Complete Networking for Cybersecurity Beginners (2026)

Hackers know exactly how that works. Every step, every protocol, every port, every tiny detail of that journey. If you want to defend systems, if you want to work in cyber security, or any IT field, you need to understand networking. This video might just be the most valuable one you'll watch in your entire journey. By the end of this video, you'll see the internet in a way you've never seen it before. So that's exactly what we're doing today. We're going to build that foundation from scratch. This is networking basics for cyber security. Let's go. Okay, let's start at the very beginning. What is a network? A network is simply a collection of devices that are connected together so they can share information. That's it. That's the whole idea. Think of it like a neighborhood. In a neighborhood, houses are connected by roads. If I want to send a package from my house to yours, I put it in a vehicle, it travels the road, and it arrives at your door. A computer network works the same way. Devices are the houses, the cables or Wi-Fi signals are the roads, and data is the package. Now those devices, they can be anything. A laptop, a phone, a CERN, a server, a printer, a smart fridge, a security camera, a traffic light, literally anything with a chip and a connection. When those devices can talk to each other, that's a network. Here's a question I want you to really sit with for a second. How does a hacker get into a system they were never invited into? Almost always, the answer involves a network. Think about it. When someone hacks into a company's database, they didn't walk in and plug in a USB drive. No, they came in through the network. They exploited a protocol, an open port, or a misconfigured service. They used the network against itself. Every major attack you've heard of, data breaches, ransomware, phishing, man-in-the- on top of networks. So when you understand networks, you understand the battlefield. And in cybersecurity, you absolutely need to know your battlefield. All right, before we go deeper, let's define three terms you're going to hear constantly in this course and in your career. These are IP address, port, and protocol. Think of an IP address as a home address. When you want to mail someone a letter, you write their address on the envelope so the postal system knows where to deliver it. A computer's IP address does the same thing. It tells the network where to send the data. Every device on a network has an IP address. For example, your laptop might have the IP address 192.168.1.5. When someone sends data to you, that address tells the network, deliver it here. We'll go much deeper into IP addresses later. For now, IP address equals the address of a device on the network. Port now. Imagine you arrive at someone's house. You have the address. You find the right building. But which door do you knock on? Because a house has a front door, a back door, a garage door, a side entrance. A port is like one of those doors. A single device can run many different services at the same time. Your laptop might be running a web browser, an email client, a file sharing app, and a game all at once. Ports help the system figure out which service the incoming data belongs to. Port 80 is the door for web traffic. Port 443 is the secure web door. Port 25 is email. Port 22 is remote command line access. Each service has its own door. That's a port. And finally, protocol. A set of rules that defines how communication happens. Let's go back to our house analogy. Imagine you arrive at someone's door. You knock. They say who's there? You say your name. They open the door. You say hello. They say hello. Come in. There's a process, a sequence. Both parties know the steps. If you did something weird like just standing there silently, the communication breaks down. A protocol is exactly that. A formal agreement between devices on how to start, carry out, and end communication. Rules for formatting data. Rules for handling errors. Rules for when to wait and when to speak. HTTP is a protocol. The rules for loading web pages. DNS is a protocol. The rules for looking up domain names. TCP is a protocol. The rules for reliable data delivery. Don't worry. We'll explore all of these in depth. So, to recap, IP address equals the address of a device, where to send data. Port equals the specific door service on that device, which app gets the data. Protocol rules the rules of communication, how the conversation happens. Got it? Good. Let's build from here. Chapter two, network fundamentals. Types of networks. Okay, now that you know what a network is, let's talk about the different types of networks. Not all networks are the same. The Wi-Fi in your bedroom is very different from the global internet. LAN, local area network. The first type is a LAN. That stands for local area network. This is a small local network, usually covering a single building or a small area. Your home network is a LAN. Your school's computer lab is a LAN. A small office with 20 computers connected together, that's a LAN. Think of it like a neighborhood, a small defined area where everyone is relatively close together. LANs are usually fast because devices are close, data doesn't have to travel far. They're also typically private. You control who gets on your home Wi-Fi. Cyber security relevance. Once an attacker is inside your LAN, they can potentially see all the other devices on it. That's why network segmentation, dividing your LAN into isolated zones, is such an important security concept. WAN, wide area network. A WAN, wide area network, is a network that spans a large geographic area. The internet itself is the biggest WAN in the world. It connects billions of devices across every continent. Companies also have private WANs. For example, a bank with branches in 50 cities might connect all those offices together through a private WAN, so employees in different cities can share files and access the same systems. Cyber security relevance. Traffic traveling over a WAN passes through many hands, ISPs, routers, data centers. That's a lot of opportunities for interception. This is why encryption is so critical when data travels over wide area networks. Other network types, quick overview. Let me quickly mention a few more. MAN, metropolitan area network, covers a city like a university campus network connecting multiple buildings across town. PAN, personal area network, very small, like Bluetooth connecting your phone to your earbuds. WLAN, wireless LAN, just a LAN that uses Wi-Fi instead of cables. Your home Wi-Fi is technically a WLAN. VPN, virtual private network, not exactly a type of network, but a technology that creates a private encrypted tunnel through a public network like the internet. Huge in cyber security. We'll come back to this idea. Network components. Let's talk about the physical things that make networks work. The hardware. Router. A router is the device that connects different networks together and directs traffic between them. In your home, your router connects your homeland to the internet, which is a WAN. Think of a router like a traffic cop at an intersection. Cars come from different directions and the traffic cop decides which way each car should go. The router reads the IP address on each data packet and decides which direction to send it. Cyber security relevance. Routers are prime targets. If an attacker compromises your router, they control everything that flows through it. Weak passwords on home routers are one of the most common security vulnerabilities in the world. Switch. A switch connects multiple devices within the same network. Where a router connects networks, a switch connects devices. Plug your desktop, your laptop, your smart TV into a switch and they can all talk to each other. A switch is smarter than its older cousin, the hub. A hub would broadcast every message to every device on the network, like shouting in a room. A switch is smarter. It sends each message only to the specific device it's meant for. Cyber security relevance. An attack called MAC flooding can overwhelm a switch and force it to act like a hub, broadcasting traffic to everyone. This allows an attacker to capture sensitive data they were never supposed to see. Firewall. A firewall is a security device that monitors and controls network traffic based on rules. Think of it as a bouncer at a club. You have a guest list. If your name is on the list, you get in. If not, you're turned away. A firewall inspects incoming and outgoing traffic and decides what to allow and what to block. It can block traffic based on IP address, port number, protocol, or even more complex patterns of behavior. Cyber security relevance. Firewalls are one of the first lines of defense. Every organization has them. Understanding how they work and how attackers bypass them is fundamental knowledge. Access point. A wireless access point, or WAP, is what creates a Wi-Fi network. It broadcasts a wireless signal that devices can connect to. Your home router usually has a built-in access point. In larger buildings, you'll see dedicated access points mounted on ceilings to provide Wi-Fi coverage. Cyber security relevance. Wireless networks are inherently more vulnerable than wired ones. Data is being broadcast through the air. Anyone within range can attempt to capture it. That's why Wi-Fi encryption like WPA2 or WPA3 matters so much. Network interface card. Every device that connects to a network has ENIC, a network interface card. It's the hardware component inside your device that handles network communication. It could be a physical Ethernet port or a Wi-Fi radio built into your laptop. Every NIC has a unique identifier called a MAC address, which we'll talk about in the IP chapter. How data travels. Packets. Here's something I find genuinely fascinating. When you send a large file over the internet, let's say a 100 megabyte video, it doesn't travel as one giant chunk. It gets chopped up into tiny pieces. These tiny pieces are called packets. Each packet is a small chunk of data, typically between 500 and 1500 bytes. And here's the cool part. Each packet contains not just a piece of the data, but also the source IP, where it came from, the destination IP, where it's going, information about how to reassemble the pieces on the other end, error checking information. So your 100 megabyte video gets broken into thousands of tiny packets. Each packet travels independently through the network. They might even take different routes. One packet might go through Chicago, another through Dallas, another through Atlanta. And then at the destination, they all get reassembled in the right order. This is called packet switching, and it's the fundamental way the modern internet works. Cybersecurity relevance. Attackers use tools called packet sniffers like Wireshark to capture and inspect these packets as they travel across the network. If the data isn't encrypted, they can read everything inside. This is called a packet capture attack, or a sniffing attack. Client server versus peer to peer. There are two main models for how devices interact on a network. Client server model. In the client server model, there are two distinct roles. Clients are devices that request things. Your web browser is a client. When you type in a URL, it sends a request. Hey, can I have this web page? Servers are devices that respond to those requests. A web server receives your request and sends back the page. Most of the internet works this way. Your phone is a client. Netflix, YouTube, Google, they're servers. The server is centralized. It has control. It has the data. Cybersecurity relevance. Servers are juicy targets. They hold data for millions of clients. Attacking the server gets you access to everyone's information at once. This is why servers need the most robust security. In a peer to peer, or P2P model, there's no central server. Every device is both a client and a server simultaneously. Think of BitTorrent. When you download a file via torrent, you're downloading pieces from many users at the same time, and you're also uploading pieces to others. Everyone shares with everyone. Cybersecurity relevance. P2P networks are harder to control and monitor. Malware sometimes uses P2P style communication to avoid detection spreading from device to device without a central command server that could be shut down. Bandwidth and latency. Two terms you'll hear constantly. Let's define them properly. Bandwidth. Bandwidth is the maximum amount of data that can be transferred through a network connection per unit of time. We measure it in bits per second, MBPS, megabits per second, or GBPS, gigabits per second. The highway analogy works perfectly here. Bandwidth is the number of lanes on the highway. More lanes, that's more cars, or more data traveling at the same time. A 100 MBPS connection can handle 100 megabits of data every second under perfect conditions. Latency. Latency is the time it takes for data to travel from source to destination. We measure it in milliseconds. Mess. Lower is better. Back to our highway analogy. Latency isn't about the number of lanes. It's about the speed limit, or better yet, how long the drive actually takes. You can have a massive 10 lane highway, but if the destination is on the other side of the world, it still takes time to get there. Cybersecurity relevance. High latency and sudden changes in bandwidth can be indicators of an attack. For example, a DDoS attack, distributed denial of service floods a network with so much traffic that bandwidth is completely consumed. Legitimate users can't get through. Monitoring bandwidth and latency anomalies is a key part of intrusion detection. Chapter three, the OSI model. Why do we need a model? All right, here we are. The OSI model. This is one of those topics every networking course covers, and with good reason. It's foundational. Once you understand it, so many other concepts just click. But let me be real with you. A lot of people teach the OSI model in a way that makes it feel abstract, boring, just seven layers with names to memorize. I'm going to do it differently. I want you to understand why it exists and why it matters, especially for security. Here's the problem it solves. Back in the early days of networking, every company made its own hardware and software. IBM computers only talked to other IBM computers. D computers only talked to DC computers. Nothing worked together. It was chaos. So in the 1980s, the ISO, that's the International Organization for Standardization, created the OSI model. That stands for Open Systems Interconnection. The OSI model is a conceptual framework, a way to describe how network communication should work. It's divided into seven layers. Each layer has a specific job. Each layer talks to the layer above it and the layer below it. This separation allows different vendors to build different pieces, and as long as each piece does its job correctly, everything works together. Think of it like an assembly line. Each station has one task. The whole line produces the finished product layers, one by one. Let's walk through each layer from the bottom up, from physical hardware to the applications you use every day. Layer one, physical layer. The physical layer is the most basic level. It deals with the actual physical transmission of raw bits, ones and zeros, over a medium. That medium could be copper cables like Ethernet, fiber optic cables, pulses of radio waves, Wi-Fi. This layer defines things like how fast do bits travel, what voltage represents a one versus a zero, what kind of connector does the cable use. No intelligence here, just physics. Bits going in, bits coming out. Cybersecurity relevance. Physical layer attacks include cutting cables, tapping cables to intercept signals, or jamming wireless frequencies. Never underestimate physical security. Layer two, data link layer. The data link layer takes those raw bits from layer one and organizes them into meaningful frames. It also handles MAC addresses, the hardware addresses burned into every network card. At this layer, devices on the same local network identify each other by MAC address. Devices here include switches and NISIs. This layer also provides error detection, making sure bits aren't corrupted in transit. Cybersecurity relevance. ARP spoofing is a layer two attack. ARP, address resolution protocol, maps IP addresses to MAC addresses. An attacker can send fake ARP messages, tricking devices into sending traffic to the wrong MAC address to the attacker's machine instead. Classic man-in-the-middle setup. Layer three, network layer. The network layer handles logical addressing and routing. This is where IP addresses live. It figures out the best path for data to travel from source to destination across different networks. Devices here, routers. Think of the network layer as the navigator. We need to get this packet from New York to Tokyo. What's the route? Cybersecurity relevance. IP spoofing happens here, forging the source IP address to hide where traffic comes from. Many DDoS attacks use IP spoofing to disguise the true attacker. Layer four, transport layer. The transport layer manages end-to-end communication between applications. This is where TCP and UDP live, the two most important transport protocols. This layer handles segmentation, breaking data into segments. Flow control, making sure one device doesn't overwhelm another. Error recovery, retransmission if segments are lost. Port numbers, identifying which application receives the data. Cybersecurity relevance. Port scanning happens here. Hackers use tools like Nmap to probe open ports. A SYN flood attack, a type of DDoS, abuses TCP's handshake at this layer. Layer five, session layer. The session layer manages the lifecycle of communication sessions. Think of a session like a phone call. It starts, you talk, the call ends. The session layer handles that lifecycle. It also manages authentication and synchronization, checkpointing long data transfers so they can resume if interrupted. Cybersecurity relevance. Session hijacking, when an attacker steals an active session. If someone is logged in and the attacker grabs their session token, they can impersonate them without needing a password. Layer six, presentation layer. The presentation layer is about format and translation. It handles data translation, converting formats like ASCII to Unicode, encryption and decryption, scrambling data for security, compression, shrinking data for efficiency. When you connect to a secure website, HTTPS, the SSL TLS encryption operates here. Cybersecurity relevance. Weak or outdated encryption at this layer can be broken, letting attackers read your data. Understanding this layer is key for security analysis. Layer seven, application layer. The application layer is the one users interact with directly. This is where protocols like HTTP, HTTPS, FTP, DNS, SMTP and SSH live. It doesn't mean the application itself, it's the protocols the applications use to communicate. Cybersecurity relevance. Most attacks happen here. SQL injection, XSS, phishing, malware command control all happen at the application layer. This layer is the most exposed because users interact with it and human interaction is always a risk. Memory trick. Need a way to remember the OSI layers? Here's a classic that actually works. Please do not throw sausage pizza away. Physical, data link, network, transport, session, presentation, application. Just go bottom to top. Physical up to application. Say it out loud a few times, it sticks better that way. Now let's talk about one of the most important concepts in networking. Encapsulation. Think of it like sending a package. Each layer on the sending side adds its own wrapping, a label with instructions, addresses or special handling notes. Here's how it works. Application layer adds its header, the actual HTTP data. Transport layer wraps it with a TCP or UDP header, adding port numbers. Network layer wraps it with an IP header, adding source and destination IPs. Data link layer wraps it with a MAC frame header for local delivery. Physical layer converts everything into bits and sends it over cables, fiber or Wi-Fi. On the receiving side, it all comes back up layer by layer. Each layer unwraps its own header, reads it and passes the remaining data up. Going down, that's encapsulation. Coming up, that's decapsulation. Cybersecurity relevance. Attackers can hide malicious payloads deep inside encapsulated packets. A technique called tunneling. For example, malware can sneak inside DNS packets, a layer 7 trick, to exfiltrate data from a network that only allows DNS traffic. This is called DNS tunneling. Real-world example. Loading a web page. Let's tie all of this together with a real-world example. You type HTTPS google.com into your browser. What happens at each OSI layer? Layer 7, application, your browser constructs an HTTP GET request. Layer 6, presentation, TLS encryption is negotiated, data gets encrypted. Layer 5, session, a session is established with Google's server. Layer 4, transport, TCP breaks it into segments, port 443 is assigned. Layer 3, network, IP addresses are added, yours and Google's. Layer 2, data link, MAC addresses are added for local delivery. Layer 1, physical, electrical signals, light pulses or radio waves carry the bits. The response comes back the same way in reverse, and all of that happens in milliseconds. Every single time you load a page. Mind-blowing, right? Chapter 4. What is the TCPIP model? The TCPIP model is the practical model, the one the actual internet runs on. While the OSI model is theoretical, academic, and architectural, TCPIP is real-world. Every device, every website, every packet you send actually uses this model. It was developed by the U.S. Department of Defense in the 1970s as part of the ARPANET project, the ancestor of the internet we know today. The TCPIP model has four layers. Some versions show five, but the classic version has four. One, network access layer, or link layer. Two, internet layer. Three, transport layer. Four, application layer. Mapping TCPIP to OSI. Let's make sense of how TCPIP compares to OSI. Application layer, TCPIP. OSI's application presentation session, layer 765. Transport layer, TCPIP. OSI's transport, layer 4. Internet layer, TCPIP. OSI's network, layer 3. Network access layer, TCPIP. OSI's data link physical, layers 2 and 1. Basically, TCPIP collapses some OSI layers into broader categories. Fewer layers, but everything still works. Layer 1, network access layer. The network access layer handles physically moving data across a local network. This includes cables, Wi-Fi signals, and wireless radios, data link Protocols here include Ethernet and Wi-Fi, 802.11. Layer 2, internet layer. The internet layer handles logical addressing and routing between networks. This is where IP lives, both IPv4 and IPv6. Other key protocols here, ICMP, internet control message protocol. Ever run ping? That's ICMP, checking if a device is alive. ARP, address resolution protocol, maps IP addresses to addresses on a local network. Cyber security relevance, ping is often one of the first tools an attacker or a security analyst uses to see which devices are alive. Tools like NMAP scan networks using ICMP and TCPIP techniques. Layer 3, transport layer. The transport layer manages end-to-end delivery between applications. Two main protocols live here, TCP, transmission control protocol, reliable, ordered, ensures all data arrives intact. UDP, user datagram protocol, fast connectionless, no guarantee of delivery. This is also where port numbers live, deciding which application gets which data. Layer 4, application layer. The application layer in TCPIP is much bigger than in an OSI. It includes the application, presentation, and session responsibilities all in one. All application protocols live here. HTTP, HTTPS, web browsing, DNS, domain name resolution, SMTP, IMAP, POP3, email sending and receiving, FTP, SFTP, file transfer, SSH, secure remote access, DHCP, automatic IP address assignment, Telnet. Old, insecure remote access. Don't use this. Cyber security relevance, every one of these protocols has vulnerabilities. FTP sends everything in plain text. Telnet, plain text too, including passwords. DNS can be manipulated. SMTP, often abused for spam or phishing. Knowing which protocols are secure and which aren't is foundational security knowledge. Why learn both models? You might be wondering, if TCPIP is what actually runs the internet, why bother with OSI? Great question. OSI gives you a mental framework. When something breaks, you can ask, is this a layer 3 problem? Layer 7? It helps diagnose and categorize network issues. TCPIP is what actually works. You need both. OSI for thinking and troubleshooting. TCPIP for real-world implementation. Security certifications like CompTIA Security Plus and CEH test you on both. And every real cyber security job expects you to know both. Chapter 5. Chapter 5, IP addresses and addressing. What is an IP address? Alright, let's dive into IP addresses. The way devices find each other on a network. An IP address, short for internet protocol address, is a number that identifies every device connected to a network. It does two things. One, identification, tells the network who this device is. Two, location, tells the network where this device is. Think of it like your home address. It tells the world who you are and where to deliver the data. There are two versions in use today, IPv4 and IPv6. IPv4, IPv4 or internet protocol version 4 is the original version and still the one most widely used. An IPv4 address looks like this. 192.168.1.100. It has four numbers separated by dots. Each number is between 0 and 255. In computers, each number is 8 bits, so the full address is 32 bits long. That gives us about 4.3 billion possible addresses. Sounds like a lot, right? But here's a problem. There are over 8 billion people on earth and most people own multiple devices. We literally ran out of IPv4 addresses. This happened around 2011. We've been stretching IPv4's life with tricks like NAT, or network address translation, but the problem remains. IPv4 just isn't enough anymore. IPv6, enter IPv66 or internet protocol version 6, the new future-proof version. An IPv6 address looks something like 2001 colon 0db8 colon 85a3 colon 000 and so on. 8 groups in total. IPv6 is 128 bits long. That means the number of possible addresses is basically unimaginable. To put it in perspective, that's enough addresses to give every atom on the surface of the earth its own IP address and still have plenty left over. We are never running out of IPv6 addresses. Ever. Cybersecurity note, IPv6 adoption is slower than expected. Many networks still run both IPv4 and IPv6 at the same time, called dual stack. If firewalls or security tools aren't set up to handle IPv6, attackers can use it as a blind spot. Always make sure your security controls cover both protocols. Public versus private IP addresses. Not all IP addresses are created equal. Some are public, some are private. Public IP addresses. A public IP is globally unique and can be reached from the internet. Google's servers have public IPs. That's how your browser finds them. Your home network has a public IP too, assigned by your ISP or internet service provider. This is the address the world sees when you connect to websites. Private IP addresses. A private IP is used only inside your local network. It cannot be accessed from the internet. Common private IP ranges include 10.0.0.0 to 10.255.255.255, 172.16.0 to 172.31.255.255, 192.168.00 to 192.168.255.255. Your home router gives your devices private IPs. Laptop might be 192.168.1.5. Phone might be 192.168.1.6. These addresses only work inside your home network. But here's the big question. If devices have private IPs, how do they talk to the internet? That's where NAT comes in. It converts private IPs to public ones so your devices can send and receive data online. NAT. Network Address Translation. This is where NAT comes in. Network Address Translation is what your router uses to let multiple devices share a single public IP address. Let's make this real. Your laptop might have a private IP like 192.168.1.5. Now when your laptop sends a request to Google, your router steps in. It replaces your laptop's private IP with its own public IP address, sends the request out to the internet, and keeps track of that translation. When the response comes back, the router checks its records, converts the public IP back into your laptop's private IP, and delivers the data to the correct device. All of this happens in milliseconds. You never even notice it. NAT basically hides your internal network from the outside world. It's not a full security solution, but it adds a layer of obscurity. Cybersecurity relevance. NAT can make forensic investigations tricky. If you see traffic coming from a public IP like 203.0.113.50, that might not be one device. It could be a router representing hundreds of internal devices. To find the real source, you need logs from the NAT device itself. Static versus dynamic IP addresses. Now let's talk about how IP addresses are assigned. There are two types, static and dynamic. A static IP address is manually set and it doesn't change. Servers usually use static IPs because you always need to find them at the same address. A dynamic IP address is assigned automatically by something called a DHCP server, dynamic host configuration protocol. These IPs can change over time. Most home devices use dynamic IPs. Even your ISP may change your public IP occasionally. Cybersecurity relevance. There's an attack called DHCP starvation. An attacker floods the network with fake requests until all available IP addresses are used up. Now legitimate devices can't connect. Then the attacker sets up a rogue DHCP server, handing out fake IP addresses and secretly routing traffic through themselves. That's a classic man-in-the-middle attack. Special IP addresses. Some IP addresses have special meanings. You'll see these again and again. Localhost 127.0.1 127.0.0.1. This is called the loopback address. It always refers to your own device. When you open a browser and go to localhost, you're talking to yourself. Cybersecurity relevance. Malware sometimes uses localhost to run hidden services in the background. Understanding this is important for analysis. Default gateway. The default gateway is your router's IP address. Usually something like 192.168.1.1 or 192.168.0.1. Whenever your device needs to send data outside your network, it sends it to the gateway first. Broadcast address. A broadcast address sends data to every device on a network at once. For example, 192.168.1.255. Cybersecurity relevance. Old attacks like smurf attacks abuse this, sending fake requests so that every device responds to a victim, overwhelming it with traffic. MAC addresses. Now let's talk about another type of address. The MAC address. MAC stands for media access control. This is a hardware address built into your device's network card. It looks like this. 00 colon 1, A colon 2, B colon 3, C colon 4, D colon 5, E. Six pairs of characters, usually in hexadecimal. MAC addresses work at the data link layer. That's layer two. They're used for communication within a local network only. When data moves across networks, the MAC address changes, but the IP address stays the same. Cybersecurity relevance. MAC spoofing is very easy. An attacker can change their MAC address to impersonate another device, bypass restrictions, or hide their identity. Subnetting. Networks within networks. Now here's a concept that confuses a lot of people at first. Subnetting. A subnet is simply a smaller network inside a bigger one. Why do we do this? For organization, for performance, and most importantly, for security. Think of it like an apartment building. The building has one main address, but inside there are many separate apartments. Each one is isolated. Subnet mask. A subnet mask tells us which part of an IP address is the network and which part is the device. For example, IP address 192.168.1.5. Subnet mask 255.255.255.0. The 255 parts represent the network. The zero part represents the devices. This means the network includes addresses from 192.168.1.1 to 192.168.1.254. That gives us 254 devices. Cedar notation. Instead of saying the full subnet mask, we often use cedar notation. So instead of 255.255.255.0, we just say slash 24. That means 24 bits are for the network. So 192.168.1.0.24 describes the whole network. Common examples. Slash 8, very large network. Slash 16, large network. Slash 24, small network. Slash 30, network. Usually point to point. Cybersecurity relevance. Subnetting is one of the most powerful security tools. You can separate systems into different zones, web servers in one subnet, databases in another, employee devices in another, and control traffic between them. So if an attacker breaks into one subnet, they can't automatically access everything else. That's called reducing the blast radius. Chapter six, ports and protocol. What is a port? All right, let's come back to that apartment analogy. Because it makes this super clear. Imagine you send a letter to a large apartment building. The address gets your letter to the building, but it doesn't tell you which apartment to deliver it to. That's where the port comes in. The IP address gets data to the device. The port number gets it to the right application on that device. A port is simply a communication endpoint identified by a number. Ports range from zero up to 65,535. So when a server receives traffic on port 80, it knows this is web traffic. On port 443, that's secure web traffic. On port 22, that's secure remote access. Each port is like a specific door for a specific service. Port ranges. Ports are divided into three main categories. Well-known ports. These go from zero to 1023. These are reserved for standard services. Examples, HTTP, port HTTPS, port 443, SSH, port 22, DNS, port 53, FTP, port 21. These usually require administrator privileges to use registered ports. These range from 1024 to 49,151. These are assigned to specific applications. MySQL, port 3306. PostgreSQL, port 5432. Remote desktop, port 3389. Alternate web, port 8080. Dynamic or ephemeral ports. These range from 49,152 to 65,535. These are temporary ports. When your browser connects to a website on port 443, it also opens a random temporary port on your side. And so the server knows exactly where to send the response back. Critical port numbers to know. These are the ports you should know instantly. No thinking. FTP, ports 20 and 21. SSH, port 22. Telnet, port 23. SMTP, port 25. DNS, port 53. DHCP, ports 67 and 68. HTTP, port 80. POP3, port 110. IMAP, port 143. HTTPS, port 443. MySQL, port 3306. RDP, port 3389. HTTP alternate, port 8080. Cybersecurity relevance. One of the first things attackers do is port scanning. They use tools like Nmap to see which ports are open. Open ports mean services are running, and running services might have vulnerabilities. That's why a key security rule is simple. If you don't need a port, close it. This is called reducing your attack surface. Key protocols explained. Now let's go deeper into the protocols themselves. DNS, domain name system. Let me ask you something. Do you know Google's IP address? Probably not. And you don't need to. You type google.com, and it just works. But behind the scenes, that name has to be converted into an IP address. Because computers don't understand names, they understand numbers. That's what DNS does. DNS is basically the phone book of the internet. You give it a name, it gives you a number. Here's what happens step by step. One, you type google.com into your browser. Two, your device checks its local memory, called the DNS cache. Three, if it doesn't find it, it asks a DNS resolver, usually your ISP or something like 8.8.8.8.4. If the resolver doesn't know, it asks the root servers. The root servers point to .com servers. Six, those point to the official Google servers. Seven, the correct IP address is returned. Eight, it gets saved for next time. Nine, your browser connects to that IP. And all of this happens in milliseconds. Cybersecurity relevance. DNS can be attacked. In DNS spoofing, an attacker tricks your system into believing a fake IP address is real. So you think you're visiting your bank, but you're actually on a fake website controlled by the attacker. There's also DNS tunneling, where attackers hide data inside DNS requests to secretly send information out of a network. HTTP and HTTPS. Let's talk about the protocols you use every single day without even thinking about it. HTTP, short for hypertext transfer protocol, is what your browser uses to request web pages. At its core, it's simple. Your browser sends a request like get slash index dot HTML using HTTP version 1.1, for example, .com. And the server responds with the page content. That's how websites load. But here's the problem. HTTP is completely unencrypted. Everything is sent in plain text. If someone intercepts that traffic, they can read everything. Usernames, passwords, session data, everything. Now this is where HTTPS comes in. HTTPS stands for HTTP secure. It's basically HTTP wrapped inside encryption using something called TLS, transport layer security. This encryption protects the data while it's traveling. It also verifies the identity of the server using a digital certificate. That's why you see the little padlock icon in your browser. Cybersecurity relevance. If you use plain HTTP on a network, your data can be captured and read. That's why HTTPS is non-negotiable today. And as a security professional, you'll use tools like Burp Suite to intercept and analyze web traffic, especially when testing web applications. SMTP, IMAP, and POP3, email protocols. Now let's talk about email. Sending and receiving emails actually involves multiple protocols working together. First, SMTP, simple mail transfer protocol. This is used for sending emails. When you hit send, SMTP takes your email from your device to your mail server and then between servers until it reaches the destination. Common ports are 25, 587, and 465. Next, IMAP, internet message access protocol. This is used for reading emails while keeping them on the server. So if you check your email on your phone and then on your laptop, everything stays synced. Ports, 143 and 993 for secure connections. Then there's POP3, post office protocol version 3. This downloads emails to your device and usually removes them from the server. Ports, 110 and 995 for secure connections. Cybersecurity relevance. Email is the number one attack vector in the world. Phishing attacks rely heavily on these protocols. And here's the issue. SMTP was designed in a time when the internet was more trusting. It has very little built-in security. That's why we now use protections like SPF, DKIM, DMARC. These help verify that an email is actually coming from who it claims to be. Understanding this is critical in investigating phishing attacks. SSH, secure shell. Now let's talk about SSH, secure shell. SSH runs on port 22 and it allows you to remotely access a system's command line securely. Before SSH, there was Telnet. And Telnet was a nightmare. Everything was sent in plain text. If someone was watching the network, they could see every command you typed, including your password. SSH fixed that. It encrypts everything. It also supports key-based authentication. Instead of typing a password, you use a cryptographic key. Much more secure. Cybersecurity relevance. SSH is constantly targeted by attackers. Bots scan the internet looking for port 22 and try thousands of username and password combinations. Best practices include disable password login, use key-based authentication, change the default port, use tools like fail to ban to block repeated failed attempts. FTP and SFTP. Finally, let's talk about file transfer. FTP. File transfer protocol uses ports 20 and 21. It's old and it's insecure. It sends everything in plain text, including usernames and passwords. So honestly, avoid using plain FTP. Instead, use SFTP, secure file transfer protocol. This runs over an SSH connection, meaning everything is encrypted and secure. There's also FTPS, which is FTP with encryption added on top using TLS. Cybersecurity relevance. If you find an open FTP port on a system, that's a red flag. Old FTP servers often have vulnerabilities. And one of the worst misconfigurations is anonymous FTP, where anyone can log in without credentials. This has exposed sensitive data countless times. Chapter 7. TCP versus UDP. Why two transport protocols? Alright, we've mentioned TCP and UDP a few times already. Now it's time to really understand them. Here's the big question. Why do we even have two transport protocols? Why not just one? Because different situations need different things. Sometimes you need perfect reliability. Every single piece of data must arrive in order with zero errors. Other times you need speed. You want data to move fast, even if a small piece gets lost along the way. In some cases, a delay is worse than losing a tiny bit of data. So here's the simple idea. TCP is built for reliability. UDP is built for speed. TCP transmission control protocol. Let's start with TCP. TCP is reliable, ordered, and connection-based. Connection-based means before any data is sent, a connection is first established between the client and the server. There's a proper beginning, a structured conversation, and a clean ending. The three-way handshake. Every TCP connection starts with something called the three-way handshake. Think of it like knocking on a door and confirming both sides are ready. Step one, SYN. The client says, hey, I want to connect. Step two, SYN ACK. The server replies, I hear you and I'm ready. Step three, ACK. The client confirms, perfect, let's start. And just like that, the connection is established. When the communication ends, TCP also performs a clean shutdown using a four-step process. FIN, ACK, FIN, ACK. TCP also guarantees correct order. Data arrives exactly as it was sent. Acknowledgement. The receiver confirms every piece. Retransmission. If something is lost, it gets sent again. Flow control prevents one side from overwhelming the other. When to use TCP. Use TCP when reliability matters more than speed. For example, web browsing, email, file transfers, databases, secure remote access. Imagine loading a website and a few pieces of data go missing. You'd see broken images, missing text, or a completely messed up page. TCP makes sure that never happens. Cybersecurity side of TCP. Now here's where things get interesting. TCP can be exploited. One classic attack is the SYN flood attack. Here's how it works. An attacker sends a huge number of connection requests and SYN packets to a server. The server responds and waits for the final confirmation. But the attacker never sends that final step. So the server is stuck holding thousands, even millions, of half-open connections. Eventually it runs out of resources. Real users can't connect anymore. That's a denial of service attack. Modern systems defend against this using techniques like SYN cookies, rate limiting. Another important concept is TCP port scanning. Attackers use tools to check which ports are open. Sometimes they complete the full connection. Other times they send a SYN, get a response, and immediately cancel the connection. This is called a stealth scan because it leaves fewer traces. UDP, user datagram protocol. Now let's switch to UDP. UDP is fast, connectionless, and yes, technically unreliable. But don't let that word scare you. In this context, unreliable just means there's no guarantee that data will arrive. UDP does not establish a connection, wait for acknowledgments, retransmit lost data. It simply sends the data and moves on. No setup, no confirmation, no delay. Just send and go. And that's exactly why UDP is so powerful. Because sometimes speed matters more than perfection. When to use UDP. Use UDP when speed matters more than perfect reliability. Here are some real world examples. DNS. A simple question and answer. Speed is everything. If it fails, you just ask again. Video streaming and voice calls. A small glitch, a dropped frame, or a tiny audio cut is better than the entire video freezing while waiting for lost data to be resent. Online gaming. Your position in the game needs to update right now, not 100 milliseconds later after a retransmission. DHCP. When your device doesn't even have an IP yet, it sends broadcast requests. That works best with UDP. SNMP. Used for network monitoring, where speed and efficiency matter. TFTP. A simple file transfer protocol used in controlled environments. UDP and application level reliability. Now here's something really important and a bit advanced. Some modern applications use UDP, but still build their own reliability on top of it. A perfect example is QUIC, the protocol behind HTTP version 3. QUIC runs over UDP, but adds its own system for ordering data, handling errors, recovering lost packets. So it combines the speed of UDP with the reliability of TCP, but in a smarter, more flexible way. Cyber security side of UDP. Now let's talk about the security side. Because UDP is connectionless, it's much easier to fake the source of a packet. There's no handshake, no verification. That makes UDP perfect for a powerful type of attack called an amplification attack. Here's how it works. An attacker sends a small request, but fakes the source IP address, making it look like the request came from the victim. That request goes to a server, like a DNS server. The server responds, but the response is much larger than the request. And it sends that response to the victim. Now imagine this happening, not once, but thousands of times from thousands of servers. The victim gets flooded with massive amounts of traffic they never even asked for. This is called a reflection and amplification attack. Reflection, because the traffic is bounced off other servers. Amplification, because small requests turn into large responses. A classic example is DNS amplification. Another is NTP amplification, where a tiny request can generate a response hundreds, even thousands of times larger. These are among the most powerful DDoS attacks used today. TCP versus UDP, quick comparison. Let's wrap this up with a simple comparison. Think of it like this. TCP is careful, reliable, and structured. UDP is fast, lightweight, and flexible. Here's the breakdown. Connection. TCP establishes a connection first. UDP just sends data instantly. Reliability. TCP guarantees delivery. UDP makes no guarantees. Ordering. TCP keeps everything in order. UDP doesn't care about order. Speed. TCP is slower due to overhead. UDP is faster because it skips all that. Error handling. TCP handles errors automatically. UDP leaves it to the application. Header size. TCP has a larger header. UDP has a very small, lightweight header. Final intuition. If your data must arrive perfectly, use TCP. If your data must arrive quickly, use UDP. And once you truly understand that difference, you've just unlocked one of the most important concepts in networking. Chapter eight, summary, and the big picture. Putting it all together. We've covered a lot of ground today. Now I want to do something special. I want to walk you through one single moment. The moment you type a URL into your browser and hit enter. And trace every single thing we learned from start to finish. This is the full picture. The journey. User, DNS, IP port, protocol, server, response. You type https://example.com and hit enter. Simple enough. But what just happened? Your browser received a text string and now it needs to figure out what to do with it. Step two, DNS resolution. Your browser needs an IP address. So it sends a DNS query using UDP on port 53 to your configured DNS resolver. Maybe 8.8.8.8 or your router. The resolver walks up the DNS hierarchy, root servers, top level domain servers, authoritative servers, and comes back with the answer example.com is at 93.184.2.16.34. Your browser now has a destination IP. Cyber security moment. If an attacker has poisoned your DNS, they could return a different IP sending you to a fake site. This is why DNSSEC and DNS over HTTPS matter. Step three, IP routing. Your device prepares a packet destined for 93.184.2.16.34. It checks, is this IP on my local network? No. So it sends the packet to its default gateway, your router. The router looks at its routing table and decides the next hop may be your ISPs router, which passes it to another router, which passes it to another. Each router at layer three reads the IP header, makes a routing decision, and forwards the packet. Cyber security moment. IP spoofing can manipulate source addresses. BGP hijacking, attacking the routing system of the internet can redirect traffic at massive scale. In 2010, a misconfiguration caused 15% of global internet traffic to route through China telecom for 18 minutes. Step four, TCP three-way handshake. Your device wants to connect to that IP on port 443, which is HTTPS. So TCP begins its handshake. SYN, from your device to the server. SYNACK, from the server back to you. ACK, you confirm connection established. Cyber security moment. These handshake packets can be captured by packet sniffers, which is why encryption is critical, not just for data, but even for session details. Step five, TLS handshake, encryption setup. Since this is HTTPS, before any real data flows, a TLS handshake happens. Your browser and the server negotiate which encryption algorithm to use, exchange certificates to verify identity, exchange encryption keys. After this, everything is encrypted. Even if someone captures the packets, they'll only see unreadable data. Cyber security moment. SSL stripping attacks try to downgrade HTTPS to HTTP. Fake certificates can trick users into trusting malicious servers. And HSTS, HTTP strict transport security, forces browsers to always use HTTPS. Step six, HTTP request. Now your browser sends an HTTP request securely over HTTPS. It looks like this. Get slash HTTP version 1.1 host example.com user agent and other details. This request travels as TCP segments wrapped inside IP packets all the way to the server. Cyber security moment. HTTP headers contain a lot of information, your browser, your system, cookies, tokens. Attackers analyze this data during reconnaissance. Security headers like content security policy and X-frame options help protect against attacks like cross-site scripting and click jacking. Step seven, server processing and response. The web server receives your request, processes it, and sends back a response. Something like HTTP version 1.1 200 OK, content type, text, HTML, and then the actual web page content. That response begins its journey back to you. It's broken into TCP packets sent across the internet, routed through multiple networks until it reaches your device. TCP then steps in again, reassembling everything in the correct order. And if anything is missing, it requests it again. Nothing is left incomplete. Cyber security moment. The network may have delivered your request safely, but the server itself can still be vulnerable. SQL injection in the application, unpatched software on the system, misconfigured permissions. This is a completely different battlefield. Step eight, rendering. Now your browser receives the HTML, parses it, and starts building the page. It requests additional resources, CSS files, JavaScript, images, each one triggering more DNS lookups, more HTTP requests, more activity behind the scenes. And finally, the page is Every single step has a potential attack. DNS can be poisoned, IP routing can be hijacked, TCP connections can be flooded, encryption can be downgraded or broken, headers can leak sensitive information, applications can be exploited, servers can be misconfigured, even the physical network can be tapped. This is why cybersecurity is not just one skill. It's layers, exactly like the OSI model. Real security professionals think in layers. They don't rely on one defense. They build defense in depth. So even if one layer fails, the entire system doesn't collapse. What you've learned today, let's quickly bring everything together. You learned the basics of networking, what a network is, how devices connect and how data moves. You understood the OSI model, all seven layers and where attacks happen in each one. You explored the TCP IP model, the real world version of networking and the key protocols that power the internet. You learned IP addressing, IPv4, IPv6, public and private IPs, NAT, subnetting, CIDR. You understood MAC addresses and how devices communicate at the local level. You explored ports and protocols, how services are identified and how communication actually happens. You compared TCP and UDP, reliability versus speed and when to use each. And most importantly, you saw the full journey from typing a website to receiving a response with attack surfaces at every step. What's next? If you've made it this far, seriously, well done. This is foundational knowledge that will stay with you for your entire cybersecurity journey. But here's the truth. Theory alone is not enough. You need to practice. Open Wireshark and capture your own network traffic. Watch a DNS query happen in real time. See the TCP handshake. Watch encryption take over. Run Nmap on your home network. Scan your devices. See which ports are open. See what services are running. Use ping. Use tracer out. Watch how data moves across the internet. Set up a virtual machine and experiment freely without risk. Because at the end of the day, the network is the foundation. Everything in cybersecurity, whether attack or defense, runs on top of it. Understand the network and you start to understand everything. If this helped you, take a second to like the video and share it with someone who might need it. Because one share can actually help someone learn something valuable. And if you're enjoying this content, consider subscribing. It genuinely helps me keep creating videos like this. Drop a comment. What was the one thing that really clicked for you today? And if you want the next video, make sure you're subscribed so you don't miss it. Transcribed by https://otter.ai