Chapter 1 — The OSI Model
The OSI (Open Systems Interconnection) model has 7 layers. Security happens at every layer — knowing where an attack targets tells you how to defend it.
# OSI Layers (remember: "Please Do Not Throw Sausage Pizza Away")
7 Application → HTTP, HTTPS, FTP, SSH, DNS, SMTP
6 Presentation → SSL/TLS, encryption, compression, JPEG
5 Session → Session management, NetBIOS, RPC
4 Transport → TCP, UDP — port numbers live here
3 Network → IP addresses, routing, ICMP, OSPF
2 Data Link → MAC addresses, Ethernet, switches, ARP
1 Physical → Cables, hubs, radio waves
# Security attacks by layer:
L7 → SQLi, XSS, web app attacks
L6 → SSL stripping, certificate attacks
L5 → Session hijacking
L4 → SYN flood, port scanning
L3 → IP spoofing, ICMP attacks
L2 → ARP poisoning, MAC flooding, VLAN hopping
L1 → Physical access, cable tapping
# Data encapsulation as it travels DOWN the stack:
L7: Data
L4: Segment (TCP) / Datagram (UDP)
L3: Packet (adds IP header)
L2: Frame (adds MAC header + FCS)
L1: BitsChapter 2 — TCP/IP Model
# Practical 4-layer model used in the real world:
Application → OSI 5,6,7 → HTTP, DNS, SMTP, FTP
Transport → OSI 4 → TCP, UDP
Internet → OSI 3 → IP, ICMP, ARP
Network Access→ OSI 1,2 → Ethernet, WiFi
# The protocol stack for visiting kalirange.com:
1. DNS query → resolves kalirange.com to IP
2. TCP 3-way handshake to IP:443
SYN → SYN-ACK → ACK
3. TLS handshake → encrypted tunnel
4. HTTP GET / request
5. Server sends HTML responseChapter 3 — IP Addressing
# IPv4 address = 32-bit number, written as 4 octets
192.168.1.100
│ │ │ └── Host portion (which device)
│ │ └──── Network portion (which subnet)
└───┴───────── Must match for hosts to communicate directly
# Private IP ranges (not routable on internet):
10.0.0.0/8 → 10.0.0.0 – 10.255.255.255
172.16.0.0/12 → 172.16.0.0 – 172.31.255.255
192.168.0.0/16 → 192.168.0.0 – 192.168.255.255
# Special addresses:
127.0.0.1 → Loopback (yourself)
169.254.x.x → APIPA (no DHCP server found)
0.0.0.0 → Default route / unspecified
255.255.255.255 → Limited broadcast
# CIDR notation:
192.168.1.0/24 → subnet mask 255.255.255.0 → 254 hosts
192.168.1.0/25 → subnet mask 255.255.255.128 → 126 hosts
10.0.0.0/8 → subnet mask 255.0.0.0 → 16,777,214 hostsChapter 4 — Subnetting
# Subnetting = dividing a network into smaller pieces
# Formula: usable hosts = 2^(host bits) - 2
# Quick prefix → hosts reference:
/24 → 254 hosts (255.255.255.0)
/25 → 126 hosts (255.255.255.128)
/26 → 62 hosts (255.255.255.192)
/27 → 30 hosts (255.255.255.224)
/28 → 14 hosts (255.255.255.240)
/29 → 6 hosts (255.255.255.248)
/30 → 2 hosts (255.255.255.252) ← point-to-point links
# Example: subnet 192.168.1.0/26
Network: 192.168.1.0
First host: 192.168.1.1
Last host: 192.168.1.62
Broadcast: 192.168.1.63
Hosts: 62
# VLSM (Variable Length Subnet Masking) — subnet efficiently
# Given: 192.168.1.0/24 — allocate subnets for:
# Department A: 100 hosts → /25 (126 hosts) → 192.168.1.0/25
# Department B: 50 hosts → /26 (62 hosts) → 192.168.1.128/26
# Department C: 25 hosts → /27 (30 hosts) → 192.168.1.192/27
# Links: 2 hosts → /30 (2 hosts) → 192.168.1.224/30Chapter 5 — TCP vs UDP
# TCP — Transmission Control Protocol
Reliable: YES (retransmits lost packets)
Ordered: YES (packets arrive in sequence)
Flow ctrl: YES (won't overwhelm receiver)
Speed: SLOWER (overhead of acknowledgements)
Use case: HTTP, HTTPS, SSH, FTP, SMTP, databases
# TCP 3-way handshake:
Client → SYN → Server "I want to connect"
Client ← SYN-ACK ← Server "OK, I'm ready"
Client → ACK → Server "Great, let's talk"
# UDP — User Datagram Protocol
Reliable: NO (fire and forget)
Ordered: NO
Flow ctrl: NO
Speed: FASTER (no overhead)
Use case: DNS, DHCP, VoIP, gaming, video streaming, NTP
# Security implications:
SYN flood → attacker sends thousands of SYN packets, never completes handshake
→ server fills half-open connection table → DoS
UDP flood → sends UDP to random ports → server sends ICMP unreachable for eachChapter 6 — Common Protocols & Ports
| Port | Protocol | Use | Security Note |
|---|---|---|---|
| 21 | FTP | File transfer | Credentials in plaintext! Use SFTP instead |
| 22 | SSH | Secure shell | Encrypted. Change default port, use key auth |
| 23 | Telnet | Remote shell | Plaintext! Never use in production |
| 25 | SMTP | Email sending | Relay abuse, spam, phishing |
| 53 | DNS | Name resolution | DNS poisoning, zone transfer leaks |
| 80 | HTTP | Web (unencrypted) | MITM, session hijacking. Use HTTPS |
| 443 | HTTPS | Web (encrypted) | Check SSL/TLS version, certificate validity |
| 445 | SMB | Windows file sharing | EternalBlue, WannaCry — always patch |
| 3306 | MySQL | Database | Never expose to internet |
| 3389 | RDP | Windows remote desktop | BlueKeep, brute-force — restrict access |
Chapter 7 — DNS Deep Dive
# DNS resolves domain names → IP addresses
# When you type "kalirange.com":
1. Browser checks local cache
2. Check /etc/hosts (Linux) or hosts file (Windows)
3. Query local DNS resolver (usually your router: 192.168.1.1)
4. Router queries Recursive DNS (8.8.8.8 or ISP's)
5. Recursive DNS asks Root DNS (13 root servers worldwide)
6. Root DNS refers to .com TLD server
7. TLD server refers to kalirange.com's authoritative DNS
8. Authoritative DNS returns the IP: 1.2.3.4
9. Your browser connects to 1.2.3.4:443
# DNS record types:
A → Domain to IPv4: kalirange.com → 1.2.3.4
AAAA → Domain to IPv6
CNAME → Alias: www → kalirange.com
MX → Mail server
TXT → Arbitrary text (SPF, DKIM, verification)
NS → Nameserver for the domain
PTR → Reverse DNS: IP → domain
SOA → Start of Authority
# DNS queries from command line:
dig kalirange.com # A record
dig kalirange.com MX # mail servers
dig kalirange.com NS # nameservers
dig @8.8.8.8 kalirange.com # query specific DNS server
# Zone transfer (security misconfiguration):
dig axfr @ns1.target.com target.com
# If allowed → dumps ALL DNS records (subdomains, internal hosts)Chapter 8 — HTTP/S Deep Dive
# HTTP methods:
GET → retrieve a resource (no body)
POST → send data (login, forms)
PUT → replace a resource
PATCH → partially update
DELETE → remove a resource
HEAD → like GET but no response body
OPTIONS→ what methods are allowed?
# HTTP status codes:
1xx → Informational (100 Continue)
2xx → Success (200 OK, 201 Created, 204 No Content)
3xx → Redirect (301 Moved, 302 Found, 304 Not Modified)
4xx → Client Error (400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found)
5xx → Server Error (500 Internal Server Error, 503 Service Unavailable)
# Security headers (check with curl -I):
Strict-Transport-Security → force HTTPS
Content-Security-Policy → restrict JS sources (XSS mitigation)
X-Frame-Options → prevent clickjacking
X-Content-Type-Options → prevent MIME sniffing
Referrer-Policy → control referrer header
Permissions-Policy → control browser features
# Check security headers:
curl -I https://kalirange.comChapter 9 — Routing Basics
# Routers connect different networks (Layer 3)
# Switches connect devices within a network (Layer 2)
# Routing table decision process:
1. Match destination IP against routing table entries
2. Use MOST SPECIFIC match (longest prefix)
3. If tie → use lowest Administrative Distance
4. If still tie → use lowest metric
# Static vs Dynamic routing:
Static → manually configured, no overhead, doesn't adapt
OSPF → Link State, fast convergence, scales well (enterprise)
EIGRP → Cisco proprietary, fast, uses bandwidth+delay metric
RIP → old, slow, max 15 hops, don't use in production
BGP → internet routing protocol (between ISPs)
# Linux routing table:
ip route show
default via 192.168.1.1 dev eth0 ← default gateway
192.168.1.0/24 dev eth0 proto kernel ← directly connected
# Add a route on Linux:
sudo ip route add 10.0.0.0/8 via 192.168.1.1Chapter 10 — Switching
# Switches forward frames based on MAC address table
# They LEARN MAC addresses from incoming frames
# Switch process for incoming frame:
1. Record Source MAC + port → add to MAC table
2. Look up Destination MAC in table:
→ Found: forward only to that port (unicast)
→ Not found: flood to all ports except source (unknown unicast)
→ Broadcast: flood to all ports except source
# VLANs (Virtual LANs):
Logically separate devices on same physical switch
VLAN 10: Sales (192.168.10.0/24)
VLAN 20: IT (192.168.20.0/24)
VLAN 30: Servers (192.168.30.0/24)
Traffic between VLANs must go through a router (inter-VLAN routing)
# Access vs Trunk ports:
Access port → belongs to ONE VLAN, used for devices (PCs, printers)
Trunk port → carries MULTIPLE VLANs (between switches, router-on-stick)
# 802.1Q VLAN tagging (trunk links):
Ethernet frame + 4-byte VLAN tag added on trunk ports
Tag removed when frame exits to access port (device never sees it)Chapter 11 — Firewalls & NAT
# Firewall types:
Packet Filter → simple, checks IP/port/protocol, no state
Stateful Firewall → tracks connection state (knows if packet is part of existing connection)
NGFW → Next-Gen: also inspects application layer, IPS, SSL inspection
WAF → Web Application Firewall: HTTP-specific rules (SQLi, XSS)
# iptables (Linux firewall):
sudo iptables -L -n -v # list rules
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT # allow SSH
sudo iptables -A INPUT -j DROP # block all other incoming
# NAT (Network Address Translation):
Problem: private IPs (192.168.x.x) are not routable on internet
NAT: router translates private IP:port → public IP:port
# NAT types:
Static NAT → one private IP ↔ one public IP (one-to-one)
PAT/NAT → many private IPs → one public IP (many-to-one) = home router
different source ports used to track connections
# Check your public IP:
curl ifconfig.me
curl icanhazip.comChapter 12 — Network Security
# Common network attacks and defences:
# ARP Poisoning (MITM):
Attack: attacker sends fake ARP replies → "I am the gateway"
→ all traffic routed through attacker
Defence: Dynamic ARP Inspection (DAI) on switches
Static ARP entries for critical hosts
# VLAN Hopping:
Attack 1: Switch Spoofing → attacker's switch negotiates trunk with real switch
Attack 2: Double Tagging → packet has two VLAN tags; outer removed at first switch
Defence: set all access ports to "switchport mode access" (never auto/dynamic)
use a dedicated native VLAN with no devices on it
# Network monitoring:
wireshark # GUI packet capture
tcpdump -i eth0 # CLI packet capture
tcpdump -i eth0 port 80 # filter HTTP
tcpdump -i eth0 host 8.8.8.8 # filter by host
tcpdump -w capture.pcap # save to fileWorkbook Complete! Networking is the foundation of everything in security. You can't attack or defend what you don't understand. Read Computer Networks by Tanenbaum for even deeper knowledge.