Networking Fundamentals: OSI Model, TCP/IP, Protocols & Ports Link to heading

OSI (Open Systems Interconnection) Model Link to heading

The OSI model is a seven-layer framework that explains how data travels across a network. Each layer serves a specific function and helps in troubleshooting networking issues.

OSI Layers Link to heading

  1. Physical Layer

    • Cables, hardware transmission, electrical signals

  2. Data Link Layer

    • MAC addresses, local network delivery

  3. Network Layer

    • IP addressing, routing

  4. Transport Layer

    • TCP/UDP, error handling, flow control

  5. Session Layer

    • Session management, communication sessions

  6. Presentation Layer

    • Encryption, compression, data formatting

  7. Application Layer

    • Protocols, applications, email, file transfers

Encapsulation & Decapsulation:
Data is wrapped with headers as it moves down the stack and unwrapped as it moves back up.

TCP/IP Model Link to heading

The TCP/IP model is the practical backbone of modern networking, simpler than OSI but widely used.

SOC Example: Log Mapping Link to heading

When analyzing logs, SOC analysts map activity to OSI layers.

Example: HTTPS Login

  • Application Layer → HTTPS login
  • Transport Layer → Port 443
  • Network Layer → External IP address
  • Data Link Layer → Internal network

Troubleshooting by Layer:

  • Port issue → Transport layer
  • IP issue → Network layer
  • DNS issue → Application layer
  • ARP issue → Data link layer

Protocols Link to heading

Protocols are rules for data communication. Examples: HTTP, DNS, FTP.

Ports Link to heading

A port is a digital doorway directing traffic to the right application.

  • Example: Port 443 = HTTPS

Analogy: Port = door, Protocol = person walking through the door.

Protocols by OSI Layer Link to heading

  • Application Layer: HTTP, HTTPS, DNS, FTP
  • Transport Layer: TCP, UDP
  • Network Layer: IP
  • Data Link Layer: Ethernet, WiFi

HTTP & HTTPS Link to heading

Common HTTP Methods Link to heading

  • GET → Fetch data
  • POST → Send data
  • PUT → Update resources
  • DELETE → Remove resources
  • PATCH → Partial updates

HTTP Status Codes Link to heading

  • 200 OK → Success
  • 301 Redirect → Resource moved
  • 400 Bad Request → Invalid syntax
  • 401 Unauthorized → Authentication required
  • 403 Forbidden → Access denied
  • 404 Not Found → Resource missing
  • 500 Server Error → Internal issue

HTTPS = HTTP + SSL/TLS encryption (Port 443)
Provides confidentiality, integrity, authenticity.

Without encryption, risks include:

  • MITM attacks
  • Credential sniffing
  • Plaintext exposure

DNS (Domain Name System) Link to heading

DNS translates domain names → IP addresses (Port 53).

DNS Resolution Process Link to heading

  1. Browser cache
  2. OS cache
  3. Resolver (ISP)
  4. Root server
  5. TLD server
  6. Authoritative nameserver

Windows DNS Configuration:
Control Panel → Network & Sharing → WiFi → Properties → IPv4 → Settings

DNS Query Types Link to heading

  • Iterative
  • Recursive

SOC Indicators Link to heading

  • Too many requests → DNS spraying
  • Suspicious domains → DNS tunneling
  • Random subdomains → Domain Generation Algorithm (DGA)

FTP & SFTP Link to heading

  • FTP (Port 21): File sharing, insecure (plaintext)
  • SFTP (Port 22): Secure file transfer over SSH

SOC Indicators:

  • Large file transfers
  • Unknown uploads
  • Anonymous logins

Common Attacks:

  • Credential sniffing
  • Data exfiltration
  • Brute-force attempts

Email Protocols Link to heading

  • SMTP (Port 25): Send emails, insecure
  • Secure SMTP (Port 587): Encrypted
  • POP3: Receive emails

SOC Indicators:

  • Bulk email sending
  • Unknown domains
  • Spoofing

Common Attacks:

  • Phishing
  • Spam campaigns
  • Email spoofing

SSH (Secure Shell) Link to heading

  • Port 22
  • Secure remote login

SOC Indicators:

  • Multiple failed logins
  • Unusual IP logins
  • Root login attempts

Common Attacks:

  • Brute-force
  • Credential theft
  • Unauthorized access

RDP (Remote Desktop Protocol) Link to heading

  • Port 3389
  • Remote control of Windows systems

SOC Indicators:

  • Odd-hour logins
  • Multiple attempts
  • External IP logins

Common Attacks:

  • Brute-force
  • Lateral movement
  • Ransomware entry

SMB (Server Message Block) Link to heading

  • Port 445
  • File sharing in Windows

SOC Indicators:

  • Admin share access
  • File transfers across systems
  • Lateral movement

Common Attacks:

  • EternalBlue exploit
  • SMB relay attacks

Port Ranges Link to heading

  • Well-known ports: 0–1023
  • Registered ports: 1024–49151
  • Dynamic/private ports: 49152–65535

Real SOC Log Scenario Link to heading

Log Example:

  • Source IP: x.x.x.x
  • Destination IP: x.x.x.x
  • Port: 3389
  • Attempts: 500
  • Status: Failed

Analysis:
This is an RDP brute-force attack due to repeated failed login attempts on port 3389.