How to use this handbook
Read the modules in sequence to build a complete mental model, then use the table of contents as a quick revision tool. Networking concepts become clearer when you connect each protocol to its layer, address, transport behavior, and security boundary.
Network Models & Fundamentals
Layered models divide communication into responsibilities that can be designed, tested, and replaced independently. Encapsulation means each layer adds its own header as data travels down the stack; the receiver removes those headers in reverse order. This vocabulary makes it easier to locate faults: a failed cable is physical, a missing route is network-layer, and a refused service is usually transport or application-layer.
OSI 7-layer model
- Physical: Signals, cabling, radio, connectors.
- Data Link: Frames, MAC addresses, switching, VLANs.
- Network: Packets, IP addressing, routing.
- Transport: End-to-end delivery, ports, reliability.
- Session: Dialog control and session state.
- Presentation: Encoding, compression, encryption.
- Application: Services such as HTTP, DNS, and SSH.
TCP/IP 4-layer model
Link covers local delivery and physical media. Internet handles IP packets and routing. Transport provides TCP, UDP, and port-based delivery. Application combines the upper OSI responsibilities into protocols used by software.
The TCP/IP model is closer to real protocol implementations, while OSI remains valuable as a troubleshooting and teaching framework.
Encapsulation example
An HTTPS request becomes application data, then a TCP segment, an IP packet, and finally an Ethernet or Wi-Fi frame. At the destination, each layer validates and unwraps its portion before passing the payload upward.
IP Addressing & Subnetting
An IP address identifies a network interface at the internet layer. IPv4 uses 32 bits and is written as four decimal octets; IPv6 uses 128 bits and provides a vastly larger address space, simpler aggregation, and built-in support for scoped addressing. CIDR notation expresses the network prefix length, such as 192.168.10.0/24.
Subnet calculation
A /24 mask has 24 network bits and 8 host bits. That produces 256 total addresses, usually 254 usable host addresses after reserving the network and broadcast addresses. A /26 borrows two more host bits: 64 total addresses and 62 typical usable hosts.
Address scopes
Private IPv4: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 are for internal networks. Public addresses are globally routable. IPv6 commonly uses global unicast, link-local, unique-local, and multicast scopes.
# Example: split 192.168.20.0/24 into four equal subnets
# Borrow 2 host bits: /24 becomes /26
192.168.20.0/26 hosts .1 - .62
192.168.20.64/26 hosts .65 - .126
192.168.20.128/26 hosts .129 - .190
192.168.20.192/26 hosts .193 - .254Core Network Protocols
Protocols define the messages and state transitions that allow independent devices to cooperate. Learn both the purpose and the failure mode of each protocol: a DNS problem looks like an application outage, DHCP failure prevents configuration, and an ARP issue can isolate devices that appear to share the same subnet.
DNS
Maps names to records such as A, AAAA, CNAME, and MX. Caching reduces latency but means changes respect TTL values.
DHCP
Uses a lease process to provide addresses, gateways, DNS servers, and other client configuration.
ARP & NAT
ARP resolves local IPv4 addresses to MAC addresses. NAT translates address or port information at network boundaries.
ICMP
Carries diagnostic and control messages. Ping and traceroute use ICMP or related TTL-expiry behavior.
FTP & SSH
FTP transfers files but should be protected or replaced for sensitive work. SSH provides encrypted remote administration and tunneling.
HTTP / HTTPS
HTTP carries web requests. HTTPS adds TLS authentication and encryption to protect content in transit.
# Useful protocol-focused diagnostics
nslookup academy.example
ping -c 4 192.168.1.1
traceroute academy.example
ssh -p 22 student@server.example
curl -I https://academy.exampleTransport Layer Protocols
The transport layer delivers data to the correct application using ports and sockets. A socket is commonly represented by an IP address, transport protocol, and port. Servers listen on known ports while clients use temporary ephemeral ports for each connection.
TCP three-way handshake
- Client sends SYN with an initial sequence number.
- Server responds with SYN-ACK, acknowledging the client and offering its own sequence number.
- Client sends ACK; the connection is established.
TCP then provides ordered delivery, retransmission, flow control, and congestion control.
UDP trade-offs
UDP has no connection handshake or built-in retransmission, reducing overhead and latency. It is useful for DNS, voice, video, games, and telemetry when the application can tolerate loss or implement its own recovery. TCP is preferable when complete, ordered delivery matters.
Client Server
| --- SYN, seq=100 ---------> |
| <-- SYN-ACK, seq=500, ack=101 |
| --- ACK, ack=501 ----------> |
| established |Network Infrastructure & Hardware
Reliable networks combine devices with distinct forwarding and policy roles. Design for clear boundaries: switches connect local devices, routers connect networks, and firewalls enforce trust decisions between zones.
Routers
Forward packets between IP networks using routing tables and protocols. They commonly provide gateway, NAT, and WAN connectivity.
Switches
Forward Ethernet frames using MAC address tables. Managed switches support VLANs, trunking, link aggregation, and monitoring.
Firewalls
Inspect traffic against policy and can filter by address, port, protocol, identity, or application context.
VLANs
Logically separate broadcast domains on shared switching hardware. Inter-VLAN traffic should pass through a deliberate routing and security policy.
Wireless bridges
Connect separated wired networks over a wireless link. Directional planning, channel selection, and encryption affect reliability.
Power over Ethernet
PoE delivers power and data over compatible Ethernet cabling for access points, cameras, and phones while simplifying deployment.
Network Security & Encryption
Security architecture protects confidentiality, integrity, and availability. Start with least privilege and segmentation, then layer authentication, encryption, monitoring, rate controls, and tested incident procedures.
TLS handshake
A client and server negotiate a version and cipher suite, validate the server certificate, establish shared key material, and then encrypt application traffic with symmetric session keys. Modern TLS protects against interception and tampering when certificates and trust stores are managed correctly.
VPNs and segmentation
VPNs create authenticated encrypted tunnels across untrusted networks. Pair them with narrow routes, device posture checks, network zones, and identity-aware access rather than treating the tunnel as unlimited trust.
DDoS protection
Use upstream scrubbing, rate limiting, caching, autoscaling, anycast capacity, and resilient origin design. Monitoring should distinguish volumetric attacks from application-layer abuse.
Firewall rules & ACLs
Use default-deny policies, explicit source and destination scopes, narrow ports, documented owners, logging for important decisions, and regular rule review. Place specific allow rules before broad deny or allow rules according to the platform’s evaluation order.
# Conceptual least-privilege policy
allow source=web-tier destination=app-tier protocol=tcp port=443
allow source=app-tier destination=db-tier protocol=tcp port=5432
deny source=any destination=db-tier protocol=any
log source=any destination=admin-net action=denyStudy checklist
- □ Map a real request through the OSI and TCP/IP layers.
- □ Calculate usable hosts for /24, /26, and /30 networks.
- □ Explain what DNS, DHCP, ARP, and NAT each contribute.
- □ Compare TCP reliability with UDP latency.
- □ Design VLAN and firewall boundaries for three trust zones.
- □ Describe how TLS and VPNs protect traffic in transit.