Network Security Fundamentals
The network is the medium almost every attack passes through, so its workings must be understood bottom-up: how data travels the OSI layers, how TCP differs from UDP, why ICMP exists, and how traceroute builds a route. On this foundation stand both reconnaissance (port scanning) and defense (network segmentation) — neither can be discussed without knowing what happens at the packet level.
The traps here are basic but common: confusing the network layer (IP, routing) with the data-link layer (MAC, frames), attributing TCP's reliability to UDP, hunting for an "ICMP port" that does not exist, and designing a flat network where a breached web server immediately reaches the database. Each mechanism is broken down in the layers below.
Topic map
- The OSI model — the seven layers bottom-up and which one each security control works at.
- TCP vs UDP — connection and delivery guarantees against speed, and how that shapes attacks.
- The ICMP protocol — network-layer control messages with no ports and how to filter it correctly.
- Traceroute path discovery — how TTL increments and ICMP Time Exceeded replies reveal the path to a host.
- Port scanning — the SYN, TCP connect and UDP methods, their stealth and reliability.
- Network segmentation — DMZ, internal segment and DB isolation against lateral movement.
Common traps
| Mistake | Consequence |
|---|---|
Confusing the network (IP, routing) and data-link (MAC, frames) layers | You misname where a control works — a failed basic question |
Attributing reliable ordered delivery to UDP | Wrong threat model: UDP gives no guarantees, hence SYN-flood vs amplification |
Hunting for an "ICMP port" to close | ICMP has no ports — it is blocked by protocol number, not by port |
Thinking a SYN scan is noisier than TCP connect | connect completes the handshake and is logged, SYN is not |
Expecting RST from a closed UDP port | A closed UDP port replies ICMP port-unreachable, not RST |
| Building a flat network or placing the DB in the DMZ | A breached external host reaches the DB directly |
Interview relevance
Network fundamentals are asked to filter out candidates who "heard the words" but do not know the mechanics. Someone who confidently separates the OSI layers, explains the guarantees of TCP and UDP, and designs a network with a DMZ and an isolated DB immediately looks stronger.
Typical checks:
- The seven
OSIlayers and which one a packet-inspecting firewall works at. - How
TCPdiffers fromUDPand when each is chosen. - Why
ICMPhas no ports and how it is filtered without breaking the network. - How
tracerouteusesTTLandICMP Time Exceeded; how aSYNscan differs fromconnect. - How to place the DB, backend and frontend across segments so that a DMZ breach gives no DB access.
Common wrong answer: "ICMP runs on UDP port 7, close it and ping is off". In fact ICMP is not a transport protocol, it has no ports, and it is blocked by a firewall rule on protocol number.