The TCP/IP Model and IPv4 Addressing

In the first course of this track you learned how attackers think and how to protect your own digital life. Now we open the hood. Almost every attack you read about travels over a network, so before you can understand it, test it or defend against it, you need to know how data actually moves from one machine to another. This lesson gives you the two ideas everything else rests on: layers, and addresses.

Throughout this course you will build your own virtual laboratory, a small private network of machines that you can break, repair and observe without hurting anyone. The first chapters give you the vocabulary. From chapter 3 on, you will put it to work. To keep track of what you learn, start a lab notebook now: a plain text file or a paper notebook where you will write down every command you run and what you observed. Professionals do exactly the same thing.

Why a network is built in layers

Imagine sending a parcel to a friend in another country. You write a letter, put it in an envelope, and write an address on it. A postal worker puts it in a bag, a truck drives the bag to an airport, a plane carries it across the sea, and another postal worker delivers it. You do not need to know how planes work, and the pilot does not need to read your letter. Each step does one job and trusts the neighbouring steps to do theirs.

Networks work the same way. Instead of one giant program that does everything, communication is split into layers. Each layer offers a service to the layer above it and uses the services of the layer below. If you replace Wi-Fi with an Ethernet cable, the layers above do not even notice.

The TCP/IP model in four layers

The model used in practice on the Internet is called TCP/IP. It is usually described with four layers, from top to bottom:

Layer	Job	Examples
Application	What the programs say to each other	HTTP, DNS, SSH, SMTP
Transport	Delivering data to the right program, reliably or not	TCP, UDP
Internet	Finding a path between networks using addresses	IP (IPv4, IPv6), ICMP
Link (network access)	Moving bits between two neighbouring devices	Ethernet, Wi-Fi, MAC addresses

You may also meet the older OSI model, which has seven layers. Security people often use its numbering as a shorthand: "layer 2" means the link layer (switches, MAC addresses), "layer 3" means IP and routing, "layer 4" means TCP and UDP, and "layer 7" means the application. Do not worry about memorising the full OSI list; knowing how the two models line up is enough.

Encapsulation: envelopes inside envelopes

When your browser sends a request, the data is wrapped several times on its way out. The application produces a message. The transport layer adds a header with port numbers. The internet layer adds a header with source and destination IP addresses. The link layer adds a header with MAC addresses and sends the result on the wire. This wrapping is called encapsulation. On the receiving side, each layer removes its own header and passes the content upward.

This matters for security because every header is a place where information is exposed, and every layer is a place where something can go wrong. When you open a packet capture in chapter 2, you will see these layers stacked exactly like this.

TCP and UDP in one minute

TCP is the careful courier. Before sending data it performs a "three-way handshake" (SYN, SYN-ACK, ACK) to check that both sides are ready, then numbers the data, checks that it arrived and resends what is lost. Web pages, email and file transfers use TCP. UDP is the postcard: no handshake, no guarantee, but very low overhead. It suits things where speed matters more than perfection, such as DNS queries, voice calls and live video.

IPv4 addresses

An IPv4 address identifies a network interface. It is a 32-bit number, written as four numbers between 0 and 255 separated by dots, for example 192.168.1.25. Each of the four numbers is called an octet because it is stored on 8 bits. An address has two logical parts: the network part (which street) and the host part (which house).

How do we know where the street ends and the house begins? With a subnet mask. A mask such as 255.255.255.0 says "the first three octets are the network, the last one is the host". The same information can be written in a shorter form called CIDR notation: 192.168.1.25/24, where 24 is the number of bits used by the network part.

Address  : 192.168.1.25
Mask     : 255.255.255.0   (/24)
Network  : 192.168.1.0
Hosts    : 192.168.1.1 to 192.168.1.254
Broadcast: 192.168.1.255

In a /24 network, the first address (.0) names the network itself and the last one (.255) is the broadcast address, which means "everyone on this network". That leaves 254 addresses for devices. Two machines can talk directly to each other only if they share the same network part. Otherwise, they need a router, which is the subject of the fourth lesson of this chapter.

Classes, and why you can mostly forget them

In the early days of the Internet, addresses were split into fixed classes. Class A used the first octet as the network, class B the first two, class C the first three. You will still see this vocabulary in textbooks and certification exams, so here is the short version:

• Class A: first octet from 1 to 126, default mask 255.0.0.0 (/8).
• Class B: first octet from 128 to 191, default mask 255.255.0.0 (/16).
• Class C: first octet from 192 to 223, default mask 255.255.255.0 (/24).

Today the Internet uses classless addressing (CIDR), which means any mask length can be used. A /26 or a /22 is perfectly normal. Think in terms of "address plus prefix length" rather than classes.

Private, special and public addresses

Some ranges are reserved for private networks and are never routed on the public Internet. Your home router and your lab will use them:

• 10.0.0.0/8
• 172.16.0.0/12 (from 172.16.0.0 to 172.31.255.255)
• 192.168.0.0/16

Other special addresses are worth recognising. 127.0.0.1 is the loopback: it always means "this very machine". An address starting with 169.254 is a link-local address that a machine gives itself when it could not get one from a server. And the ranges 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24 are reserved for documentation, which is why you will see them in examples. Everything else is generally a public address assigned to someone on the Internet.

Because many private networks share the same ranges, your home devices reach the Internet through NAT (Network Address Translation): your router replaces your private address with its own public address on the way out and remembers who asked for what. This is why every home looks the same from the inside, with 192.168.x.x addresses, while the outside sees only the router.

How machines get an address: DHCP

You rarely type an IP address by hand. When your laptop joins a network, it broadcasts a request and a DHCP server answers with an address, a mask, a default gateway (the router to use for everything outside the network) and the address of a DNS server. We will see in chapter 2 how easily this conversation can be observed.

Your turn: read your own network configuration

Open a terminal (Terminal on macOS, a console on Linux, PowerShell or Command Prompt on Windows) on your own computer and display your configuration:

# Linux
ip addr show

# macOS
ifconfig

# Windows
ipconfig

In your lab notebook, write down: the IPv4 address of your active interface, its mask or prefix length, the network address and broadcast address that follow from it, and your default gateway (on Linux, ip route shows it; on Windows, ipconfig lists it). Finally, say whether your address is private, and which range it belongs to.

See a solution

Suppose the output shows inet 192.168.1.42/24 and a default route via 192.168.1.1. Then the mask is 255.255.255.0, the network address is 192.168.1.0, the broadcast address is 192.168.1.255 and the gateway is 192.168.1.1, which is typically your router. The address is private because it belongs to 192.168.0.0/16. If your own values differ, apply the same reasoning: with a /24, keep the first three octets for the network and replace the last one with 0 (network) or 255 (broadcast).

Bonus: with a /26 mask (255.255.255.192), the host part has 6 bits, so each subnet holds 64 addresses, of which 62 are usable. Try to work out in which /26 subnet 192.168.1.100 lies: the subnets start at .0, .64, .128 and .192, so it is in 192.168.1.64/26.