Connect and Protect: Networks and Network Security
Architecture and models
The OSI model has seven layers (Physical, Data Link, Network, Transport, Session, Presentation, Application); the TCP/IP model compresses them to four (Network Access, Internet, Transport, Application). Map layers when a question asks where a device or attack sits: hubs and switches work with MAC addresses at the data-link layer; routers direct traffic by IP address at the network layer; TCP/UDP carry data at transport; HTTP, DNS, and TLS live at the application layer. Encapsulation wraps data as it descends the stack; TCP opens a three-way handshake (SYN, SYN-ACK, ACK).
Know the common ports: 20/21 FTP, 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS, 3389 RDP. DHCP assigns addresses, DNS resolves names, ARP maps IPs to MACs on a local network, and CIDR notation describes subnets.
Defenses
A stateful firewall tracks connection state; a stateless one inspects packets in isolation; a next-generation firewall adds deep packet inspection and intrusion prevention. IDS detects and alerts; IPS detects and blocks. A VPN encrypts traffic in a tunnel; a proxy brokers requests and hides internal addresses; a DMZ isolates public-facing services. Network segmentation, hardened baselines, and zero trust (verify everything, trust nothing by default) limit blast radius.
Attacks
DoS and DDoS (SYN flood, ICMP flood, ping of death), on-path attacks, smurf attacks, backdoors, and social-engineered access.
Traps
Questions swap switches and routers, IDS and IPS, stateful and stateless, and the layer counts of OSI versus TCP/IP.
Rule of thumb
Identify the layer first - device, protocol, and attack all follow from it. Data link means MAC, network means IP, transport means port.