Networking Foundations
IP addressing, ports and protocols, the OSI and TCP/IP models – the ground on which every attack and every defence stands.
About this part
Every attack and every defence happens on a network. Before you can understand a port scan, a firewall rule or a phishing link, you need to know how one computer finds another and talks to it. This part gives you that ground.
You will learn three things. First, IP addressing: what an IPv4 address is, how subnets split a network, and why your laptop has a private address like 192.168.1.5 while a website has a public one. Second, ports and protocols: why SSH uses port 22, HTTPS uses 443 and DNS uses 53, and what each one does. Third, the OSI and TCP/IP models, TCP versus UDP, and the three-way handshake (SYN, SYN-ACK, ACK) that starts every TCP connection.
Think of it like a postal system. The IP address is the building. The port is the flat number. The protocol is the language written inside the letter. When you open a site on your phone over Jio or Airtel, all three work together in a fraction of a second.
Take your time here. Later, when a tool like Nmap says 22/tcp open ssh, you will know exactly what it means and how to protect it.
Examples you will meet in this part. Your home Wi-Fi router gives your phone a private IP (192.168.x.x). A website like amazon.in answers on public IPs. A database such as MySQL (port 3306), PostgreSQL (5432), MongoDB (27017) or Redis (6379) should only ever be reachable on private addresses. You will learn to read these numbers at a glance.
After this part you will be able to
- Read an IP like 172.31.5.20/20 and say whether it is private and how many addresses the subnet has.
- Name the port and protocol behind SSH, HTTP, HTTPS, DNS and the common databases.
- Explain the TCP three-way handshake with a drawing.
- Explain why a security group that allows 0.0.0.0/0 on port 22 is risky.
A real-world picture
Suppose we are a junior network engineer at Airtel. A customer says "the internet works but one website doesn't open". With these basics you check DNS first (nslookup), then the connection to the port (nc -zv site 443), and you explain the result in two lines. Globally, the 2016 Dyn DNS outage showed how much depends on DNS: big sites became unreachable for many users because the DNS layer under them was attacked. Everyday analogy: a PIN code and a house number. Both are needed to deliver a parcel.
Key terms
- IPv4 address: A 32-bit number written as four parts, like 13.233.10.5.
- Private range: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. These are not routed on the internet.
- CIDR /24: The first 24 bits are the network part, which leaves 256 addresses (AWS keeps 5 in each subnet).
- Port: A number from 0 to 65535 that picks the program on a computer, for example 443 for HTTPS.
- TCP vs UDP: TCP is reliable and ordered, used by web, SSH and databases. UDP is fast with no handshake, used by DNS queries and video calls.
- Three-way handshake: SYN → SYN-ACK → ACK, before any TCP data flows.
Mini case study
Suppose we are a junior analyst at Tata Consultancy Services, asked to review a new web server on AWS before launch (with the client's written approval). The checklist from this part becomes a short report: what you checked, what you found (for example "port 22 open to 0.0.0.0/0" or "directory listing on"), the evidence (a command and its output), and the fix. Clear, evidence-based reports like this are how defenders work every day.