Chapter 1: Network Models

Concerned with the transmission of raw bits (1s and 0s) over a physical medium (e.g., copper wire, radio waves).

Deals with specifications like cable thickness and signal frequency.

Recognizes and strips the preamble and frame check sequence (FCS) from incoming Ethernet frames.

Uses MAC addresses to ensure frames reach the correct device.

Checks the destination MAC address; if it matches, strips the MAC info and passes the data up.

Retains the source MAC for response purposes.

Manages logical addressing (IP addresses) for routing across networks (e.g., the internet).

Verifies the destination IP; if correct, strips IP info and forwards data.

Keeps the source IP for replies.

Assembles and disassembles data into chunks (max 1500 bytes per Ethernet frame).

Ensures data is properly sequenced (e.g., box 1 of 3, 2 of 3...).

Reassembles data on the receiving end before passing it on.

Manages sessions or connections between systems (e.g., browser to web server).

Uses port numbers to identify which application the data belongs to (e.g., multiple browser tabs).

Saves destination and source ports for communication tracking.

Ensures data is in a readable format for the application.

Handles tasks like data conversion, compression, and encryption.

Largely obsolete today as modern applications are compatible with many formats.

Not the apps themselves, but the APIs/smart functions enabling apps to use network data.

Example: Microsoft Word’s ability to open files from a network folder.

A hub repeats incoming signals and sends them out to all connected devices, regardless of destination.

Rebroadcasts them to all connected ports (like a megaphone).
Key Point: Operates at Layer 1 (Physical)—no MAC address awareness.

All devices receive all frames, leading to unnecessary traffic and requiring each device to filter out irrelevant frames.

A unique 48-bit identifier burned into every network card, used to identify devices at the data link layer.

12 hexadecimal characters, grouped into 6 pairs (e.g., 00-1A-2B-3C-4D-5E).

The OEM identifier—the manufacturer’s assigned ID (e.g., Intel).

A unique identifier for that specific NIC, assigned at the factory.

ipconfig /all

It ignores and discards the frame.

The destination MAC and the source MAC.

So the recipient knows who sent the frame and can reply.

To verify data integrity and detect transmission errors.

Inside the network card (NIC).

It strips off the MAC and CRC info and sends the data up to the software.

To uniquely identify each device on the network and ensure frames reach the correct destination.

To ensure only the intended recipient processes the frame (others discard it).
Analogy: Like a mailing address on a letter.

1. Destination MAC (who it’s for).

2. Source MAC (who sent it).

3. Data (payload).

4. CRC/FCS (error check).

Compares the destination MAC to its own:

Match: Processes the frame.

No match: Discards it.

Switches learn MAC addresses and forward frames only to the target port, reducing traffic.
Exam Tip: Hubs = Layer 1; Switches = Layer 2.

Ensures the "package" (frame) reaches the right "house" (NIC) on a street (LAN).

They can be spoofed (impersonated). Mitigation: Switch port security.

A 16-bit unsigned number (range: 0–65535) used to identify a specific service or application on a device.

Layer 4 – Transport Layer.

A combination of an IP address and a port number used to identify an application endpoint.

TCP (Transmission Control Protocol) and UDP (User Datagram Protocol).

0–1023

Legacy and commonly used protocols like HTTP, FTP, DNS, etc.

1024–49151

IANA (Internet Assigned Numbers Authority).

49152–65535

As temporary source ports for outgoing connections.

To direct the message to the correct application or service on the receiving host.

Port 20.

Port 21.

Port 22.

Port 23.

Port 53.

Port 80.

Port 443.

Just like mailboxes route mail to the correct apartment, port numbers route data to the correct application.

Well-known (0–1023): Reserved for legacy services (e.g., HTTP/80, FTP/21).

Registered (1024–49,151): Assigned by IANA to specific apps (e.g., MySQL/3306).

Dynamic (49,152–65,535): Ephemeral ports for temporary/client-side connections.

20/21: FTP (data/control).

22: SSH (secure remote access).

53: DNS (domain resolution).

80: HTTP (web traffic).

443: HTTPS (secure web traffic).

They ensure the correct service (e.g., web server, email) processes the payload.
Example: Port 25 → SMTP (email), Port 3389 → RDP (remote desktop).

For outgoing connections (e.g., your PC uses a random port to browse the web).
Exam Tip: These are client-side ports (49,152–65,535).

To reduce attack surface (open ports can be exploited).
Example: Telnet (23) is insecure—use SSH (22) instead.

Probing a host to find open ports (used for diagnostics or attacks).

Transmission Control Protocol; a connection-oriented protocol that ensures reliable delivery of data through error checking, acknowledgments, and retransmissions.

SYN → SYN-ACK → ACK.

It terminates the connection between sender and receiver.

Applications requiring reliable delivery: HTTP, SMTP, FTP.

User Datagram Protocol; a connectionless protocol that sends data with low latency, without error checking or retransmission.

For time-sensitive or real-time applications: VoIP, streaming, DNS.

A self-contained packet sent via a connectionless network like UDP.

Addressing and routing data packets across networks.

TCP ensures reliable delivery, while IP handles addressing and routing.

Internet Control Message Protocol; used for diagnostics and network tools like ping and traceroute.

Securing data over IP networks, especially in VPNs.

AH (Authentication Header): Authenticates packets, no payload encryption.

ESP (Encapsulating Security Payload): Encrypts and authenticates payloads.

IKE (Internet Key Exchange): Manages encryption keys and security associations.

A negotiated agreement between two devices on encryption/authentication settings.

Tunnel Mode: Encrypts entire IP packet; adds a new IP header. Used for gateway-to-gateway communication.

Transport Mode: Encrypts only the payload; keeps original IP header. Used for host-to-host communication.

Sets up and maintains encryption keys and SAs through ISAKMP (Internet Security Association and Key Management Protocol).

Connection-oriented (establishes connection first).

Reliable (uses ACKs/NACKs and retransmits lost packets).

Sequentially numbers packets for reassembly.

Slower due to overhead (e.g., 3-way handshake).
Use Cases: HTTP (80), FTP (20/21), SMTP (25).

Connectionless (no handshake).

Unreliable (no ACKsetransmissions).

Faster (low latency).
Use Cases: VoIP, DNS (53), streaming, gaming.

Handles logical addressing (IP addresses) and routing packets across networks.
Works with TCP/UDP:

TCP = reliable delivery.

IP = "street address" for routing.

Network diagnostics and error reporting:

ping (echo requesteply).

traceroute (path discovery).

Messages like "Destination Unreachable."
Operates at Layer 3 (Network).

AH (Authentication Header): Integrity checks (no encryption).

ESP (Encapsulating Security Payload): Encrypts payload + authenticates.

IKE (Internet Key Exchange): Negotiates encryption keys/Security Associations (SAs).

Tunnel Mode: Encrypts entire packet (+ new header). Used for gateway-to-gateway (e.g., site-to-site VPN).

Transport Mode: Encrypts only payload. Used for host-to-host.

FTP: 20/21

SSH: 22

DNS: 53

HTTP: 80

HTTPS: 443

When speed > reliability (e.g., live video, gaming, VoIP).
TCP: File transfers, web browsing.

A negotiated agreement between devices on:

Encryption algorithms.

Keys.

Security parameters.
Established via IKE.

A hardware component that connects a computer to a network and handles the creation and processing of frames.

As binary signals (1s/0s) via:

Electricity (copper cables).

Light (fiber optics).

Radio waves (Wi-Fi).

Not continuous streams—sent in discrete chunks called frames.

Frames have:

Start/end markers.

Max size: 1500 bytes (~10,000 bits).

Created by NICs from app data (e.g., Word doc).

Transmitted as binary signals.

Received by NICs:

Data extracted → passed to software.

Frame discarded after processing.

Rebroadcasts frames to all ports (no intelligence).

Problem: Inefficient (all devices receive every frame).
Modern Replacement: Switches (forward frames selectively).

Discrete units (start/end).

Fixed max size (1500 bytes = one "block").

NICs "build" (send) and "disassemble" (receive) them.

A network limited to a local area (like a home or office), allowing devices to share resources.

Binary data — sequences of 1s and 0s, regardless of the medium (copper, fiber, wireless).

As discrete chunks called frames or sometimes packets (packetized data).

A block of binary data sent across the network, typically up to 1500 bytes (about 12,000 bits).

Inside the network card (NIC) — created before transmission and consumed upon receipt.

The NIC extracts the data and passes it up to the appropriate software, then discards the frame.