1.5.1 Network Fundamentals
Understand how devices connect, communicate, and expose security risk
The networking hub introduced the big picture. This page breaks that picture into the pieces you will keep seeing in security work: network scope, topology, addressing, device identity, traffic direction, and the basic commands used to inspect a system.
1. What is a Network?
Simple Definition
A network is a group of two or more devices connected together to share resources, exchange data, and communicate with each other.
Technical Definition
A computer network is an interconnected collection of computing devices, including computers, servers, switches, routers, and other hardware, that uses transmission media (wired or wireless) and communication protocols to enable data exchange and resource sharing.
Purpose of Networking
- Resource Sharing: Printers, files, storage, software applications
- Communication: Email, messaging, video calls, VoIP
- Data Transfer: Moving files between devices quickly and reliably
- Centralized Management: Managing users, permissions, and policies from one place
- Cost Efficiency: Share expensive resources instead of buying for each user
Think of a network like a postal system:
- Your Device = Your house (has a unique address)
- IP Address = Your postal address
- Router = Post office (routes mail to the right destination)
- Packets = Letters/packages being sent
- Protocols = Rules for addressing and delivering mail
Once that basic idea is clear, the next question is scope. A small private network, a company intranet, and the public internet all move data, but they are owned, accessed, and secured in different ways.
2. Network vs Internet
Many beginners confuse "network" with "internet." They are related, but they are not the same thing.
| Aspect | Network | Internet |
|---|---|---|
| Definition | A group of connected devices | A global network of networks |
| Scope | Limited (local, private) | Worldwide (public) |
| Ownership | Single entity (home, company) | No single owner |
| Access | Restricted/controlled | Publicly accessible |
| Example | Office LAN, home WiFi | www, email services |
Intranet vs Extranet vs Internet
Intranet
A private network accessible only within an organization.
- Internal websites and apps
- Employee-only access
- Protected by firewall
Extranet
An extended intranet that allows limited access to authorized external users.
- Partner/vendor access
- Controlled external sharing
- VPN or secure login
Internet
The global public network connecting billions of devices worldwide.
- Open to everyone
- Uses TCP/IP protocols
- WWW, email, streaming
With scope defined, it becomes easier to classify networks by size, purpose, and who is allowed to use them.
3. Types of Networks
Network type describes the size and purpose of the network. A home LAN, a campus network, and a global WAN all need different design and security decisions.
Primary Network Types
| Type | Full Form | Range | Example |
|---|---|---|---|
| PAN | Personal Area Network | ~10 meters | Bluetooth devices, USB connections |
| LAN | Local Area Network | Building/Campus | Office network, school lab |
| MAN | Metropolitan Area Network | City (~50 km) | Cable TV network, city-wide WiFi |
| WAN | Wide Area Network | Global | The Internet, corporate VPNs |
Additional Network Types
| Type | Full Form | Description |
|---|---|---|
| CAN | Campus Area Network | Multiple LANs within a campus (university, business park) |
| SAN | Storage Area Network | High-speed network for data storage devices |
| WLAN | Wireless Local Area Network | LAN using WiFi instead of cables |
| VPN | Virtual Private Network | Encrypted tunnel over public network |
- PAN: Bluetooth vulnerabilities, device pairing attacks
- LAN: ARP spoofing, VLAN hopping, insider threats
- WLAN: Evil twin attacks, WPA cracking, deauth attacks
- WAN: DDoS attacks, MitM, traffic interception
4. Network Topologies
Topology refers to the physical or logical arrangement of devices in a network.
Bus Topology
All devices connect to a single backbone cable. Simple but a single point of failure.
Star Topology
All devices connect to a central switch/hub. Most common in modern networks.
Ring Topology
Each device connects to exactly two other devices, forming a circle.
Mesh Topology
Every device connects to every other device. Highly redundant but expensive.
Topology Comparison
| Topology | Pros | Cons | Use Case |
|---|---|---|---|
| Bus | Simple, cheap | Single point of failure | Small temp networks |
| Star | Easy to manage, scalable | Hub failure = network down | Offices, homes |
| Ring | Equal access, ordered | One break = network down | Token Ring (legacy) |
| Mesh | Highly redundant | Expensive, complex | ISPs, data centers |
| Hybrid | Flexible, scalable | Complex design | Large enterprises |
| Tree | Hierarchical, scalable | Root failure = critical | WAN backbones |
- Bus: traffic is easy to sniff because all devices share the same path
- Star: the central switch is important because traffic depends on it
- Ring: traffic passes through neighboring nodes, which can create interception points
- Mesh: multiple paths improve resilience and make disruption harder
5. Transmission Modes
Transmission mode defines the direction of data flow between devices.
| Mode | Direction | Example | Visual |
|---|---|---|---|
| Simplex | One-way only | Keyboard to computer, radio broadcast | A ------> B |
| Half-Duplex | Both ways, one at a time | Walkie-talkie, old WiFi | A <-----> B |
| Full-Duplex | Both ways simultaneously | Phone call, modern Ethernet | A <====> B |
6. Network Architecture
After you know how traffic flows, look at who provides services. Architecture explains whether devices depend on central servers or share resources directly with each other.
Client-Server
Centralized model where servers provide resources and clients request them.
- Centralized control
- Easier to manage/secure
- Server = single point of failure
- Example: Web servers, file servers
Peer-to-Peer (P2P)
Decentralized model where each device acts as both client and server.
- No central authority
- Harder to manage/secure
- More resilient (no single failure point)
- Example: BitTorrent, small home networks
Comparison Table
| Aspect | Client-Server | Peer-to-Peer |
|---|---|---|
| Control | Centralized | Distributed |
| Security | Easier to enforce policies | Harder to secure uniformly |
| Scalability | Requires server upgrades | Scales naturally with peers |
| Cost | Higher (servers needed) | Lower (no dedicated servers) |
| Failure Impact | Server down = major impact | One peer down = minimal impact |
- Client-Server: a server compromise can expose many clients or shared data
- P2P: malware can spread peer-to-peer and can be harder to track or contain
7. IP Addressing Basics
IPv4 vs IPv6
| Feature | IPv4 | IPv6 |
|---|---|---|
| Format | 192.168.1.1 | 2001:0db8:85a3::8a2e:0370:7334 |
| Bits | 32-bit | 128-bit |
| Total Addresses | ~4.3 billion | ~340 undecillion |
| Notation | Decimal (dots) | Hexadecimal (colons) |
Public vs Private IP Addresses
| Type | Description | Ranges |
|---|---|---|
| Public | Globally unique, routable on internet | Assigned by ISPs |
| Private | Used within local networks, not routable | See below |
Private IP Address Ranges (RFC 1918)
| Class | Range | CIDR | Common Use |
|---|---|---|---|
| A | 10.0.0.0 - 10.255.255.255 | 10.0.0.0/8 | Large enterprises |
| B | 172.16.0.0 - 172.31.255.255 | 172.16.0.0/12 | Medium networks |
| C | 192.168.0.0 - 192.168.255.255 | 192.168.0.0/16 | Home networks |
Special IP Addresses
- 127.0.0.1: Loopback (localhost, refers to your own machine)
- 0.0.0.0: Default route or "all interfaces"
- 255.255.255.255: Broadcast (send to all devices on network)
- 169.254.x.x: APIPA (auto-assigned when DHCP fails)
CIDR Notation Basics
CIDR (Classless Inter-Domain Routing) notation represents IP ranges efficiently.
- 192.168.1.0/24 = 256 addresses (192.168.1.0 to 192.168.1.255)
- /24 means 24 bits for network, 8 bits for hosts
- Smaller number = more hosts (e.g., /16 = 65,536 addresses)
8. MAC Address
What is a MAC Address?
A MAC (Media Access Control) address is a unique hardware identifier burned into every network interface card (NIC) by the manufacturer.
Format
AA:BB:CC:DD:EE:FF (colon notation)
AA-BB-CC-DD-EE-FF (hyphen notation)
AABB.CCDD.EEFF (Cisco notation)
- 48 bits (6 bytes) in total
- First 3 bytes: OUI (Organizationally Unique Identifier), identifies manufacturer
- Last 3 bytes: NIC Specific, unique to the device
MAC vs IP Address
| Aspect | MAC Address | IP Address |
|---|---|---|
| Layer | Layer 2 (Data Link) | Layer 3 (Network) |
| Assigned By | Manufacturer | Network admin / DHCP |
| Permanence | Usually permanent* | Can change |
| Scope | Local network only | Can be global (public IP) |
| Format | Hexadecimal (48 bits) | Decimal/Hex (32/128 bits) |
Despite being "permanent," MAC addresses can be changed/spoofed using software tools. Attackers use MAC spoofing to:
- Bypass MAC-based access controls
- Impersonate trusted devices
- Evade network monitoring
- Perform ARP poisoning attacks
9. Essential Commands
# View IP configuration and MAC address
ipconfig /all
# View only IP address info
ipconfig
# Release DHCP lease
ipconfig /release
# Renew DHCP lease
ipconfig /renew
# Flush DNS cache
ipconfig /flushdns
# View ARP table (IP to MAC mappings)
arp -a
# View routing table
route print# View IP and MAC address (modern)
ip a
ip addr show
# View IP and MAC address (legacy)
ifconfig
# View only IP addresses
ip -4 addr show
# View ARP table
arp -a
ip neigh show
# View routing table
ip route show
route -n
# View DNS configuration
cat /etc/resolv.conf# Test connectivity (Windows)
ping 8.8.8.8
ping google.com
# Test connectivity (Linux - limit to 4 packets)
ping -c 4 8.8.8.8
ping -c 4 google.com
# Trace route to destination (Windows)
tracert google.com
# Trace route to destination (Linux)
traceroute google.com
# DNS lookup
nslookup google.com
# View open connections
netstat -an10. Real Use Cases
The terms above become useful when you can connect them to normal admin and security tasks.
Setting Up a Home Network
When configuring a home network, you'll apply these concepts:
- Your router creates a LAN using Star topology
- Router acts as DHCP server assigning private IPs (192.168.x.x)
- Uses NAT to share one public IP among all devices
- WiFi creates a WLAN overlay
Corporate LAN Segmentation
Enterprise networks use these concepts for security:
- VLANs separate departments (HR, Finance, IT)
- Different subnets for different security zones
- Client-server architecture with domain controllers
- Hybrid topology with redundancy
Security Audit Starting Point
When performing a security assessment:
- Identify network topology: how devices are connected
- Map IP ranges and subnets in use
- Catalog network types: wired vs wireless
- Understand architecture: client-server relationships
- Document entry points: internet-facing systems
11. Security Corner
Before exploiting vulnerabilities, pentesters need to understand the target environment. Network fundamentals enable:
- Reconnaissance: Mapping the target network structure
- Enumeration: Identifying active hosts, services, and topology
- Attack Planning: Understanding which attacks are feasible
- Lateral Movement: Knowing how to pivot through the network
Attack Surface Differences
| Network Exposure | Attack Surface | Common Attacks |
|---|---|---|
| LAN Exposure | Internal attackers, compromised devices | ARP spoofing, VLAN hopping, credential theft |
| WAN Exposure | Internet-facing services | DDoS, port scanning, web exploits |
| Wireless Exposure | Anyone within radio range | Evil twin, deauth, handshake capture |
12. Knowledge Check Quiz
Test your understanding with these 10 questions.