Networking Fundamentals for Security Practitioners

Prerequisites

• FND-K001: The CIA Triad, Security Goals & the Modern Threat Landscape
• FND-K002: Ethical, Legal & Professional Boundaries

You do not need prior networking knowledge. You need a terminal and either Wireshark or tshark installed.

Why This Lesson Matters

Every security technique — from sniffing traffic, to firewall rule writing, to lateral movement detection — assumes that you understand how network communication works. Without this foundation, you are manipulating symbols you do not understand. Misidentifying a protocol, misreading a port number, or confusing TCP and UDP can lead to completely wrong conclusions during an investigation.

This lesson does not aim to make you a network engineer. It aims to give you exactly the vocabulary and mental models you need to work with network traffic as a security analyst, tester, or incident responder. By the end, you should be able to open a PCAP and have a clear idea of what you are looking at.

1. The OSI Model and TCP/IP Stack

The OSI (Open Systems Interconnection) model is a conceptual framework that describes network communication in seven layers. The TCP/IP model collapses these into four. Both models serve the same purpose: they allow different implementations to interoperate by standardising the interface between layers.

1.1 The OSI Model

The OSI model is primarily a teaching tool. In practice, the TCP/IP four-layer model is what you will encounter:

TCP/IP Layer    ←→  OSI Layers    Examples
─────────────────────────────────────────────────────
Application     ←→  7, 6, 5       HTTP, DNS, SMTP, SSH, TLS
Transport       ←→  4             TCP, UDP
Internet        ←→  3             IPv4, IPv6, ICMP
Link            ←→  2, 1          Ethernet, Wi-Fi

Why security analysts care about layers: - Firewall rules operate at Layer 3 (IP address) and Layer 4 (port/protocol) - IDS/IPS operates primarily at Layers 3–7 - DDoS attacks often target Layer 3 (volumetric) or Layer 7 (application) - Wireshark displays traffic organised by layer — understanding layers helps you navigate its protocol tree

1.2 Encapsulation

Each layer wraps the layer above it in a header (and sometimes a trailer). When data is sent, it is progressively encapsulated:

[HTTP data]                                    ← Application layer
[TCP header | HTTP data]                       ← Transport layer adds TCP header
[IP header | TCP header | HTTP data]           ← Internet layer adds IP header
[Eth header | IP header | TCP header | HTTP | Eth trailer]  ← Link layer

When data arrives, each layer strips its header and passes the payload up. Wireshark shows you this nested structure in its "packet details" panel.

2. IPv4 Addressing

2.1 IP Addresses and Notation

An IPv4 address is a 32-bit number written as four octets in decimal, separated by dots:

192.168.1.100
└─┘ └─┘ └┘ └─┘
 8   8   8   8 bits = 32 bits total

Range per octet: 0–255. Total possible IPv4 addresses: 2^32 = 4,294,967,296.

2.2 Subnetting and CIDR

CIDR (Classless Inter-Domain Routing) notation specifies an IP address and the number of bits that constitute the network prefix:

192.168.1.0/24
            └─ 24 bits = network prefix
               remaining 8 bits = host addresses
               → 254 usable host addresses (256 minus network and broadcast)

Common CIDR blocks:

Security relevance: Nmap scans, firewall rules, and network segmentation all use CIDR notation. "Scan the /24" means scan all 256 addresses in a subnet.

2.3 Special Addresses

3. TCP and UDP

3.1 TCP — Transmission Control Protocol

TCP provides reliable, ordered, connection-oriented communication. It guarantees delivery and correct ordering of data.

The TCP Three-Way Handshake:

Client                     Server
  │                           │
  │── SYN ──────────────────► │  "I want to connect"
  │◄─ SYN-ACK ─────────────── │  "OK, I acknowledge"
  │── ACK ──────────────────► │  "Confirmed, connection established"
  │                           │
  │═══════ data exchange ════ │
  │                           │
  │── FIN ──────────────────► │  "I'm done"
  │◄─ FIN-ACK ─────────────── │  "Acknowledged"

TCP flags (visible in Wireshark): - SYN — synchronise (start connection) - ACK — acknowledge receipt - FIN — finish (graceful close) - RST — reset (abrupt close or port closed) - PSH — push data to application immediately

Security relevance: - Port scanning uses TCP SYN packets (SYN scan / half-open scan) - A SYN with no SYN-ACK response = port is filtered (firewall dropping packets) - A RST response to SYN = port is closed - SYN-ACK response = port is open

3.2 UDP — User Datagram Protocol

UDP provides connectionless, unreliable, low-latency communication. No handshake, no acknowledgement, no guaranteed delivery.

When to use UDP: - DNS queries (short request/response, speed matters) - VoIP / video streaming (some packet loss is acceptable) - DHCP - NTP (time synchronisation) - Game state updates

Security relevance: - UDP is common in DoS amplification attacks (DNS amplification, NTP amplification) — send a small spoofed request that generates a large response directed at a victim - UDP scanning is slower and less reliable than TCP scanning

3.3 Ports

Ports are 16-bit numbers (0–65535) that allow a single IP address to host multiple services.

Critical ports for security practice:

4. Key Protocols in Detail

4.1 DNS — Domain Name System

DNS translates human-readable hostnames into IP addresses. It runs primarily over UDP on port 53 (falls back to TCP for large responses).

DNS resolution process:

Browser wants to connect to www.example.com

1. Check local cache
2. Query local DNS resolver (usually provided by router or ISP)
3. If not cached: resolver queries root nameserver (13 root servers globally)
4. Root refers to .com TLD nameserver
5. TLD refers to example.com authoritative nameserver
6. Authoritative nameserver returns A record: 93.184.216.34
7. Resolver caches and returns IP to browser

DNS record types:

Security attack vectors via DNS: - DNS spoofing / cache poisoning: inject false records into a resolver's cache - DNS tunnelling: encode data in subdomains (see COA path) - Zone transfer (AXFR): improperly configured servers return all DNS records — a free recon gift - Subdomain enumeration: guess or brute-force subdomains to discover infrastructure

# Zone transfer attempt (often fails if properly configured)
dig AXFR example.com @ns1.example.com

# Check SPF, DKIM, DMARC records
dig TXT example.com
dig TXT _dmarc.example.com

# Reverse DNS lookup
dig -x 93.184.216.34

4.2 HTTP and HTTPS

HTTP (HyperText Transfer Protocol) is the application protocol for web communication. It is request/response: client sends a request, server returns a response.

HTTP Request structure:

GET /login HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0
Accept: text/html
Cookie: session=abc123
Authorization: Basic dXNlcjpwYXNz

HTTP Response structure:

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Set-Cookie: session=new_token; HttpOnly; Secure
Content-Length: 1234

<html>...</html>

HTTP Methods:

HTTP Status Codes (security-relevant):

HTTPS: HTTP transported over TLS (Transport Layer Security). The TLS handshake occurs before any HTTP data is sent, establishing an encrypted channel. HTTPS protects data in transit but does not: - Guarantee the server is legitimate (certificates can be obtained for malicious domains) - Protect data that is logged server-side - Prevent attacks at the application layer (SQLi, XSS, etc.)

4.3 HTTP Basic Authentication

Basic Auth sends credentials in the Authorization header as Base64-encoded username:password:

Authorization: Basic dXNlcjpwYXNzd29yZA==

Decoding: echo "dXNlcjpwYXNzd29yZA==" | base64 -d → user:password

Why this matters: Basic Auth over HTTP sends credentials in cleartext (Base64 is not encryption). Anyone who can capture the traffic can trivially extract the credentials. Even over HTTPS, Basic Auth is inferior to modern token-based authentication because credentials are sent on every request.

5. Reading a PCAP File

PCAP (Packet Capture) files record network traffic. They are the primary evidence source in network forensics and the primary playground for network penetration testing.

5.1 Essential tshark Commands

# List all packets with timestamps and protocols
tshark -r capture.pcap

# Count packets by protocol
tshark -r capture.pcap -q -z io,phs

# Show only HTTP traffic
tshark -r capture.pcap -Y "http"

# Show only packets to/from a specific IP
tshark -r capture.pcap -Y "ip.addr == 192.168.1.100"

# Extract HTTP request URIs
tshark -r capture.pcap -Y "http.request" 
  -T fields -e ip.src -e http.request.method -e http.request.full_uri

# Find packets with Authorization headers
tshark -r capture.pcap -Y "http.authorization" 
  -T fields -e ip.src -e ip.dst -e http.authorization

# Follow a TCP stream (stream index 0)
tshark -r capture.pcap -q -z follow,tcp,ascii,0

5.2 Wireshark Display Filters

Wireshark uses a rich filter language. Essential patterns:

# Protocol filters
http
dns
tcp
udp
icmp
ftp
smtp

# IP address filters
ip.addr == 10.0.0.5          # traffic to or from
ip.src == 10.0.0.5           # traffic from only
ip.dst == 10.0.0.5           # traffic to only

# Port filters
tcp.port == 80
tcp.dstport == 443

# Combining filters
http && ip.src == 192.168.1.100
tcp.port == 80 || tcp.port == 443

# Finding credentials
http.authorization
ftp.request.command == "PASS"

5.3 Following TCP Streams

A TCP stream is the complete bidirectional conversation between two endpoints. In Wireshark: right-click any packet → Follow → TCP Stream. This reconstructs the full exchange as readable text, showing client data in one colour and server data in another.

In tshark: tshark -r file.pcap -q -z follow,tcp,ascii,<stream_id>

This is how you extract cleartext credentials from HTTP, FTP, Telnet, and SMTP traffic.

6. Common Mistakes

Mistake 1: Confusing ports and protocols. Port 80 typically runs HTTP, but any protocol can run on any port. An attacker running SSH on port 443 to evade firewall filtering is a real technique. Protocol identification should use Wireshark's dissection, not just port number.

Mistake 2: Thinking HTTPS means safe. HTTPS encrypts data in transit. It does not protect against application vulnerabilities, server misconfigurations, certificate misissuance, or the server itself logging plaintext data.

Mistake 3: Forgetting that Base64 is not encryption. Base64 is an encoding, not a cipher. It has no key. Anyone can decode it. HTTP Basic Auth, JWT headers, and email MIME parts use Base64. Calling it "encrypted" in a security report is a professional error.

Mistake 4: Reading IP addresses wrong in a PCAP. In a PCAP, always note both source and destination IP. An analyst who only records "192.168.1.100" without noting the direction of the connection may incorrectly attribute traffic.

Mistake 5: Ignoring UDP traffic. Many interesting events — DNS queries, DHCP, NTP, SNMP — are UDP. A PCAP analysis that filters to TCP only misses half the picture.

7. Guided Example — Extract Credentials from a PCAP

Step 1: Open the PCAP and assess what is inside

tshark -r capture.pcap -q -z io,phs

Look for HTTP in the protocol hierarchy.

Step 2: Filter for HTTP authentication traffic

tshark -r capture.pcap -Y "http.authorization" 
  -T fields -e frame.number -e ip.src -e ip.dst -e http.authorization

Expected output:

47   192.168.1.15   203.0.113.10   Basic dXNlcjpzM2NyZXRwYXNz

Step 3: Decode the Base64 credential

echo "dXNlcjpzM2NyZXRwYXNz" | base64 -d
# Output: user:s3cretpass

Step 4: Confirm in context by following the stream

tshark -r capture.pcap -q -z follow,tcp,ascii,2

Read the full HTTP exchange to understand what the client was accessing.

Step 5: Document the finding

Finding: HTTP Basic Authentication observed in cleartext
Source IP: 192.168.1.15
Destination: 203.0.113.10:80
Credentials recovered: user:s3cretpass
Frame: 47 (timestamp: 2026-06-08 14:32:17 UTC)
Impact: Credentials transmitted without encryption; any network observer can recover them
Remediation: Migrate endpoint to HTTPS; replace Basic Auth with token-based authentication

8. Practice Exercises

Before attempting the lab, work through these mentally or in a lab environment:

1. A Wireshark capture shows the following packet. Identify each field: Ethernet II, Src: 00:0c:29:ab:cd:ef, Dst: 00:50:56:e1:23:45 Internet Protocol Version 4, Src: 10.0.0.5, Dst: 54.230.1.10 Transmission Control Protocol, Src Port: 51234, Dst Port: 80, Flags: PSH, ACK Hypertext Transfer Protocol GET /api/users HTTP/1.1 Host: api.example.com Authorization: Basic YWRtaW46cGFzc3dvcmQ=
2. What layer is Ethernet II?
3. What is the source IP and destination IP?
4. What does the PSH flag mean?

5. What is the decoded credential from the Authorization header?

6. You open a PCAP and find DNS queries for names like aGVsbG8=.attacker.com, d29ybGQ=.attacker.com. What technique is likely being used? What data is being transmitted?

7. Write the Wireshark display filter that would show only TCP traffic on port 443 from IP address 172.16.0.50.

9. Lab

Assessment mode: flag

challenge_spec_id: 6 — PCAP credential extraction

You are given a PCAP file capture.pcap containing HTTP traffic with an embedded Basic Authentication exchange. Your task:

1. Open the PCAP with tshark or Wireshark
2. Filter for HTTP Authorization headers
3. Extract the Base64-encoded credential
4. Decode the credential
5. The decoded password is the flag in PREFIX{password} format

Recommended tools: tshark, Wireshark, base64 (CLI)

10. Framework Alignment

11. Further Reading

• RFC 791 — Internet Protocol (IPv4 specification — dry but authoritative)
• RFC 793 — Transmission Control Protocol (TCP specification)
• Wireshark User Guide — https://www.wireshark.org/docs/wsug_html_chunked/ — The reference manual
• Julia Evans — "How DNS Works" — https://jvns.ca/blog/2021/12/04/how-to-use-dig/ — Accessible deep dive into DNS
• Practical Packet Analysis (3rd ed.) — Chris Sanders — The most practical PCAP analysis book available
• Nmap Network Scanning — Gordon Fyodor Lyon — The authoritative reference; first chapters cover TCP/IP fundamentals from a scanning perspective

["Map each layer of the TCP/IP model to its security relevance and identify one attack that operates at each layer", "Explain subnetting and CIDR notation and calculate the number of usable hosts in a given /24 and /30 network", "Describe the TCP three-way handshake and explain how a SYN scan exploits the handshake process for port discovery", "Use tshark to filter a PCAP file for HTTP Authorization headers and decode a Base64 Basic Auth credential"]

Prerequisites → Why this matters → OSI model and TCP/IP stack (layers + security relevance) → IPv4 addressing and CIDR → TCP and UDP (handshake, flags, ports) → DNS internals → HTTP and HTTPS structure → HTTP Basic Auth in depth → PCAP reading with tshark and Wireshark → Common mistakes → Guided example (credential extraction) → Practice exercises → Lab (flag) → Framework alignment → Further reading