Networking
Everything I Learned About Computer Networking During My Cybersecurity Internship
When I started my internship, my supervisor told me something that stuck with me: “You can’t secure a network if you don’t understand how it actually works.” At first I thought I already knew networking, I mean, I’d passed the course, right? Turns out there’s a big difference between passing an exam and actually being able to explain concepts to someone else. This blog is basically me doing that. I’m writing this the way I wish someone had explained it to me on day one, no jargon overload, just plain language, real examples, and the stuff that actually matters when you’re troubleshooting or securing a network.
So grab a coffee, and let’s go through the entire networking module, one topic at a time.
1. Introduction to Computer Networking
At its core, a computer network is just a bunch of devices, laptops, phones, servers, printers, whatever, connected together so they can share data. That’s it. Every time you send a WhatsApp message, stream a video, or open a website, you’re using a network to move data from one device to another.
Networks exist because devices working alone are boring and limited. You want your laptop to talk to a printer down the hall, or to a server on the other side of the planet. Networking is the set of rules and hardware that makes that possible.
There are different types of networks based on size:
LAN (Local Area Network): Your home Wi-Fi or your office network. Small area, high speed.
MAN (Metropolitan Area Network): Covers a city, like a university connecting multiple campuses.
WAN (Wide Area Network): Covers huge distances, the internet itself is the biggest WAN there is.
Key Takeaways
● A network is just devices sharing data using agreed-upon rules.
● Networks are classified by size: LAN, MAN, WAN.
● Understanding networking is the foundation for understanding security, you can’t defend what you don’t understand.
2. The OSI Model
This is the model everyone loves to hate because they made us memorize it for exams without really explaining why it matters. So let me try to actually explain why.
Purpose
The OSI (Open Systems Interconnection) model breaks down the entire process of network communication into 7 separate layers. Why bother? Because if everything happened in one giant blob, troubleshooting would be a nightmare, and every company would build incompatible systems. By splitting communication into layers, engineers can work on one layer without worrying about the others. It’s basically the “separation of concerns” idea, applied to networking.
Think of it like a company with departments. Sales don’t need to know how accounting does its job, they just need to know how to hand off information to them properly. Same with OSI layers.
The 7 Layers (from top to bottom)
1) Application Layer: This is where you, the human, interact with the network. Browsers, email clients, chat apps. Example: when you open Gmail, that’s the Application layer at work.
2) Presentation Layer: Handles formatting, encryption, and compression. It makes sure data sent by one system can be understood by another. Example: converting data to/from formats like JPEG or SSL encryption happening here.
3) Session Layer: Manages the “session” or conversation between two devices, starting it, keeping it alive, and closing it properly. Example: when you’re on a video call, this layer keeps that connection alive until you hang up.
4) Transport Layer: Responsible for reliable delivery of data, breaking it into segments, and reassembling it. TCP and UDP live here. Example: TCP making sure every packet of a downloaded file arrives and in order.
5) Network Layer: Handles logical addressing (IP addresses) and routing, deciding the best path for data to travel. Example: your router deciding whether to send a packet to your neighbor’s network or to Google’s servers.
6) Data Link Layer: Deals with physical addressing (MAC addresses) and how data is framed for transmission on the local network. Example: your Wi-Fi card talking to your router using MAC addresses.
7) Physical Layer: The actual hardware, cables, radio signals, voltages, the literal bits traveling as electricity or light. Example: the Ethernet cable or Wi-Fi signal carrying your data.
A trick I used to remember this (bottom to top): “Please Do Not Throw Sausage Pizza Away.”
Key Takeaways
• OSI has 7 layers, each with a specific job.
• It’s a reference model, real-world systems don’t always follow it exactly, but it’s great for understanding and troubleshooting.
• When something breaks, thinking “which layer is this problem in?” actually helps narrow down the issue.
3. The TCP/IP Model
Here’s the thing nobody tells you clearly enough: the internet doesn’t actually run on OSI. It runs on TCP/IP. OSI is more of a teaching tool; TCP/IP is what’s implemented.
The Layers
TCP/IP condenses OSI’s 7 layers into 4 (sometimes described as 5):
● Application Layer: Combines OSI’s Application, Presentation, and Session layers. HTTP, FTP, DNS, SMTP all live here.
● Transport Layer: Same idea as OSI, TCP and UDP.
● Internet Layer: Equivalent to OSI’s Network layer. Handles IP addressing and routing.
● Network Access Layer (also called Link Layer): Combines OSI’s Data Link and Physical layers.
OSI vs TCP/IP, What’s the Actual Difference?
OSI is a theoretical model and has 7 layers, while
TCP/IP is practical model and has 4 layers
The way I explain it to myself: OSI is like a very detailed textbook diagram of how a car engine should work in theory, while TCP/IP is the actual engine running in the car you drive every day.
Key Takeaways
● TCP/IP is what actually powers the internet.
● It has 4 layers instead of OSI’s 7, by merging similar layers together.
● Knowing both models helps you translate between “theory” (OSI) and “practice” (TCP/IP) when discussing networking issues.
4. Internet Protocol (IP)
This is where things get more technical, but also more interesting because this is the part that’s directly tied to how devices are identified and how attacks like spoofing actually work.
IPv4 vs IPv6
IPv4 is the addressing system we’ve used for decades. It looks like 192.168.1.1, four numbers separated by dots, each ranging from 0 to 255. The problem? IPv4 only supports about 4.3 billion addresses, and with billions of phones, laptops, IoT devices, and smart fridges out there, we’ve basically run out.
IPv6 was created to fix this. It looks like 2001:0db8:85a3:0000:0000:8a2e:0370:7334, much longer, using hexadecimal instead of decimal, giving us an almost unlimited number of addresses (trillions upon trillions).
Public vs Private IP
● Public IP: The address your network uses to communicate with the outside world (the internet). It’s unique globally. Your ISP assigns this.
● Private IP: The address your device uses inside your local network (like your home Wi-Fi). Ranges like 192.168.x.x or 10.x.x.x are reserved for private use and aren’t routable on the internet directly.
Example: Your laptop might have private IP 192.168.1.5 at home, but when you visit a website, that website sees your router’s public IP, not your private one, because of NAT (Network Address Translation).
Static vs Dynamic IP
● Static IP: Manually assigned and doesn’t change. Useful for servers that need a consistent address (like a company’s web server).
● Dynamic IP: Automatically assigned by a DHCP server and can change over time. Most home devices use this.
Switch vs Router
This confused me for the longest time, so here’s the simplest explanation I’ve got:
● A switch connects devices within the same local network and forwards data using MAC addresses. Think of it as the traffic controller inside one building.
● A router connects different networks together (like your home network to the internet) and forwards data using IP addresses. Think of it as the road connecting your building to the rest of the city.
IP Datagram (The Important Fields, Simplified)
An IP datagram (packet) has a header full of fields, but here are the ones that actually matter to understand:
● Source IP / Destination IP: Who sent it, who it’s going to.
● TTL (Time to Live): A countdown number decreases every time the packet passes through a router. When it hits zero, the packet is dropped. This prevents packets from looping forever.
● Protocol: Tells the receiving device what’s inside (TCP? UDP? ICMP?).
● Header Checksum: A quick error-check to make sure the header wasn’t corrupted in transit.
● Fragmentation fields (Identification, Flags, Fragment Offset): Used when a packet is too big and needs to be split up (explained next).
Fragmentation and Reassembly
Sometimes a packet is bigger than the network path can carry in one piece. When that happens, the packet gets fragmented, broken into smaller pieces, and sent separately. The receiving device then reassembles them back into the original packet using the Identification and Fragment Offset fields I mentioned above.
Real-world analogy: imagine mailing a huge poster that doesn’t fit in one envelope, so you cut it into strips, number them, and mail them separately. The person receiving them tapes the strips back together in order.
MTU (Maximum Transmission Unit)
MTU is simply the largest size a packet is allowed to be on a given network without needing fragmentation. Standard Ethernet MTU is usually 1500 bytes. If your data is bigger than the MTU, it gets fragmented.
Reliable Data Transport (RDT 1.0, 2.0, 3.0)
This part is more theoretical, but it’s the foundation of how TCP achieves reliability over an unreliable network.
● RDT 1.0: The simplest case, assumes a perfectly reliable channel with no errors, no loss. Data just gets sent and received, no acknowledgments needed. (This basically never happens in real networks, but it’s the starting point for the theory.)
● RDT 2.0: Introduces the idea that the channel can have bit errors. So now the receiver sends back an ACK (acknowledgment: “I got it fine”) or NAK (negative acknowledgment: “something’s wrong, resend it”). This is like texting someone and them replying “got it” or “didn’t get that, say again.”
● RDT 3.0: Adds the assumption that the channel can also lose packets entirely, not just corrupt them. To handle this, a timer is introduced, if the sender doesn’t get an ACK within a certain time, it assumes the packet was lost and resends it automatically.
This step-by-step evolution is basically how TCP’s reliability mechanism was built, acknowledgments, checksums, and timeouts working together.
Key Takeaways
● IPv4 is running out; IPv6 is the long-term fix.
● Private IPs stay inside your network; public IPs are how you’re seen on the internet.
● Switches work within a network; routers connect different networks.
● TTL, fragmentation, and MTU exist to keep data moving efficiently and prevent network chaos.
● RDT 1.0 à 3.0 shows how reliability is built step-by-step: from “assume nothing goes wrong” to “handle errors and losses with ACKs and timers.”
5. Networking Protocols
This is the part that felt the most “practical” to me during the internship, because these protocols show up constantly in logs, packet captures, and security tools like Wireshark.
● TCP (Transmission Control Protocol): Connection-oriented, reliable. It confirms delivery through a handshake (SYN, SYN-ACK, ACK) and resends lost data. Used for things where accuracy matters more than speed, like loading a webpage or transferring a file.
● UDP (User Datagram Protocol): Connectionless, faster but unreliable, no guarantee data arrives or arrives in order. Used where speed matters more than perfection, like video calls or online gaming.
● DHCP (Dynamic Host Configuration Protocol): Port 67/68: Automatically assigns IP addresses to devices joining a network, so you don’t have to configure it manually.
● DNS (Domain Name System): Port 53: Translates domain names (like google.com) into IP addresses. Basically the internet’s phonebook.
● ARP (Address Resolution Protocol): Maps an IP address to a MAC address within a local network. When your laptop wants to talk to another device on the same network, it uses ARP to find its physical hardware address.
● FTP (File Transfer Protocol): Ports 20/21: Used to transfer files between computers. Not secure by default, sends data in plain text.
● SFTP (SSH File Transfer Protocol): Port 22: Like FTP, but encrypted using SSH. Much safer choice for transferring sensitive files.
● SMB (Server Message Block): Port 445: Used mainly in Windows environments for sharing files, printers, and other resources across a network.
● SMTP (Simple Mail Transfer Protocol): Port 25: Used for sending emails from a client to a server, or between mail servers.
● POP3 (Post Office Protocol v3): Port 110: Downloads emails from a server to your device, usually removing them from the server afterward.
● IMAP (Internet Message Access Protocol): Port 143: Similar to POP3 but keeps emails synced on the server, so you can access them from multiple devices.
● HTTP (HyperText Transfer Protocol): Port 80: The protocol behind normal web browsing. Not encrypted.
● HTTPS (HTTP Secure): Port 443: Same as HTTP but encrypted using TLS/SSL. This is why you always want to see the padlock icon in your browser.
● SSH (Secure Shell): Port 22: Lets you securely log into and control a remote machine through an encrypted connection. A must-know for anyone in cybersecurity or sysadmin work.
● Telnet: Port 23: The older, unencrypted version of remote login. Basically deprecated for security reasons since anyone sniffing the network can see your credentials in plain text.
● SNMP (Simple Network Management Protocol): Port 161/162: Used to monitor and manage network devices like routers and switches.
● LDAP (Lightweight Directory Access Protocol): Port 389: Used to access and manage directory information, like a company’s list of employee accounts (common in Active Directory environments).
● NTP (Network Time Protocol): Port 123: Synchronizes the clocks of devices across a network. Sounds boring but it’s actually critical, a lot of security logging and authentication breaks if device clocks are out of sync.
Key Takeaways
● TCP = reliable but slower. UDP = fast but no guarantees.
● Know your ports, they show up everywhere in security tools and firewall rules.
● Prefer encrypted versions of protocols (HTTPS over HTTP, SFTP over FTP, SSH over Telnet) whenever possible.
6. Subnetting
6. Subnetting
Honestly, subnetting is one of those topics that sounds scarier than it actually is once you get the logic.
What Is Subnetting?
Subnetting is the process of dividing one big network into smaller, more manageable sub-networks (subnets). Instead of having thousands of devices on one giant flat network, you split it into smaller pieces.
Why It’s Used and Its Benefits
- Better organization: Different departments (HR, Finance, IT) can each have their own subnet.
- Improved security: You can isolate sensitive systems into their own subnet and control traffic between subnets with firewalls.
- Reduced broadcast traffic: Smaller networks mean less noise, since broadcast messages don’t have to flood the entire organization.
- Efficient IP usage: You avoid wasting IP addresses on networks that don’t need that many.
CIDR Notation
CIDR (Classless Inter-Domain Routing) notation is that slash-number you always see after an IP, like 192.168.1.0/24. That /24 tells you how many bits are used for the network portion of the address. The more bits used for the network, the fewer are left for hosts (individual devices).
Network ID and Host ID
Every IP address is really made of two parts:
- Network ID: Identifies which network the device belongs to.
- Host ID: Identifies the specific device within that network.
In 192.168.1.0/24, the first 24 bits (192.168.1) are the network ID, and the remaining 8 bits are available for host IDs, giving you up to 254 usable devices on that subnet.
An Easy Example First
Get Shamaym Asim’s stories in your inbox
Join Medium for free to get updates from this writer.
Before jumping into anything complicated, let’s start with a simple example.
Imagine your teacher gives you one network:
192.168.1.0/24
and says:
“Split this network into 2 smaller networks (subnets).”
Think of it like having one large classroom that needs to be divided into two equal classrooms.
Step 1: Understand the Original Network
The network is:
192.168.1.0/24
The /24 means that:
- The first 24 bits are used for the Network ID.
- The remaining 8 bits are used for the Host ID.
Since IPv4 addresses are 32 bits long, the number of host bits is:
32 − 24 = 8 bits
To calculate the total number of addresses, we use the formula:
Total Addresses = 2^(Host Bits)
So,
2^(32−24) = 2⁸ = 256 addresses
These addresses range from:
192.168.1.0 to 192.168.1.255
Among these:
- 192.168.1.0 is the Network Address.
- 192.168.1.255 is the Broadcast Address.
Therefore, the number of usable host addresses is:
256 − 2 = 254 usable hosts
Step 2: Create 2 Subnets
We now need to split this network into 2 equal subnets.
The number of subnets is calculated using:
Number of Subnets = 2^(Borrowed Bits)
Since we need 2 subnets:
2¹ = 2
This means we only need to borrow 1 bit from the host portion.
As a result:
- Original prefix = /24
- New prefix = /25
The subnet mask changes from:
255.255.255.0 → 255.255.255.128
Step 3: Calculate the Size of Each Subnet
After borrowing one bit:
- Network bits = 25
- Host bits = 7
The total addresses in each subnet are:
2⁷ = 128 addresses
Each subnet contains:
- 1 Network Address
- 1 Broadcast Address
Therefore:
128 − 2 = 126 usable host addresses
Step 4: First Subnet
The first subnet starts from the beginning of the original network.
Network Address: 192.168.1.0/25
Range:
- Network Address: 192.168.1.0
- First Host: 192.168.1.1
- Last Host: 192.168.1.126
- Broadcast Address: 192.168.1.127
So the usable host range is:
192.168.1.1–192.168.1.126
Step 5: Second Subnet
The first subnet ends at 192.168.1.127, so the second subnet begins at the next address.
Network Address: 192.168.1.128/25
Range:
- Network Address: 192.168.1.128
- First Host: 192.168.1.129
- Last Host: 192.168.1.254
- Broadcast Address: 192.168.1.255
So the usable host range is:
192.168.1.129–192.168.1.254
Key Takeaways
● Subnetting = dividing a big network into smaller, controlled pieces.
● CIDR notation tells you how the address space is split between network and host.
● Subnetting improves security, organization, and efficient IP usage.
7. Networking Concepts
Client-Server Architecture
One central server provides resources or services, and multiple clients request them. Example: your browser (client) requesting a webpage from a web server.
Peer-to-Peer (P2P)
No central server, every device (peer) can act as both client and server, sharing resources directly with each other. Example: torrenting, where you download pieces of a file from other users, not one central server.
Hybrid Architecture
A mix of both, some services run through a central server while others happen directly between peers. Example: many modern apps use a central server for login/authentication but P2P for the actual data (like some video call apps).
Sockets
A socket is basically the “endpoint” of a communication, a combination of an IP address and a port number. It’s what lets your application know exactly where to send and receive data. Think of it as a phone number + extension for a specific app on a specific device.
Routing vs Forwarding
• Routing is the process of figuring out the best path for data to take across a network (this is the “big picture” decision-making).
• Forwarding is the actual action of moving a packet from an input port to the correct output port on a router, based on the routing decision already made.
Simple way to remember it: routing = planning the route, forwarding = actually driving the car along that route.
Network Layer vs Transport Layer
• Network Layer handles addressing and routing between different networks (IP addresses, routers).
• Transport Layer handles the actual delivery of data between applications on those devices (ports, TCP/UDP, reliability).
Basically: Network layer gets the data to the right device, Transport layer gets it to the right application on that device.
Multiplexing and Demultiplexing
• Multiplexing: Combining data from multiple applications on a sending device into a single stream to be sent over the network (each gets tagged with a port number).
• Demultiplexing: The receiving device splitting that stream back apart and delivering each piece to the correct application, based on port numbers.
Example: You might have a browser, a game, and Spotify all sending/receiving data at the same time. Multiplexing/demultiplexing is how your device keeps all that traffic sorted correctly using ports.
Connectionless vs Connection-Oriented Demultiplexing
Connectionless Demultiplexing (UDP): Data is delivered to a socket based solely on the destination IP and port, it doesn’t care who the sender is specifically.
Connection-Oriented Demultiplexing (TCP): Data is delivered based on a full 4-tuple, source IP, source port, destination IP, and destination port. This allows a server to distinguish between multiple simultaneous connections from different clients (or even the same client on different ports).
Key Takeaways
● Client-server = centralized;
● P2P = decentralized; hybrid = a mix of both.
● Sockets = IP + port, the actual communication endpoint.
● Routing decides the path; forwarding executes it.
● Multiplexing/demultiplexing use ports to keep multiple apps’ data organized on the same connection.
8. Common Network Attacks
This is the section that ties everything back to why I’m doing a cybersecurity internship in the first place. Once you understand how networking actually works, these attacks make a lot more sense, because most of them are just abusing trust built into these protocols.
● DoS (Denial of Service): One attacker floods a target with traffic or requests, overwhelming it so legitimate users can’t access it.
● DDoS (Distributed Denial of Service): Same idea as DoS, but using many devices (often a botnet) at once, making it much harder to block or trace.
● Man-in-the-Middle (MITM): An attacker secretly intercepts communication between two parties, potentially reading or altering the data without either side knowing.
● ARP Spoofing: The attacker sends fake ARP messages to associate their own MAC address with another device’s IP address on the local network, tricking devices into sending traffic to the attacker instead of the real destination.
● DNS Spoofing (DNS Cache Poisoning): The attacker corrupts DNS records so that a domain name resolves to a malicious IP address instead of the real one, redirecting users to fake websites.
● Packet Sniffing: Capturing and analyzing network traffic, often to steal sensitive data like passwords, especially on unencrypted protocols like HTTP or Telnet.
● Phishing: Tricking users into revealing sensitive information (passwords, card details) through fake emails, messages, or websites that look legitimate.
● Malware: Malicious software designed to damage, disrupt, or gain unauthorized access to systems, includes viruses, worms, ransomware, trojans, and spyware.
Basic Prevention Methods
● Use encrypted protocols (HTTPS, SFTP, SSH) instead of their unencrypted counterparts.
● Implement firewalls and intrusion detection/prevention systems (IDS/IPS).
● Enable network segmentation (this is literally why subnetting matters for security too).
● Keep systems patched and updated regularly.
● Use strong authentication (MFA where possible).
● Train users to recognize phishing attempts, because humans are usually the weakest link, not the technology.
● Monitor network traffic for unusual patterns.
Key Takeaways
• Most network attacks exploit trust built into protocols that weren’t designed with security in mind (like ARP and DNS).
• Encryption and segmentation are two of the most effective, practical defenses.
• Security isn’t just about tools, user awareness matters just as much.
9. Conclusion
Writing this out honestly helped me connect the dots way better than just re-reading my notes ever did. Networking isn’t just a bunch of layers and acronyms to memorize for an exam, it’s the actual plumbing that every cybersecurity concept sits on top of. You can’t understand a Man-in-the-Middle attack without understanding ARP. You can’t understand why HTTPS matters without understanding HTTP and TCP. It all connects.
If there’s one thing I’d tell a junior version of myself starting this module, it’d be: don’t just memorize the OSI layers, actually think about why each layer exists and what problem it solves. That mindset made everything else in this module click a lot faster.
That’s the complete networking module, from the very basics of what a network is, all the way to how attackers exploit weaknesses in these systems. Hopefully this made it a little less intimidating for anyone else going through the same material.
10. References
[1] J. F. Kurose and K. W. Ross, Computer Networking: A Top-Down Approach, 8th ed. Boston, MA, USA: Pearson, 2021.
[2] Cisco Networking Academy, “CCNA Certification Course Materials,” Cisco Systems, Inc., 2023. [Online]. Available: https://www.netacad.com
[3] Internet Engineering Task Force (IETF), “RFC Editor,” IETF. [Online]. Available: https://www.rfc-editor.org
[4] [Your Name], “Computer Networking Module — Lecture Notes and Lab Exercises,” BS Cyber Security Program, [Your University Name], 2026, unpublished.
[5] [Company/Organization Name], “Cybersecurity Internship — Mentorship and Training Sessions,” 2026, unpublished.
