Networking — Deep Notes with Diagrams

Cybersecurity ke liye — Prince

1. Networking Basics Kya Hai?

Networking matlab do ya do se zyada devices ka aapas me data share karna. Cybersecurity me networking isliye important hai kyunki har attack, kisi
na kisi network protocol ke through hi hota hai. Jab tak network ka flow samajh me nahi aayega, tab tak attack ya defense dono samajhna
mushkil hoga.

2. OSI Model (7 Layers) — Sabse Important Concept

OSI Model ek conceptual framework hai jo batata hai ki data ek device se dusre device tak kaise jaata hai.

Layer 7 — Application
HTTP, DNS, FTP, SMTP

Layer 6 — Presentation
Encryption, SSL/TLS, encoding

data flows down

Layer 5 — Session
Sessions, sockets

Layer 4 — Transport
TCP, UDP

Layer 3 — Network
IP, ICMP, routers

Layer 2 — Data link

MAC address, switches, ARP

Layer 1 — Physical
Cables, WiFi signals

Yaad rakhne ka trick: "All People Seem To Need Data Processing" (Application → Physical)

Cybersecurity angle: Layer 3-4 attacks = IP spoofing, SYN flood (DDoS) | Layer 7 attacks = SQLi, XSS | Layer 2 attacks = ARP spoofing, MAC flooding

3. TCP/IP Model (Practical Version)

1. Application Layer (OSI ke 5,6,7 combine) — HTTP, DNS, FTP, SMTP

2. Transport Layer — TCP, UDP
3. Internet Layer — IP, ICMP, ARP
4. Network Access Layer — Ethernet, WiFi

4. IP Addressing — Deep Dive

IPv4

32-bit address, 4 octets (e.g., [Link] ). Har octet 0-255 ke beech hota hai.

IP Classes
 Class Range Use

A [Link] – [Link] Large networks

B [Link] – [Link] Medium networks

C [Link] – [Link] Small networks (most common)

D [Link] – [Link] Multicast

E [Link] – [Link] Research/Reserved

Private vs Public IP

Private ranges: [Link]–[Link] , [Link]–[Link] , [Link]–[Link]

Public IP: Internet pe directly identify hone wala address

Subnetting

/24 = [Link] = 256 addresses (254 usable). CIDR notation: [Link]/24

Practice trick: /25 = 128 hosts, /26 = 64 hosts, /27 = 32 hosts... (har / +1 pe half ho jaata hai)

5. DNS (Domain Name System)

DNS internet ka "phonebook" hai — domain name ko IP me convert karta hai.

Auth
Browser Resolver Root server TLD server
server

wants IP asks root points to .com points to owner returns IP

DNS Record Types

Record Kaam

A Domain → IPv4 address

AAAA Domain → IPv6 address

CNAME Domain → Dusra domain (alias)

MX Mail server info

TXT Text info (SPF, verification)

NS Nameserver info

Attack angle: DNS spoofing, DNS cache poisoning, DNS tunneling (data exfiltration ke liye use hota hai)

6. DHCP (Dynamic Host Configuration Protocol)

Automatically device ko IP address assign karta hai.

DORA Process: Discover → Offer → Request → Acknowledge

Attack angle: DHCP starvation, rogue DHCP server attack

7. TCP vs UDP
 TCP UDP

Connection-oriented Connectionless
needs a handshake first no handshake, just sends

Reliable Unreliable
acknowledges every packet no delivery guarantee

Slower Faster
ordering and checks add overhead minimal overhead

Used for Used for

HTTP, email, file transfer Video calls, gaming, DNS

where every byte must arrive where speed matters more

TCP 3-Way Handshake

Client Server

1. SYN

2. SYN-ACK

3. ACK

connection established

Connection close hone me 4-way handshake hota hai (FIN, ACK, FIN, ACK)

Attack angle: SYN Flood attack (fake SYN bhejte rehna, server resources khatam karna — DDoS ka common type)

8. Important Ports

Port Protocol Kaam

20/21 FTP File transfer

22 SSH Secure remote login

23 Telnet Insecure remote login (avoid)

25 SMTP Email sending

53 DNS Domain resolution

67/68 DHCP IP assignment

80 HTTP Web traffic (unencrypted)

110 POP3 Email retrieval

143 IMAP Email retrieval (advanced)

443 HTTPS Secure web traffic

445 SMB Windows file sharing

3306 MySQL Database

3389 RDP Windows remote desktop

 8080 HTTP alt Proxy/alt web port

9. HTTP/HTTPS Deep Dive

Common HTTP Status Codes

200 OK 301/302 Redirect 400 Bad Request 401 Unauthorized 403 Forbidden 404 Not Found 500 Internal Server Error

HTTPS

HTTP + SSL/TLS encryption. TLS Handshake flow: Client Hello → Server Hello → Certificate exchange → Key exchange → Encrypted session start

Attack angle: Man-in-the-Middle (MITM), SSL stripping, session hijacking

10. Firewalls, NAT, Proxy, VPN

Firewall: Traffic filter karta hai rules ke basis pe (allow/deny). Types: Packet-filtering, Stateful, Next-Gen Firewall (NGFW)

NAT: Private IP ko Public IP me translate karta hai. Types: Static NAT, Dynamic NAT, PAT (most common)

Proxy: Forward proxy (client side) vs Reverse proxy (server side, load balancing/security)

VPN: Encrypted tunnel — Protocols: OpenVPN, WireGuard, IPSec

11. ARP (Address Resolution Protocol)

IP address ko MAC address me convert karta hai (Layer 2/3 ke beech ka bridge).

Client Router

fake ARP reply fake ARP reply

Attacker

all client to router traffic now flows through the attacker

Attack angle: ARP Spoofing/Poisoning — attacker fake ARP response bhejta hai taaki traffic uske through route ho (MITM attack ka common tarika)

12. Switches, Routers, Hubs — Difference

Device Layer Kaam

Hub Layer 1 Sab ports pe data broadcast karta hai (outdated, insecure)

Switch Layer 2 MAC address ke basis pe specific device ko data bhejta hai

Router Layer 3 Different networks ke beech routing karta hai (IP based)

13. VLAN (Virtual LAN)

Ek physical network ko logically multiple networks me divide karna. Security aur traffic management ke liye use hota hai.

14. Common Network Attacks (Summary)

Attack Kya Hota Hai

DDoS Server ko fake traffic se overload karna

MITM Do parties ke beech traffic intercept karna

ARP Spoofing Fake ARP responses se traffic redirect karna

DNS Spoofing Fake DNS response se galat site pe redirect karna

Port Scanning Open ports dhundhna (Nmap se)

Packet Sniffing Network traffic capture karna (Wireshark se)

SYN Flood Fake TCP connections se server overload karna

15. Tools Jo Practice Karne Chahiye

Wireshark — Packet capture & analysis

Nmap — Port scanning & network discovery
tcpdump — Command-line packet capture
Ping/Traceroute — Connectivity test aur route dekhna
Netstat — Active connections dekhna

16. Practice Plan

1. Wireshark install karo → apne traffic ko capture karo → TCP handshake dekho live
2. Nmap se apne home network scan karo ( nmap -sV [Link]/24 )
3. Subnetting practice daily 10 minute — khud calculate karo, calculator baad me use karo
4. TryHackMe pe "Network Fundamentals" aur "Nmap" rooms complete karo (free)

Quick Revision Cheat Sheet

OSI = 7 layers, TCP/IP = 4 layers

TCP = reliable + slow, UDP = fast + unreliable
3-way handshake = SYN, SYN-ACK, ACK
DNS = domain → IP, ARP = IP → MAC
Port 80 = HTTP, 443 = HTTPS, 22 = SSH, 53 = DNS
Private IP ranges: 10.x, 172.16-31.x, 192.168.x