Skip to content

CNSP

TCP/IP (Protocols And Networking Basics)

OSI Model

  • OSI → Open Systems Interconnection
  • Layer 7: Application Layer → This is the only layer that directly interacts with data from the user.
    • Ex. HTTP, FTP, SMTP, DNS.
    • Your web browser uses HTTP to request the web page.
  • Layer 6: Presentation Layer → This layer is primarily responsible for preparing data so that it can be used by the application layer
    • Ex. Encryption (SSL/TLS), Data compression formats (JPEG, MPEG).
    • The web page data is encoded in HTML, and any necessary encryption (like HTTPS) is applied.
    • Responsible for translation, encryption, and compression of data.
  • Layer 5: Session Layer → Manages sessions or connections between applications. It establishes, maintains, and terminates connections.
    • Ex. Session management protocols, RPC (Remote Procedure Call).
    • A session is established between your browser and the web server.
  • Layer 4: Transport Layer → Ensures end-to-end communication and data integrity between devices. It provides reliable data transfer and error recovery.
    • Ex. TCP (Transmission Control Protocol), UDP (User Datagram Protocol).
    • TCP segments the HTTP request and ensures reliable delivery.
  • Layer 3: Network Layer → Manages the logical addressing and routing of data packets across different networks. It determines the best path for data transmission.
    • Ex. Routers, IP addresses (IPv4/IPv6)
    • IP packets are created with source and destination IP addresses and routed to the web server.
  • Layer 2: Data Link Layer → Ensures reliable transmission of data across the physical network by managing error detection and correction. It also handles MAC (Media Access Control) addresses.
    • Ex. Switches, Network Interface Cards (NICs), MAC addresses.
    • The IP packets are framed with MAC addresses for delivery on the local network segment.
  • Layer 1: Physical Layer → Deals with the physical connection between devices, including cables, switches, and the electrical signals transmitted.
    • Ex. Ethernet cables, Hubs, Wi-Fi.
    • The frames are transmitted as electrical signals over the network medium (e.g., Ethernet cable, Wi-Fi).

TCP/IP Model

  • A framework for computer network protocols used to interconnect network devices on the internet
  • Application Layer → This is the topmost layer where network applications and their protocols operate.
    • Ex. You use an email client, which relies on the SMTP protocol to send your email. The email client formats your message according to SMTP standards.
  • Transport Layer → This layer ensures the reliable transmission of data between hosts.
    • The email is divided into TCP segments. TCP ensures each segment is delivered accurately by handling sequencing, error checking, and retransmissions if necessary.
  • Internet Layer → Also known as the Network Layer, it handles the logical addressing and routing of packets to their destination
    • IP (Internet Protocol): Manages packet addressing and routing, ensuring data packets reach the correct destination across multiple networks. IPv4 and IPv6 are versions of IP used.
    • Each TCP segment is encapsulated in an IP packet with source and destination IP addresses. IP determines the best route for the packets to travel through various networks to reach the recipient's email server.
  • Network Access Layer → This is the lowest layer, responsible for the physical transmission of data over network media.
    • It includes protocols and hardware for data link and physical transmission, such as Ethernet and Wi-Fi.
    • The IP packets are converted into frames appropriate for the local network (e.g., Ethernet frames if using a wired connection or Wi-Fi frames if using a wireless connection). These frames are then transmitted over the physical medium to the next hop in the network.

IPv4 vs IPv6

  • IPv4 → 32 bits
    • Exhausted due to limited address space
    • IPv4 supports IPsec optionally.
  • IPv6 → 128 bits
    • Vast address space, unlikely to be exhausted
    • IPv6 has mandatory support for IPsec, providing enhanced security.

Network Discovery Protocols

  • ARP → Address Resolution Protocol
    • Resolves IP addresses to MAC addresses.
  • NDP → Neighbor Discovery Protocol
    • Used in IPv6 networks to discover other devices, determine their MAC addresses, and find routers.
    • Replacement of ARP in IPv6
    • NDP performs address autoconfiguration, duplicate address detection, and neighbor reachability.
  • ICMP → Internet Control Message Protocol
    • Used for diagnostic and error-reporting purposes.
    • Tools like ping and traceroute use ICMP to test connectivity and trace the path to a destination.
  • LLDP → Link Layer Discovery Protocol
    • Allows network devices to advertise their identity and capabilities.
    • Network administrators use LLDP to discover and map network topologies.
  • SNMP → Simple Network Management Protocol
    • Manages and monitors network devices.
    • Network management systems (NMS) use SNMP to gather information about network health, performance, and configuration.
  • mDNS → Multicast DNS
    • Resolves hostnames to IP addresses within local networks.
    • Apple’s Bonjour service uses mDNS for device discovery and service advertisement on local networks.
  • UPnP → Universal Plug and Play
    • Allows devices to automatically discover each other and establish services.
    • Home networks use UPnP for seamless device integration and communication (e.g., smart TVs, gaming consoles).
  • DHCP → Dynamic Host Configuration Protocol
    • Automatically assigns IP addresses and network configuration.
    • Routers use DHCP to assign IP addresses to devices on a network, ensuring no conflicts and simplifying configuration.

MCQs

  1. Which of the following is not an online attack? A. Brute force attack B. Rainbow table attack C. Password Spraying attack D. Phishing Attack → B. Rainbow table attack
  2. Which of the following protocol is not vulnerable to address spoofing attacks if implemented correctly? A. UDP B. ARP C. TCP D. IP → TCP
  3. Open TCP port not behind firewall → SYN & ACK
  4. Closed TCP port behind the firewall → RST & ACK
  5. Closed TCP port not behind firewall → RST & ACK