Networking security starts with core security framing:

Opening Framing: The Network is the Battlefield

Every cyberattack traverses a network. Whether an attacker is phishing credentials, exfiltrating data, or commanding malware—packets flow across wires, through routers, and past firewalls. Understanding networks isn't optional for security professionals; it's foundational.

This course teaches networking through a security lens. You won't just learn how packets move from A to B—you'll learn where attackers intercept them, how protocols can be abused, and what defenders monitor to catch intrusions.

This week, we establish the foundation: what networks are, why they matter for security, and how to start thinking about network traffic as evidence of activity—both legitimate and malicious.

Key insight: Networks are transparent to those who know how to look. Every connection, every transfer, every communication leaves traces that skilled analysts can read.

1) What is a Network?

At its simplest, a network connects devices so they can communicate. But that simple definition hides enormous complexity:

• Nodes: Devices on the network (computers, servers, phones, IoT devices)
• Links: Connections between nodes (cables, wireless, fiber)
• Protocols: Rules for communication (TCP/IP, HTTP, DNS)
• Services: Applications that use the network (web, email, file sharing)

Network Types by Scale:

• PAN (Personal Area Network): Bluetooth devices, ~10 meters
• LAN (Local Area Network): Office, home, building
• WAN (Wide Area Network): Cities, countries, the Internet
• WLAN: Wireless LAN (Wi-Fi networks)

Security Perspective: Each network type has different attack surfaces. A LAN attacker might be an insider or someone who gained physical access. A WAN attacker could be anywhere in the world. Wireless networks can be attacked from the parking lot.

Key insight: The network boundary defines your threat model. Know where your network ends and the untrusted world begins.

2) The Security Mindset for Networking

Security professionals view networks differently than network engineers:

Network Engineer Thinks: "How do I make this connection reliable and fast?"

Security Professional Thinks: "Who else could use this connection? What could they see? What could they modify?"

The CIA Triad Applied to Networks:

• Confidentiality: Can unauthorized parties read our traffic? (Encryption, VPNs, network segmentation)
• Integrity: Can attackers modify data in transit? (TLS, checksums, digital signatures)
• Availability: Can attackers disrupt our communications? (DDoS protection, redundancy, failover)

Key Security Questions for Any Network:

1. What traffic is normal? What would be anomalous?
2. Who can access this network segment?
3. What data crosses this link? Is it protected?
4. If compromised, what else could an attacker reach?
5. How would we detect malicious activity?

Key insight: Every network design decision is also a security decision. Convenience often trades off against security.

3) Network Traffic: Packets and Flows

Network communication happens through packets—small chunks of data with headers describing where they're going and what they contain:

Packet Structure (simplified):
┌─────────────────────────────────────────┐
│ Headers                                 │
│ ┌─────────────────────────────────────┐ │
│ │ Layer 2: MAC addresses (Ethernet)   │ │
│ ├─────────────────────────────────────┤ │
│ │ Layer 3: IP addresses (Internet)    │ │
│ ├─────────────────────────────────────┤ │
│ │ Layer 4: Ports (TCP/UDP)            │ │
│ └─────────────────────────────────────┘ │
├─────────────────────────────────────────┤
│ Payload (actual data)                   │
└─────────────────────────────────────────┘

What Headers Reveal:

• Source/Destination IPs: Who's talking to whom
• Ports: What service is being used (80=HTTP, 443=HTTPS, 22=SSH)
• Protocol flags: Connection state (SYN, ACK, FIN)
• Timestamps: When communication occurred

Flows vs. Packets:

A single web page load might involve hundreds of packets. Security tools often aggregate these into "flows"—summaries of connections:

Flow Record Example:
Source IP:    192.168.1.100
Dest IP:      93.184.216.34
Source Port:  52431
Dest Port:    443
Protocol:     TCP
Bytes:        15,234
Packets:      42
Duration:     2.3 seconds
Start Time:   2024-01-15 09:23:45

Key insight: Packet captures show everything; flow records show patterns. Both are essential for security analysis.

4) Network Security Tools: First Look

Throughout this course, you'll use these essential tools:

Wireshark - Packet Analysis:

The gold standard for packet capture and analysis. Wireshark lets you see every byte of network traffic, decode protocols, and follow conversations.

# Capture packets on interface eth0
wireshark -i eth0

# Or use command-line capture
tshark -i eth0 -w capture.pcap

tcpdump - Command-Line Capture:

Lightweight, available on any Linux system, perfect for servers and headless systems:

# Capture all traffic on eth0
sudo tcpdump -i eth0

# Capture only port 80 traffic, save to file
sudo tcpdump -i eth0 port 80 -w http_traffic.pcap

# Show packet contents in ASCII
sudo tcpdump -i eth0 -A port 80

Nmap - Network Scanner:

Discovers hosts and services. Used by both attackers (reconnaissance) and defenders (asset discovery, vulnerability scanning):

# Ping scan - discover live hosts
nmap -sn 192.168.1.0/24

# Port scan - find open services
nmap -sV 192.168.1.100

# Aggressive scan (OS detection, version, scripts)
nmap -A 192.168.1.100

netstat/ss - Connection Status:

# Show all listening ports
ss -tlnp

# Show established connections
ss -tnp state established

# Legacy command (still works)
netstat -tulnp

Key insight: These tools are dual-use—attackers and defenders use the same techniques. Knowing them helps you both attack and defend.

5) Common Network Attacks: Overview

This course will cover these attacks in depth. For now, understand the categories:

Reconnaissance Attacks:

• Port scanning: Discovering open services
• Network mapping: Understanding topology
• Banner grabbing: Identifying software versions
• DNS enumeration: Finding hosts and subdomains

Interception Attacks:

• Sniffing: Capturing traffic on shared networks
• Man-in-the-Middle: Intercepting and modifying traffic
• ARP spoofing: Redirecting local traffic
• DNS spoofing: Redirecting name lookups

Denial of Service:

• Flooding: Overwhelming with traffic volume
• Protocol abuse: Exploiting protocol weaknesses
• Application layer: Targeting specific services
• Amplification: Using third parties to multiply attack

Exploitation:

• Service vulnerabilities: Attacking exposed software
• Protocol weaknesses: Exploiting design flaws
• Credential attacks: Brute force, credential stuffing

Key insight: Most attacks have network signatures. Understanding attacks helps you recognize their traffic patterns.

Real-World Context: Network Security in Practice

Network security skills are essential across security roles:

SOC Analyst: You'll monitor network traffic for anomalies, investigate alerts from IDS/IPS systems, and trace attack paths through packet captures. The 2020 SolarWinds attack was detected by analyzing unusual DNS traffic patterns.

Incident Responder: Network forensics reveals what attackers accessed, what data they exfiltrated, and how they maintained persistence. Packet captures are evidence in investigations.

Penetration Tester: Network reconnaissance is phase one of any engagement. Understanding protocols helps you find misconfigurations and vulnerabilities that automated tools miss.

MITRE ATT&CK Reference:

• T1046 - Network Service Discovery: Attackers scan for services
• T1040 - Network Sniffing: Capturing credentials and data
• T1557 - Adversary-in-the-Middle: Intercepting communications
• T1498 - Network Denial of Service: Disrupting availability

Key insight: Network skills are foundational—they underpin almost every other security domain.

Guided Lab: Your First Packet Capture

Let's capture and analyze real network traffic to see packets in action.