is now largely obsolete. A switch forwards Ethernet frames according to a MAC-address table. It normally sends a frame only toward the port associated with its destination MAC address, improving efficiency and reducing unnecessary exposure.

Switches can support security features such as port security, virtual LANs (VLANs), 802.1X authentication, DHCP snooping, and dynamic ARP inspection. These controls require careful configuration; a VLAN is a logical segmentation mechanism, not automatically a complete security boundary.

Router

A router connects different IP networks and selects a next hop using a routing table. A home gateway often combines a router, switch, wireless access point, firewall, and DHCP server in one appliance. Routers separate broadcast domains, whereas ordinary switches generally do not.

Routing may be static or dynamic. Static routes are manually configured and predictable, but they do not automatically adapt to changes. Dynamic routing protocols exchange reachability information. Examples include OSPF within an organization and BGP between autonomous systems. Incorrect routing advertisements can cause outages, interception, or traffic redirection.

Wireless access point

An access point bridges wireless clients to a wired network. Wireless security should use modern authentication and encryption, such as WPA3 where supported, strong credentials, protected management interfaces, and separate guest access. Radio signals extend beyond physical walls, so wireless security must account for nearby unauthorized listeners.

Firewall and proxy

A firewall enforces traffic rules between security zones. Rules may consider source and destination addresses, protocols, ports, connection state, identity, or application characteristics. A stateful firewall tracks connections, while a stateless filter evaluates individual packets or rules without maintaining connection context.

A proxy acts on behalf of a client or server. Forward proxies commonly represent clients; reverse proxies represent servers and may provide TLS termination, load balancing, caching, or web-application filtering. Security depends on correct trust boundaries and logging, not merely on the presence of a device labeled “firewall.”

4. Encapsulation and the OSI Model

When an application sends data, each networking layer adds information needed by its corresponding peer. This process is called encapsulation. At the receiving end, headers are removed in decapsulation.

The seven-layer OSI model is a conceptual reference framework:

The OSI model is useful for analysis, but real protocols do not always fit one layer perfectly. TLS, for example, provides security services between application protocols and transport services. The model should therefore guide reasoning rather than be treated as a rigid description of every implementation.

At the sender, application data becomes a transport-layer segment or datagram, a network-layer packet, and a data-link frame. At each router, the incoming frame is removed and a new frame is created for the next link. The IP packet generally remains logically addressed from the original source to the final destination, although fields such as the IPv4 time-to-live may change.

5. The TCP/IP Model

The TCP/IP model is commonly represented using four layers:

The models use different boundaries, but both support a layered way of thinking. Layering enables interoperability: an application can use TCP without knowing the details of Ethernet, and Ethernet can carry many different application protocols.

Security analysis often asks four questions: What layer is being attacked? What information identifies the communication? What device can enforce a control? Which evidence will appear in logs? For example, a switch may observe MAC addresses, a router may enforce an IP-based rule, and an application gateway may inspect an HTTP request.

6. Addressing: MAC, IP, Ports, and Sockets

MAC addresses

A MAC address identifies a network interface on a local data-link network. Ethernet frames contain source and destination MAC addresses. A switch uses these addresses to forward frames. MAC addresses are not reliable identities for people or organizations: they can be changed or spoofed, and they normally have only local-link significance.

IPv4 addressing

An IPv4 address contains 32 bits and is commonly written in dotted-decimal notation, such as 192.0.2.25. A subnet mask identifies which bits represent the network prefix and which represent the host portion. In CIDR notation, 192.0.2.0/24 means that the first 24 bits are the network prefix.

For a conventional subnet with a prefix length of /n, the total number of addresses is:

Here, 32 is the number of IPv4 address bits and n is the prefix length. In the traditional model, a subnet such as /24 reserves one address for the network identifier and one for the directed broadcast address, leaving:

usable host addresses. This subtraction is not universally applicable: point-to-point links, special-purpose prefixes, and modern address-allocation practices may use different rules. For a /24, the total is 256 addresses and the traditional usable-host count is 254.

Private IPv4 ranges include 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Private addresses are not globally routed on the public Internet. Network Address Translation (NAT) commonly allows multiple private hosts to share a public address, but NAT is not a substitute for a firewall or comprehensive security policy.

IPv6 addressing

IPv6 uses 128-bit addresses and is written in hexadecimal groups, for example 2001:db8::25. The larger address space supports extensive allocation and reduces dependence on address conservation. IPv6 has link-local addresses, commonly beginning with fe80::/10, and may use global unicast, unique local, multicast, and anycast addressing. Security teams must monitor IPv6 even when an organization primarily documents IPv4, because an unmanaged IPv6 path can bypass intended controls.

Ports and sockets

A port is a transport-layer identifier ranging from 0 to 65,535 for TCP or UDP. Well-known ports traditionally occupy 0–1,023, registered ports 1,024–49,151, and dynamic or private ports 49,152–65,535, although operating systems and applications may vary in allocation behavior.

A socket endpoint is commonly described by an IP address, transport protocol, and port. A TCP connection is identified by a four-tuple: source IP, source port, destination IP, and destination port. For example, a client might use 192.168.1.20:51544 to connect to 203.0.113.10:443 over TCP. Port numbers identify services, not security guarantees. HTTPS commonly uses TCP 443, but an attacker can run another service on that port, and a service can be configured on a nonstandard port.

7. Packet Flow and Transport Protocols

Suppose a workstation opens an HTTPS website. The application first needs the server’s IP address, usually through DNS. The workstation then determines whether the destination is local. If it is not local, it sends the frame to the default gateway’s MAC address. The router examines the destination IP, consults its routing table, decrements the IPv4 time-to-live or IPv6 hop limit, and forwards the packet to the next hop. Each link creates a new frame. The final host delivers the payload to the listening application through the destination port.

Address Resolution Protocol (ARP) maps an IPv4 address to a local MAC address. Neighbor Discovery performs related functions for IPv6. Attackers may abuse weaknesses in local address-resolution mechanisms through spoofing or poisoning, enabling interception or disruption. Segmentation, inspection, authenticated infrastructure, and monitoring reduce risk.

TCP is connection-oriented and provides ordered, reliable byte-stream delivery. Its three-way handshake is commonly described as SYN, SYN-ACK, and ACK. TCP uses sequence numbers, acknowledgements, retransmission, and flow control. Reliability does not mean confidentiality or authenticity; TLS is needed for those properties in many applications.

UDP is connectionless and provides datagrams without TCP’s built-in reliability and ordering. It has lower protocol overhead and is useful for DNS, voice, streaming, DHCP, and other applications that implement their own reliability or value low latency. UDP is not inherently insecure, but its lack of a handshake can facilitate spoofing and reflection attacks when applications are poorly designed.

8. Routing and Default Gateways

A routing table contains destination prefixes, next hops, interfaces, and metrics. A router selects the most specific matching prefix, often called longest-prefix matching. If no more specific route exists, a default route may be used. The default route is commonly represented as 0.0.0.0/0 for IPv4 and ::/0 for IPv6.

For example, a workstation with address 192.168.10.25/24 treats 192.168.10.0/24 as local. A destination such as 192.168.10.40 is reached directly after address resolution. A destination such as 198.51.100.20 is outside the local prefix, so the workstation sends the frame to its configured default gateway. The gateway then makes the next routing decision.

Routing and security are closely related. An incorrect route can expose an internal service, create a denial of service, or send sensitive traffic through an unauthorized intermediary. Route filtering, authenticated routing protocols where supported, change control, and continuous monitoring are important controls.

9. DNS: Naming the Internet

The Domain Name System translates domain names into records such as IP addresses. It is hierarchical. Root name servers refer queries to top-level-domain servers, which refer them to authoritative servers for domains such as example.com. A recursive resolver performs this work for a client and commonly caches answers according to their time to live (TTL).

Important DNS record types include:

DNS is essential but was not originally designed to provide strong authenticity or confidentiality. DNS cache poisoning can provide false answers. DNS Security Extensions (DNSSEC) allow validation of digitally signed DNS data, helping establish authenticity and integrity, although DNSSEC does not encrypt ordinary DNS queries. Encrypted DNS technologies such as DNS over TLS and DNS over HTTPS protect queries from some network observers, but they also affect monitoring, policy enforcement, and incident investigation.

A secure organization should control recursive resolvers, restrict unauthorized zone transfers, monitor unusual query patterns, protect registrar accounts, and publish accurate records. DNS logs can reveal malware command-and-control behavior, data-exfiltration attempts, and suspicious algorithmically generated domains.

10. Essential Security Concepts

A threat is a potential cause of harm. A vulnerability is a weakness that can be exploited. Risk combines the possibility of an adverse event with its consequences. An asset is something valuable that requires protection. An attack surface is the collection of reachable points through which an attacker may attempt access.

Confidentiality prevents unauthorized disclosure, integrity protects against unauthorized alteration, and availability supports timely and reliable access. These three properties are often called the CIA triad. Authentication verifies identity; authorization determines permitted actions; accounting or auditing records relevant activity.

Network segmentation limits the spread of compromise. Least privilege limits what a user, service, or device can do. Defense in depth uses multiple independent controls. Zero-trust security avoids automatically trusting a device merely because it is inside a network and instead evaluates identity, device condition, context, and requested resource.

A packet capture can support troubleshooting and forensics, but it may contain credentials, personal data, or confidential business information. Monitoring must therefore follow lawful authority, organizational policy, data-minimization principles, retention requirements, and access controls. Security professionals should not capture or scan networks without explicit authorization.

Applied Case: A Small Clinic Network

Background

This illustrative case concerns a small medical clinic with twelve workstations, wireless tablets, a cloud-based records application, printers, and a guest Wi-Fi service. The clinic uses a single consumer gateway and one flat LAN.

Problem

Staff report slow connections and occasional inability to reach the records system. A review also finds that guest devices receive addresses in the same network as medical workstations. The gateway uses a shared administrator password, and IPv6 is enabled but not documented.

Analysis

The flat topology creates unnecessary lateral-movement risk: compromise of a guest device could provide a path toward clinical systems. Shared administration weakens accountability. Undocumented IPv6 creates a potential alternate path around IPv4-only firewall rules. Performance complaints may result from wireless interference, excessive broadcast traffic, DNS problems, or an overloaded gateway; assumptions should be tested rather than treated as facts.

Approach and solution

The clinic creates separate VLANs for clinical systems, staff devices, printers, management, and guests. Inter-VLAN traffic is routed through a firewall using least-privilege rules. Guest traffic is denied access to internal networks and permitted only to the Internet. WPA3 or the strongest supported enterprise wireless security is enabled, and management access is restricted to an administrative network with individual accounts and multifactor authentication.

The clinic documents IPv4 and IPv6 addressing, verifies firewall rules for both protocols, uses centrally managed DNS resolvers, and enables logs for authentication, DNS, firewall decisions, and administrative changes. A monitoring baseline is created so that unusual traffic can be identified. The design is reviewed against privacy obligations applicable to medical information.

Outcome

The redesign reduces lateral movement, improves accountability, and makes traffic paths observable. Performance improves after separate testing identifies a wireless interference issue. The clinic also establishes a change-management process and schedules periodic access reviews.

Learning points

1. Network segmentation is both an availability and security design tool.
2. A security review must include IPv4 and IPv6.
3. Device capability does not replace policy, documentation, or monitoring.
4. Troubleshooting should use evidence from addressing, routing, DNS, wireless, and logs.
5. Sensitive network monitoring must respect authorization and privacy requirements.

Challenges and Contemporary Developments

Modern networks increasingly use cloud services, software-defined networking, container platforms, 5G, remote work, and Internet of Things devices. These environments blur the traditional boundary between “internal” and “external” networks. Identity-aware access, secure APIs, centralized logging, strong asset inventories, and automated configuration validation are therefore increasingly important.

Artificial intelligence can assist with traffic classification, anomaly detection, and alert prioritization, but it can also generate false positives, conceal attacker activity in normal-looking traffic, or expose sensitive data if logs are sent to an unapproved service. Human review, explainable procedures, data governance, and controlled testing remain necessary.

Common foundational best practices include maintaining an accurate asset and topology inventory; using secure configurations; applying patches; disabling unnecessary services; enforcing multifactor authentication; separating management traffic; filtering ingress and egress traffic; protecting backups; synchronizing system time; collecting useful logs; testing restoration; and rehearsing incident-response procedures.

Chapter Summary

Networks connect devices through layered protocols and agreed addressing systems. LANs, WANs, wireless networks, intranets, extranets, and VPNs differ in scope and purpose. Bus, ring, star, mesh, and hybrid topologies influence cost, resilience, and attack surface. Switches forward local frames, routers connect IP networks, access points provide wireless connectivity, and firewalls enforce traffic policy.

The OSI and TCP/IP models provide useful frameworks for understanding encapsulation, packet flow, troubleshooting, and security controls. MAC addresses support local-link delivery; IP addresses support logical addressing and routing; ports identify transport services; and sockets describe communication endpoints. TCP provides reliable ordered delivery, while UDP provides lightweight datagrams without built-in reliability.

Routing tables and default gateways determine how packets reach remote networks. DNS provides hierarchical name resolution but requires protection against manipulation and misuse. Security analysis applies confidentiality, integrity, availability, authentication, authorization, least privilege, segmentation, defense in depth, and risk-based decision-making. Effective network security combines sound architecture, secure configuration, monitoring, governance, and authorized professional practice.

Key Terms

Network: Interconnected devices that exchange data using protocols.

LAN: Local Area Network covering a limited geographic area.

WAN: Wide Area Network connecting geographically separated networks.

Topology: Physical or logical arrangement of network components.

Switch: Device that forwards local frames using MAC addresses.

Router: Device that forwards packets between IP networks.

Firewall: Control that permits or blocks traffic according to policy.

MAC address: Data-link identifier associated with a network interface.

IP address: Logical address used for network-layer communication.

Subnet mask: Value identifying network and host portions of an IPv4 address.

Port: Transport-layer number identifying an application endpoint.

Socket: Communication endpoint described by address, protocol, and port.

Protocol: Agreed rule set for communication.

Encapsulation: Adding layer-specific information to data.

Routing table: Information used to select packet paths.

DNS: Hierarchical system for resolving names and storing related records.

TCP: Reliable, connection-oriented transport protocol.

UDP: Connectionless transport protocol using datagrams.

VLAN: Logical segmentation of a switched network.

NAT: Translation between address spaces, commonly private and public IPv4.

Review Questions

5 Short Answer Questions

1. What is the principal difference between a switch and a router?
2. Define a MAC address and state where it has significance.
3. What is the purpose of a default gateway?
4. Why is DNS important to Internet use?
5. What does encapsulation mean in layered networking?

5 Long Answer Questions

1. Compare LANs, WANs, intranets, extranets, and VPNs, including security implications.
2. Explain the OSI and TCP/IP models and discuss why their boundaries should not be treated as perfectly identical.
3. Describe the complete path of an HTTPS request from a workstation to a remote server.
4. Compare TCP and UDP in terms of connection behavior, reliability, performance, and security considerations.
5. Explain how VLANs, firewalls, least privilege, and monitoring can reduce lateral movement.

3 Analytical / Application Questions

1. A workstation can reach devices on its own subnet but cannot reach the Internet. Identify a logical troubleshooting sequence involving addressing, the default gateway, routing, DNS, and firewall policy.
2. A company has a guest wireless network using the same subnet as its payroll computers. Analyze the risks and propose a redesigned topology and access-control policy.
3. DNS logs show many requests to rapidly changing domains from one workstation. Develop an investigation plan and explain which security, privacy, and governance principles should guide it.

Multiple Choice Questions with Answers

Question 1

Which device normally forwards Ethernet frames based on destination MAC addresses?

A. Router

B. Switch

C. DNS resolver

D. Firewall proxy

Correct Answer: B. Switch

Question 2

What is the traditional number of usable host addresses in an IPv4 /24 subnet?

A. 24

B. 128

C. 254

D. 256

Correct Answer: C. 254

Question 3

Which protocol provides reliable, ordered byte-stream delivery?

A. UDP

B. ARP

C. DNS

D. TCP

Correct Answer: D. TCP

Question 4

What is the primary function of a default gateway?

A. To resolve domain names

B. To forward traffic destined for other networks

C. To assign MAC addresses

D. To encrypt every application payload

Correct Answer: B. To forward traffic destined for other networks

Question 5

Which DNS record maps a domain name to an IPv6 address?

A. A

B. MX

C. AAAA

D. PTR

Correct Answer: C. AAAA

Question 6

Which OSI layer is primarily associated with IP routing?

A. Physical

B. Data link

C. Network

D. Presentation

Correct Answer: C. Network

Question 7

A TCP connection is commonly identified by which combination?

A. Destination MAC only

B. Source and destination IP addresses and ports

C. DNS name and TTL only

D. VLAN number only

Correct Answer: B. Source and destination IP addresses and ports

Question 8

What is a major security benefit of separating guest Wi-Fi from clinical systems with policy-controlled VLANs?

A. It guarantees that guests cannot access the Internet

B. It limits direct lateral access to sensitive systems

C. It removes the need for authentication

D. It converts UDP into TCP

Correct Answer: B. It limits direct lateral access to sensitive systems

Question 9

Which statement about DNSSEC is correct?

A. It provides validation of signed DNS data

B. It replaces all firewalls

C. It encrypts every DNS query by definition

D. It assigns private IPv4 addresses

Correct Answer: A. It provides validation of signed DNS data

Question 10

Which security property concerns preventing unauthorized disclosure of information?

A. Availability

B. Integrity

C. Confidentiality

D. Nonrepudiation

Correct Answer: C. Confidentiality