TCP/IP Model and Common Ports

The OSI (Open Systems Interconnection) model divides network communication into seven layers: Physical, Data Link, Network, Transport, Session, Presentation, and Application. Each layer serves a distinct purpose and communicates only with the layers directly above and below it. Security controls can be applied at any layer, so understanding the model helps you identify where a given attack or defense operates. The mnemonic Please Do Not Throw Sausage Pizza Away helps you recall the layers from bottom to top.

The TCP/IP model (also called the DoD model) condenses the OSI layers into four: Network Access (OSI layers 1-2), Internet (OSI layer 3), Transport (OSI layer 4), and Application (OSI layers 5-7). Most real-world networking and security analysis uses TCP/IP terminology. Understanding the mapping between both models is essential for Security+ because exam questions may reference either one when describing where an attack or control operates.

IP addresses uniquely identify devices on a network. IPv4 uses 32-bit addresses written in dotted-decimal notation (e.g., 192.168.1.10), while IPv6 uses 128-bit addresses. A subnet mask determines which portion of an address identifies the network versus the host. CIDR notation (e.g., /24) expresses the subnet mask compactly. Security professionals use subnets to segment networks and restrict traffic flow between zones of trust.

Before data is exchanged over TCP, a three-way handshake establishes a connection: the client sends a SYN, the server replies with a SYN-ACK, and the client completes the process with an ACK. Attackers exploit this sequence in SYN flood DoS attacks by sending many SYN packets without completing the handshake, exhausting server resources. Understanding normal handshake behavior helps analysts spot anomalies in packet captures and SIEM logs.

UDP (User Datagram Protocol) is a connectionless transport protocol that sends packets without establishing a session first. It is faster but less reliable than TCP because there is no acknowledgment or retransmission. Services like DNS, DHCP, NTP, and SNMP use UDP because low latency matters more than guaranteed delivery. Security implications include UDP-based amplification attacks, where small requests generate large responses that overwhelm victims.

Well-known ports (0-1023) are reserved for common services and assigned by IANA. Memorizing the most important ones is essential for the Security+ exam. Port 22 is SSH, port 443 is HTTPS, port 80 is HTTP, port 25 is SMTP, and port 53 is DNS. Knowing which port a service uses helps analysts distinguish legitimate traffic from attacks and write accurate firewall rules.

Registered ports (1024-49151) are used by applications that require a consistent but non-privileged port. Examples include 3389 (RDP), 3306 (MySQL), 1433 (MSSQL), and 8080 (HTTP alternate). Dynamic (ephemeral) ports (49152-65535) are assigned temporarily by the OS to client-side connections. Attackers sometimes run malicious services on high-numbered ports to avoid firewall rules that only block well-known ports.

ICMP (Internet Control Message Protocol) is used for diagnostics and error reporting. The ping command uses ICMP Echo Request/Reply to test reachability. While useful, ICMP can be exploited: ping sweeps discover live hosts, ICMP redirect messages can manipulate routing tables, and covert channels can tunnel data inside ICMP payloads. Many organizations block ICMP at the perimeter while allowing it internally for troubleshooting.

ARP (Address Resolution Protocol) maps IP addresses to MAC addresses on a local network segment. When a host wants to send traffic to 192.168.1.1, it broadcasts an ARP request asking 'Who has 192.168.1.1?' and the owner replies with its MAC address. ARP has no authentication, making it vulnerable to ARP spoofing (also called ARP poisoning), where an attacker sends fake ARP replies to redirect traffic through their machine for man-in-the-middle attacks.

DNS (Domain Name System) translates human-readable hostnames (www.example.com) into IP addresses. A DNS query travels through a hierarchy: the client queries a recursive resolver, which queries root servers, then TLD servers, then authoritative nameservers. Security implications are significant: DNS cache poisoning inserts fake records, DNS tunneling encodes data in queries to exfiltrate data or reach C2 servers, and typosquatting registers lookalike domains to phish users.

Two essential tools for analyzing TCP/IP traffic are Wireshark and Nmap. Wireshark is a packet analyzer that lets you inspect individual frames, filter by protocol, and follow TCP streams to reconstruct sessions. Nmap is a network scanner that identifies live hosts, open ports, running services, and OS versions. Together they give security professionals visibility into what is actually traversing a network, enabling anomaly detection and confirming firewall rules work as intended.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: the OSI and TCP/IP models describe network layers where security controls operate, well-known ports (0-1023) identify common services and must be memorized for the exam, and protocols like ARP, DNS, and ICMP each carry unique security risks including spoofing, cache poisoning, and tunneling. Next up we explore firewalls and how they filter network traffic.