1.8 Networking Basics for Security★★

# What Happens When You Open a Website

• You type a website name, and the page appears in under a second.
• Feels like one step. It's actually a dozen, across several machines.
• Your phone finds an address, knocks on a numbered door, and asks for the page.
• Almost every attack in this subject hijacks one of those steps.

# OSI and TCP/IP Models

Protocols and layers

• Protocol: a set of rules for how devices communicate (HTTP, TCP, IP).
• Layer: a group of related networking jobs; each layer serves the one above it.

The OSI model (7 layers)

• Memory trick (7 → 1): All People Seem To Need Data Processing.

The TCP/IP model (4 layers)

1. Application = OSI layers 5–7 (HTTP, DNS, SMTP).
2. Transport = OSI layer 4 (TCP, UDP).
3. Internet = OSI layer 3 (IP, ICMP).
4. Network access (link) = OSI layers 1–2 (Ethernet, Wi-Fi).

TCP vs UDP

The TCP three-way handshake

flowchart TD
    A["<b>Client → server: SYN</b><br>(let's connect)"]:::blue --> B["<b>Server → client: SYN-ACK</b><br>(ready, confirm?)"]:::blue
    B --> C["<b>Client → server: ACK</b><br>(confirmed)"]:::blue
    C --> D["<b>Connection open</b><br>(data can flow)"]:::green
    classDef blue fill:#5b84d424,stroke:#5b84d480
    classDef green fill:#52a86e24,stroke:#52a86e80

• A SYN flood sends thousands of SYNs and never completes step 3, filling the server's memory (→ 2.17).
• Port scans use these same packets to see which ports answer (→ 2.6).

# Ports and Services PYQ 1M

A port is a number (0–65535) that identifies a specific service on a computer, so one IP address can run many services at once.

• Well-known ports: 0–1023 · registered: 1024–49151 · dynamic (temporary): 49152–65535.

Security points

• Close every port that isn't needed; each open port is a possible way in.
• Firewalls allow or block traffic by port (→ 6.6).
• Use the encrypted version of a service: SSH instead of Telnet, HTTPS instead of HTTP (→ 6.8).

# HTTP Response Codes PYQ 5M

HTTP requests and responses

• HTTP (HyperText Transfer Protocol): the rules a browser and a web server use to talk.
• Request: the browser sends a method and a path, e.g. GET /results.html.
  • GET fetches data · POST sends form data · PUT updates · DELETE removes · HEAD fetches headers only.
• Response: the server sends back a status line (with the response code), headers and the body (the page).

An HTTP response code (status code) is a three-digit number sent by a web server in reply to a request, telling whether the request succeeded and, if not, why.

The five classes

1. 1xx Informational: request received, continuing.
2. 2xx Success: request received, understood and accepted.
3. 3xx Redirection: the browser must go somewhere else.
4. 4xx Client error: the request has a problem (wrong address, no permission).
5. 5xx Server error: the server failed to handle a valid request.

Common codes

Why they matter for security

• Many 401/403 codes in a short time suggest password guessing.
• Bursts of 404 codes suggest someone scanning for hidden pages.
• Detailed 500 error pages can leak database details to attackers (→ 2.9).
• 503 errors under heavy traffic can signal a DDoS attack; 429 shows rate limiting at work.

# IP, MAC, DNS and LDAP PYQ 1M · other

• IP address: the logical address of a device on a network. IPv4 is 32-bit (e.g. 192.168.1.10); IPv6 is 128-bit.
• MAC address: a 48-bit hardware address fixed in the network card (e.g. 00:1A:2B:3C:4D:5E); used inside the local network.
• DNS (Domain Name System): turns names like sbi.co.in into IP addresses; port 53 (attacks on it → 2.3).
• LDAP (Lightweight Directory Access Protocol): a protocol for looking up and managing directory information (users, groups, devices) on a network, as in Microsoft Active Directory; port 389.
• RAS (Remote Access Service): lets users connect to an organisation's network from outside; needs strong passwords and a VPN.