Session 5: Networking Fundamentals — Part 1

Programme: Cyber Security Technologist Level 4
Session type: Tutor-led learning
Topic: Networking Fundamentals

Session overview

This session introduced the fundamental principles of computer networking, including network components, communication protocols, geographical network scope, the OSI model, IP and MAC addressing, and common networking services.

We also explored how these concepts relate to cybersecurity, concluding with an example of a MAC flooding attack against a network switch.

The session is the first of two Networking Fundamentals sessions scheduled this week. CompTIA Security+ learning is due to begin the following week. The exam version has not yet been confirmed; this entry makes no claim about specific exam objectives.

Previous entry: Session 4: Governance, Risk and Compliance — In Depth.

1. What is a computer network?

We began by discussing possible definitions of a network.

A computer network is a collection of interconnected devices that communicate and exchange data using agreed rules called protocols.

Networks enable devices to share information, resources and services, including files, printers, applications and internet connectivity.

Hosts and nodes

Devices participating in a network are commonly called nodes or hosts.

• Node: A device or connection point participating in a network, such as a computer, switch or router.
• Host: A network-connected endpoint that can send or receive data, such as a laptop, smartphone or server.

All hosts are nodes, but not all nodes are necessarily end hosts.

Four basic elements of network communication

The tutor identified four important elements:

These elements work together to enable communication between devices.

Cybersecurity connection: Networks are a major attack surface. Many cyberattacks use network communication, although some attacks can occur without a network, such as the use of an infected USB drive on an isolated computer.

For the roles of switches, routers, servers and endpoints, see What Is a Network?. The earlier Study Buddy networking discussion remains a separate supplementary learning record.

2. Network protocols

A network protocol is a set of agreed rules that devices follow when exchanging data.

The tutor compared protocols to a shared language: devices require compatible protocols to communicate successfully.

Different protocols define different aspects of communication, including data formatting, addressing, transmission, error handling and interpretation.

Devices do not necessarily need identical networking technologies. For example, a laptop using Wi-Fi can communicate with a server using Ethernet because they support compatible higher-layer protocols.

How HTTPS works

We explored HTTPS as an example of protocols working together.

HTTPS is HTTP secured using Transport Layer Security (TLS).

A simplified HTTPS connection using TCP involves:

1. The browser resolves the destination’s IP address, using DNS when necessary.
2. A TCP connection is established, typically to destination port 443.
3. The browser and server perform a TLS handshake to authenticate the server and establish cryptographic keys.
4. The browser sends its encrypted HTTP request.
5. The server processes the request and returns an encrypted response.

Modern HTTP/3 uses QUIC over UDP rather than TCP.

Key distinction: HTTP defines web requests and responses; TLS provides encryption, integrity protection and authentication. Lower-layer protocols handle addressing, transport and transmission.

3. Network Interface Cards (NICs)

A NIC provides the hardware interface that allows a device to connect to a network.

Examples include wired Ethernet adapters and wireless Wi-Fi adapters.

NICs operate primarily at the Physical and Data Link layers of the OSI model.

An Ethernet or Wi-Fi interface typically uses a MAC address for local link-layer communication.

NICs can be integrated into a motherboard, installed as expansion cards or connected externally.

4. Geographical scope of networks

We discussed four classifications of networks according to their geographical scope.

A LAN can use wired or wireless technologies. Multiple LANs may be interconnected through a WAN.

The internet is a global network of interconnected networks and is commonly used as an example of wide-area networking.

These categories represent general scope rather than fixed geographical distance limits.

5. Communication methods

We explored three ways of directing network traffic.

Unicast — One to one

Communication between one sender and one intended recipient.

Example: A browser communicating with a web server.

Multicast — One to a selected group

Communication directed to a group of interested receivers.

Example: Distributing an IP multicast video stream to multiple devices.

Broadcast — One to all within a broadcast domain

Communication directed to every device in the relevant broadcast domain.

Example: An IPv4 ARP request.

Broadcast traffic is generally limited to a local broadcast domain, often a VLAN. Routers do not normally forward ordinary local broadcasts.

DHCP

Dynamic Host Configuration Protocol automatically provides IP configuration, including an IP address, subnet mask, default gateway and DNS server information.

The initial IPv4 DHCP process is commonly remembered using DORA:

• Discover — The client looks for a DHCP server.
• Offer — A server offers configuration.
• Request — The client requests an offered configuration.
• Acknowledge — The server confirms the lease.

DHCP uses UDP ports 67 (server) and 68 (client).

The initial Discover and Request messages are typically broadcast. Offer and Acknowledgement messages may be broadcast or unicast, depending on the circumstances.

DHCP relay agents can enable clients to communicate with servers on other subnets.

Layer distinction: DHCP is an application-layer protocol. Its use of broadcast does not make it a Data Link layer protocol.

ARP

Address Resolution Protocol resolves an IPv4 address to an associated link-layer address, normally a MAC address on an Ethernet network.

An ordinary ARP request is broadcast, while the reply is normally unicast.

ARP is discussed in greater detail in the MAC addressing section below.

6. The OSI model

The Open Systems Interconnection model divides networking functions into seven conceptual layers.

We studied the layers from the top down.

My Baldur’s Gate 3 mnemonic

All Players Should Take New Defensive Positions.

The OSI model is a reference framework. Real-world protocols do not always map neatly to a single layer.

TLS, for example, is commonly associated with Layer 6 because it provides encryption, but it is not a complete implementation of the OSI Presentation layer.

Ethernet and Wi-Fi both contain Physical and Data Link functions.

Encapsulation

As information moves down the networking stack, applicable layers add their own control information.

The receiving device processes the information through the corresponding layers, a process called decapsulation.

Cybersecurity connection: Understanding the OSI layers helps identify where networking failures, security controls and attacks occur.

7. IP addressing, gateways and NAT

IP and MAC addresses

An IP address provides logical addressing for communication across IP networks.

A MAC address provides link-layer addressing for local frame delivery.

IPv4 addresses are 32 bits long, while IPv6 addresses are 128 bits long.

Public and private IPv4 addresses

Private IPv4 addresses are used within private networks, such as home, school and business networks.

Public IPv4 addresses are globally routable on the public internet, subject to routing and access controls.

An ISP typically assigns a public-facing IP address to a home router, although Carrier-Grade NAT can change this arrangement.

Private IPv4 ranges

These are the RFC 1918 private address ranges.

Class A, B and C are historical classful addressing categories. Modern networks use Classless Inter-Domain Routing (CIDR) and subnet masks. The RFC 1918 blocks are not themselves three complete traditional classful networks.

IPv6

IPv6 does not use Class A, B or C networks.

Important IPv6 address types include:

• Global unicast — Typically within 2000::/3.
• Unique local — fc00::/7, used for internal addressing.
• Link-local — fe80::/10, used for local-link communication.
• Loopback — ::1/128.
• Multicast — ff00::/8.

The commonly used locally assigned unique local addresses begin with fd.

IPv6 uses Neighbour Discovery Protocol rather than ARP.

Gateways and default gateways

A gateway connects networks or provides communication between systems.

A default gateway is the next-hop router used when a computer has no more specific route to the destination.

For example, a laptop with IP address 192.168.1.10/24 may use a router at 192.168.1.1 as its default gateway.

Traffic to a destination on the same subnet can normally be delivered locally. Traffic to a remote destination is forwarded towards the gateway.

Network Address Translation (NAT)

NAT modifies IP address information as packets pass between networks.

In a typical home IPv4 network, NAT combined with Port Address Translation (PAT) allows multiple privately addressed devices to share one public-facing IPv4 address.

The router maintains translation mappings so that returning traffic can be delivered to the appropriate device.

Common NAT types include static NAT, dynamic NAT and PAT/NAT overload.

NAT is not itself a firewall and is not a substitute for one. This distinction connects to Defence in Depth: different controls serve different purposes.

8. MAC addresses and ARP

A conventional Ethernet MAC address is 48 bits long and written in hexadecimal.

A MAC address is often manufacturer-assigned, but it can also be locally administered, randomised or spoofed.

How ARP works

When an IPv4 device wants to communicate with another device on its local subnet:

1. It checks whether the required IP-to-MAC mapping is already known.
2. If necessary, it broadcasts an ARP request asking which device owns the destination IPv4 address.
3. The target device normally replies with its MAC address using unicast.
4. The sender records the mapping in its ARP cache.
5. The sender can address Ethernet frames to the destination MAC address.

If the target is on a remote subnet, the sender typically resolves the MAC address of its next-hop router instead.

ARP operates at the boundary between Layer 2 and Layer 3 and is commonly associated with Layer 2 in networking fundamentals. It resolves Layer 3 addressing information for local Layer 2 delivery.

Cybersecurity connection: ARP does not authenticate ordinary ARP messages, making ARP spoofing or ARP poisoning possible.

9. Protocols, ports and sockets

The tutor explained how protocols, ports and sockets relate to application communication.

Protocols

A protocol defines rules governing how data is exchanged.

Logical ports

TCP and UDP ports are 16-bit identifiers used to distinguish communication endpoints.

Common examples:

The port ranges are:

• 0–1023: Well-known ports.
• 1024–49151: Registered ports.
• 49152–65535: Dynamic/private ports.

Sockets

A socket is an operating-system-managed software endpoint through which an application sends or receives network data.

A TCP connection is distinguished by its source and destination IP addresses and ports, together with its transport protocol.

For example, an illustrative connection could be:

192.168.1.10:51542 → 203.0.113.10:443

TCP establishes a connection using the three-way handshake: SYN, SYN-ACK and ACK.

Logical versus physical switch ports

A TCP/UDP port is a logical transport-layer identifier.

A switch port is a physical network interface used to connect a device to a switch.

A conventional Layer 2 switch generally forwards Ethernet frames using MAC addresses, rather than the TCP or UDP destination port number.

10. MAC flooding and switch security

The session concluded with a discussion of an attack that can make a switch behave somewhat like a hub.

This is known as MAC flooding, or a CAM table overflow attack.

Normal switch operation

A Layer 2 switch learns source MAC addresses and associates them with physical ports in its MAC address table.

When the destination MAC address is known, the switch can forward a unicast frame to the appropriate port.

MAC flooding

An attacker can send numerous frames containing fabricated source MAC addresses.

If the switch’s MAC address table becomes exhausted, the switch may be unable to learn additional legitimate MAC addresses.

Traffic addressed to unknown destinations may then be flooded out of multiple ports within the affected VLAN.

This potentially exposes traffic to other connected devices and can cause network disruption.

Important technical distinction

A switch does not literally turn into a hub. It may continue to forward traffic for known addresses normally.

The hub analogy describes the increased flooding of unknown unicast traffic.

Defences

A primary defence on supported managed switches is switch port security, which can restrict the number of MAC addresses learned on an access port and define an action when the limit is exceeded.

Monitoring abnormal MAC address learning and applying appropriate switch security controls can also help.

Cybersecurity takeaway: MAC flooding demonstrates how exploiting Layer 2 behaviour can affect both network confidentiality and availability, two elements of the CIA Triad.

Session reflection

This session strengthened my understanding of how network communication works, from applications and protocols through to addressing, switching and transmission media.

The discussions helped connect theoretical networking concepts with practical examples, including how HTTPS establishes secure communication, how NAT enables internet access for privately addressed devices, and how ARP and MAC addresses support local communication.

Exploring MAC flooding also illustrated how normal networking mechanisms can be abused by an attacker.

These concepts provide foundational knowledge for further cybersecurity study and the forthcoming CompTIA Security+ material.

This entry records tutor-led learning and discussion, not completed network configuration labs or attack exercises.

Further revision

Areas to revisit and practise include:

• Recalling all seven OSI layers and their functions.
• Memorising the three RFC 1918 private IPv4 ranges.
• Explaining the differences between DHCP, ARP, DNS and NAT.
• Distinguishing IP addresses, MAC addresses, ports and sockets.
• Understanding the TCP three-way handshake.
• Explaining MAC flooding and the purpose of switch port security.

The Networking & Protocols revision topic now includes the Session 5 questions and flashcards alongside the earlier Study Buddy material. These provide learning-only practice for selected foundations; they do not cover every detail or establish verified exam alignment.

For the extended educational explanations from my ChatGPT note-taking discussion, start with What Is a Network?, the first lesson of the Networking Fundamentals module, which continues through the worked HTTPS, DHCP/ARP, forwarding/NAT/PAT and switching lessons. These expand the explanations without representing additional completed practical work.

Next session: Session 6: Networking Fundamentals — Part 2, Thursday, 24 September 2026.