Sefism.Network engineering: Network security

Tauseef Fayyaz

Chapter 01

Models, addressing and subnetting

How data moves through the layers, the ports you will see every day, IPv4 and IPv6 addressing, and the subnetting maths every other stage depends on.

OSI and TCP/IP models

Also called OSI model, TCP/IP model, seven layers, network layers, encapsulation

What: Two ways to split networking into layers. OSI has seven: physical, data link, network, transport, session, presentation, application. TCP/IP folds them into four or five. Each layer wraps the data from the layer above with its own header, which is called encapsulation.
Why: Layers give you a shared vocabulary and a troubleshooting order. "It is a Layer 2 problem" tells a colleague to look at switches, VLANs and MAC addresses, not routing.
Example: A web request is HTTP data (Layer 7), put in a TCP segment (Layer 4), inside an IP packet (Layer 3), inside an Ethernet frame (Layer 2), sent as bits on a cable (Layer 1).

Watch out

Memorising the layer names without being able to say which device, address and header lives at each one.

TCP vs UDP

Also called TCP, UDP, three-way handshake, transport layer

What: The two main transport protocols. TCP opens a connection with a three-way handshake (SYN, SYN-ACK, ACK), numbers every byte and resends what is lost. UDP just sends datagrams, with no connection and no retries.
Why: Knowing which one an application uses tells you what a firewall rule must allow and why a voice call stutters while a download simply slows down.

Watch out

Assuming UDP is "unreliable so never used": DNS, DHCP, VoIP, video and QUIC all run over it.

Common port numbers

Also called well-known ports, port numbers, TCP ports, UDP ports

What: The numbers that identify a service on a host. Well-known ports run from 0 to 1023 and are fixed by convention, so a firewall rule or packet capture can tell services apart.
Why: You read ports in every ACL, firewall policy and capture. Knowing the common ones by heart makes both faster and safer.

Code

20/21 FTP      22 SSH         23 Telnet
25 SMTP        53 DNS         67/68 DHCP
69 TFTP        80 HTTP        110 POP3
123 NTP        143 IMAP       161/162 SNMP
179 BGP        389 LDAP       443 HTTPS
514 Syslog     1812/1813 RADIUS
49 TACACS+     3389 RDP       500/4500 IKE

Watch out

Forgetting that DNS uses TCP 53 as well as UDP 53, for large responses and zone transfers.

IPv4 addresses and CIDR prefixes

Also called IP address, subnet mask, CIDR, prefix length, network address, broadcast address

What: An IPv4 address is 32 bits written as four numbers from 0 to 255. The prefix length, such as /24, says how many leading bits name the network; the rest name hosts. The first address is the network, the last is broadcast.
Why: Every device, route and ACL is built on prefixes. Reading 10.1.4.0/22 and knowing which addresses it covers is the core network skill.
Example: 192.168.10.0/26: mask 255.255.255.192, network 192.168.10.0, broadcast 192.168.10.63, usable hosts .1 to .62.

Watch out

Counting 2 to the power of host bits as usable hosts and forgetting to subtract the network and broadcast addresses.

Subnetting table

Also called subnet cheat sheet, block size, magic number

What: The prefixes you meet most, with their masks, block sizes and usable hosts. The block size is 256 minus the interesting mask octet, and subnets start at multiples of it.
Why: With this table in your head, subnetting questions take seconds and you can check an address plan by eye.

Code

/24 255.255.255.0    block 256  hosts 254
/25 255.255.255.128  block 128  hosts 126
/26 255.255.255.192  block 64   hosts 62
/27 255.255.255.224  block 32   hosts 30
/28 255.255.255.240  block 16   hosts 14
/29 255.255.255.248  block 8    hosts 6
/30 255.255.255.252  block 4    hosts 2
/31 255.255.255.254  point-to-point links
/32 255.255.255.255  one host (loopback)

Watch out

Starting a /27 at .20: subnets must begin on a multiple of the block size (.0, .32, .64...).

VLSM

Also called variable length subnet masking, address plan, IP plan

What: Carving one block into subnets of different sizes, largest first, so each LAN, link and loopback gets only the addresses it needs.
Why: Real networks have a 200-user office next to a 2-address router link. VLSM keeps the plan compact and summarisable.
Example: From 10.0.0.0/24: staff /25 (126 hosts), guests /26 (62), servers /27 (30), two router links /30 each.

Watch out

Allocating small subnets first and leaving gaps that no larger subnet can fit into.

IPv6 addressing

Also called IPv6, link-local, global unicast, SLAAC, EUI-64, unique local

What: IPv6 addresses are 128 bits written in hex groups, such as 2001:db8:10::1/64. Interfaces have a link-local address (fe80::/10) plus usually a global unicast one; LANs are almost always /64.
Why: Operators and clouds run IPv6 now, and every CCNA version tests addressing and static routes for it.

Watch out

Using :: twice in one address: it may replace only one run of zero groups.

ARP

Also called Address Resolution Protocol, ARP table, MAC resolution

What: The IPv4 protocol that finds the MAC address for an IP address on the local network by broadcasting a question and caching the answer. IPv6 uses Neighbor Discovery instead.
Why: Before a host can send a frame, even to its default gateway, it needs a MAC address. Many "can ping one way only" faults end in a stale or wrong ARP entry.

Code

show ip arp
show mac address-table dynamic
clear arp-cache

Watch out

Thinking a host ARPs for a remote server: it ARPs for its default gateway and sends the frame there.

DHCP and DHCP relay

Also called DORA, ip helper-address, DHCP relay, DHCP server

What: DHCP hands clients an address, mask, gateway and DNS servers through Discover, Offer, Request, Acknowledge. A relay (ip helper-address) forwards those broadcasts to a server on another subnet.
Why: Almost every user device gets its address this way, so "no IP address" is one of the first tickets you will handle.

Code

ip dhcp excluded-address 10.1.10.1 10.1.10.20
ip dhcp pool STAFF
 network 10.1.10.0 255.255.255.0
 default-router 10.1.10.1
 dns-server 10.1.1.53
interface Vlan20
 ip helper-address 10.1.1.10

Watch out

Forgetting the helper address on the client VLAN interface, so broadcasts never leave the subnet.

DNS records

Also called A record, AAAA record, CNAME, MX record, PTR record, NS record

What: DNS turns names into addresses. A maps a name to IPv4, AAAA to IPv6, CNAME to another name, MX names the mail server, NS the authoritative servers and PTR maps an address back to a name.
Why: "The network is down" is often a DNS fault. Checking records with nslookup or dig separates name problems from reachability problems in a minute.

Shell

nslookup www.example.com
dig AAAA www.example.com +short
dig -x 192.0.2.10 +short   # PTR lookup

Watch out

Fixing a record and testing straight away, then blaming the fix when the old answer is still cached until its TTL expires.

Go deeper