Networking & Security Fundamentals Link to heading

IP Address Basics Link to heading

An IP address is a unique numerical identifier assigned to every device on a network.

  • Communication occurs through IP packets.
  • Data is broken into packets, sent, and reassembled at the destination.
  • Each packet has a header (control info) and payload (data).

Encapsulation Process:
Data moves down the OSI stack → each layer adds its own header (Ethernet, IP, TCP, Application).

Packet Details Include:

  • Source IP
  • Destination IP
  • Protocol type (e.g., TCP)
  • TTL (Time to Live)
  • Packet length

Key Networking Concepts Link to heading

  • Hop: Jump a packet makes from one router to the next.
  • RTT (Round Trip Time): Time for a packet to travel to destination and back.
  • TTL (Time to Live): Limits packet lifetime; decremented by each router.

TCP 3-Way Handshake Link to heading

TCP establishes reliable connections using a three-step process:

  1. Client → SYN packet
  2. Server → SYN-ACK packet
  3. Client → ACK packet

TCP Flags Link to heading

  • SYN: Initiates connection
  • ACK: Confirms receipt
  • FIN: Gracefully ends connection
  • RST: Abruptly ends connection
  • PSH: Forces immediate delivery
  • URG: Marks priority data

Suspicious Patterns (SOC Indicators) Link to heading

  • SYN packets only → Possible SYN Flood
  • SYN + FIN together → Malicious scanning
  • RST Flood → DoS activity
  • No ACK responses → Half-open attack

Routers Link to heading

Routers connect networks and direct traffic.
Functions:

  • Routing packets by destination IP
  • NAT (map private IPs to public)
  • Maintain routing tables

SOC Indicators:

  • Traffic to malicious IPs
  • Unusual outbound connections
  • Data exfiltration patterns

Switches Link to heading

Switches connect devices in a LAN using MAC addresses.

  • Operate at Data Link Layer
  • Forward data only to destination device

SOC Indicators:

  • Internal movement of data
  • MAC anomalies

Threats:

  • ARP Spoofing
  • MAC Flooding

Example: Same MAC on multiple ports → Possible MITM or ARP spoofing.

VPN (Virtual Private Network) Link to heading

VPN creates an encrypted tunnel between user and network.

Types:

  • Remote Access VPN
  • Site-to-Site VPN
  • SSL VPN (HTTPS, port 443)

Suspicious Indicators:

  • Logins from unusual countries
  • Multiple logins from same user, different locations
  • High data transfer volumes

SOC Example: User logs in from Germany, then India within 2 minutes → Impossible travel → Compromised account.

Firewalls Link to heading

Firewalls control traffic based on rules.

Types:

  • Network Firewall
  • Host Firewall
  • Stateful Firewall

Actions:

  • Allow
  • Deny
  • Filter/Reject

DMZ Segmentation: Acts as buffer between internet and internal networks.

SOC Indicators:

  • Blocked attack attempts
  • Port scanning
  • Suspicious outbound traffic

Example: 500 denied attempts on port 3389 → RDP brute-force attack.

IDS/IPS Link to heading

  • IDS: Detects suspicious traffic, alerts SOC.
  • IPS: Actively blocks malicious traffic.
  • Often integrated into Next-Gen Firewalls.

Proxy Servers Link to heading

Proxies act as intermediaries.

  • Operate at application level (e.g., browsers).
  • Do not encrypt traffic.

Types:

  • Forward Proxy → Outbound requests
  • Reverse Proxy → Inbound requests

SOC Visibility:

  • Routers → IP traffic
  • Switches → MAC activity
  • Firewalls → Allowed/blocked traffic
  • IDS/IPS → Attack alerts
  • Proxies → User behavior

DNS Footprinting Link to heading

Attackers gather DNS info to map infrastructure.

Goals:

  • Discover subdomains
  • Identify services (VPN, mail)
  • Map IPs

SOC Detection:

  • High DNS queries from one IP
  • Sequential subdomain queries
  • Unusual external queries

Example: IP queries admin.company.com, vpn.company.com, mail.company.com → Reconnaissance.

DNS Poisoning Link to heading

Attackers inject fake DNS responses.

Goals:

  • Redirect to fake login pages
  • Deliver malware
  • Intercept communications

Types:

  • Cache poisoning
  • Host file poisoning
  • Router DNS tampering

Indicators:

  • Domains resolving to unusual IPs
  • Sudden IP changes
  • Certificate warnings
  • Failed DNS queries
  • Clients using unusual DNS servers

APT (Advanced Persistent Threat) Link to heading

APTs are long-term targeted attacks.

Characteristics:

  • Advanced techniques (custom malware, zero-days)
  • Persistent hidden access
  • Threat actors (nation-states, organized groups)

SOC Indicators:

  • Unusual outbound connections
  • Multiple systems accessed
  • Unknown domains/IPs
  • Large data transfers
  • Persistence mechanisms
  • PowerShell/WMI abuse
  • Lateral movement
  • Credential dumping
  • Disabled security tools

Real SOC Example:

  • Phishing email opened
  • PowerShell executes malicious commands
  • Mimikatz dumps credentials
  • Unusual admin logins
  • RDP connections across servers
  • Data exfiltration

Analyst Approach: Look for connected events → Identify larger attack chain.