Networking Refresher

Layers, not magic

Networking is built as a stack of layers, each unaware of what's above or below it. The standard reference is the OSI model (seven layers), but everyone actually uses the TCP/IP model (four):

1. Link, the wire or radio. Ethernet, Wi-Fi.
2. Internet, routing packets between networks. IP.
3. Transport, conversations between programs. TCP, UDP, QUIC.
4. Application, what your program speaks. HTTP, SMTP, DNS.

Each layer takes the layer above's data and wraps it in a header. By the time a packet leaves your machine, it's an Ethernet frame containing an IP packet containing a TCP segment containing an HTTP request. Each layer's header is read by the matching layer at the destination.

IP: getting bytes across the world

The Internet Protocol moves packets from a source IP address to a destination IP address. It is best-effort: packets can be lost, reordered, or duplicated. IP doesn't promise anything beyond "I'll try."

Two versions are in use: IPv4 (32-bit addresses, written like 192.0.2.10) and IPv6 (128-bit addresses, written like 2001:db8::42). They coexist; most devices speak both.

TCP and UDP: shaping the conversation

The transport layer turns IP's best-effort packets into something a program can use.

• TCP is a reliable, ordered byte stream. It retransmits losses, throttles to avoid congestion, and presents the data in order. Web, email, SSH, almost everything.
• UDP is fire-and-forget datagrams. No retries, no ordering. Use when you can tolerate loss or want to handle it yourself: DNS lookups, real-time voice and video.
• QUIC is a newer protocol that runs over UDP, providing TCP-like reliability plus built-in encryption. It's what HTTP/3 uses.

Ports

An IP address gets you to the right machine. A port gets you to the right program on that machine. Ports are 16-bit numbers (0 to 65535). A few well-known ones:

• 80, HTTP
• 443, HTTPS
• 53, DNS
• 22, SSH
• 25 / 465 / 587, SMTP variants

A network conversation is identified by the five-tuple: source IP, source port, destination IP, destination port, and protocol (TCP or UDP). Two browser tabs to the same site use the same destination but different source ports, which is how the OS knows which packet belongs to which tab.

NAT: more devices than IPs

IPv4 ran out of addresses years ago. Network Address Translation is the workaround: your home router hands all your devices private IPs and rewrites packets so the outside world sees one public IP. Replies are routed back by matching against the NAT table.

NAT is not a security feature, despite being treated like one. It makes some attacks slightly harder simply by hiding internal addresses; it does not replace a firewall.

DNS: turning names into addresses

Humans don't want to remember 140.82.121.4; they want github.com. The Domain Name System resolves names to IP addresses through a hierarchy of servers (root → TLD → authoritative).

DNS is the unglamorous backbone of everything else. Take it down or poison it, and the internet effectively goes dark. That makes it a permanent attack target:

• Cache poisoning: feed false records into a recursive resolver.
• Hijacking: trick a domain registrar into pointing the domain elsewhere.
• Eavesdropping: plain DNS is unencrypted; anyone on path sees every site you visit.

The modern fixes: DNSSEC (signs DNS records), DNS over TLS and DNS over HTTPS (encrypts the queries). Adoption is uneven but growing.